ARP overwritten DOS

[CyberNerd]

This morning - in the middle of an A2 ICT exam, we had a serious problem with a laptop assuming the ip addressess of (almost) every network switch.

lots of arp overwritten messages brought us quickly to the culprit - a student's personal laptop

 

arp info overwritten for 172.16.254.240 by 00:12:bf:0e:xx:xx
arp info overwritten for 172.16.254.250 by 00:0e:6a:90:xx:xx
arp info overwritten for 172.16.254.249 by 00:12:bf:0e:xx:xx

 

Any ideas what could have caused this? hardware error?

To me it looks like the sort of thing a virus should do but scanning it shows nothing so far and we don't believe the student did it maliciously.

 

I appreciate the solution to this is to have a policy for laptops and segregate the wireless network with VLANs - but these things require time and don't have enough flashy lights for management to pay interest in around here.

[Geoff]

Bad drivers or student deliberatly instructing his laptop to do evil things.