Student Laptop Stop LAN Use

[karldenton]

Hi,

Current status:

Server 2003

No ISA

DHCP

 

Since changing ISP we don't require a proxy server to access the internet and the filtering is "on the line".

This obivously means that students can unplug network cables from the machines and use there laptops instead. The internet is filtered but I was wondering if there is an easy way to stop them doing it. I have there mac addresses.

Thanks

[karldenton]

Just had a thought. I could probably give them static IP addresses then Ban access to the internet for those IP addresses in the router.

[Cue]

Just had a thought. I could probably give them static IP addresses then Ban access to the internet for those IP addresses in the router.

 

Mac Spoofing is easy as 1, 2, 3 these days, this wouldn't solve much.

[3s-gtech]

An AUP prohibiting this is the first step, along with classroom control. Are teachers allowing it in their lessons?

[Norphy]

The most obvious way I can see is to implement 802.1x authenication on your switches assuming that they support it.

[plexer]

Install the mac callout filter on your dhcp server then you can deny their mac addresses getting an ip, yes they could spoof the mac address of the machine they just unplugged but it's unlikely tbh.

 

Ben

[karldenton]

No these are not in lessons, its a residential school so they are doing it on a night.

Our kids are not clever enough to do mac spoofing for sure.

[karldenton]

Install the mac callout filter on your dhcp server then you can deny their mac addresses getting an ip, yes they could spoof the mac address of the machine they just unplugged but it's unlikely tbh.

 

Ben

 

Have you got any more help with this please. Do you set it up in DHCP on the server ?

[Roberto]

Of course, just because your current connection doesn't require a proxy server currently, that doesn't stop you adding one of your own and requiring it's use.

[p858snake]

I would setup a "public" wifi for them to use and just filter it with your own proxy.

 

Just because you don't need a proxy inbetween your connection anymore doesn't you can't have it and use that for authentication.

[bio]

for windows 2003 you can use :

 

How to Filter MAC Address with Windows Server 2003/2008 DHCP Server Callout DLL

 

for windows 2008 (R2) its buildin

 

bio..

[karldenton]

Ok,

 

Thanks for your replies.

 

Just tried the .dll

 

I've got the mac address of one student's laptop, put it in the text file etc.

 

Tried the internet on their machine and it works ?? IPconfig shows they have been given an address ending in .71 but when I go into DHCP there isn't an assignment to .71

 

The dll log shows:

Mon Nov 29 14:59:48 2010 022****67922 Deny

Mon Nov 29 14:59:48 2010 000****49553 Allow

Mon Nov 29 14:59:51 2010 022****67922 Deny

Mon Nov 29 15:00:44 2010 0019****951b Allow

 

so its denied the address but still works

[waldronm2000]

What access layer switches are you using, and do they support MAC-based port security?

 

Also, if you wanted to use DHCP to solve the problem, create specific reservations for the MAC addresses in question, then override the DHCP Options for these reservations and give them the wrong default gateway and/or DNS. Alternatively, filter the reserved IP addresses at the router.