We gave every user a static local IP address, bound them with their MAC addresses, and provided them access to different resources.

But, a user has spoofed their MAC address to connect using another IP address, causing a conflict. This person is also hogging on the resources allotted to the legitimate user.

I gave the legitimate user a new IP address, but after a few hours its all the same.

How can I retrieve info about the person and identify them?

1 Answer 1


There is no identifying information in an IP packet, except the source and destination IP addresses.

Depending on your switch models, you may be able to look in the switch MAC address tables to identify the switch interface to which the user is connected. You will want the legitimate user to disconnect from the network while you do this, otherwise you will get constantly changing MAC address tables.

  • In case of unmanaged switches, does this round up to this- I can't find the guy?
    – louisl
    Oct 8, 2016 at 18:00
  • If the switch is unmanaged, you can't get into it to look at the MAC address table.
    – Ron Maupin
    Oct 8, 2016 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.