Block a particular IP address

[tech40]

How can I block a specific IP address on a network?
These are not options:
1. Denial of service attack.
2. Use IP address on another adapter to get duplicate ip error message.

I am attempting to stop activity from a particular computer on my network.

 

[smah]

This needs to be something more sophisticated than "unplug it"?

What exactly are you trying to block and how is your network set up?

 

[tech40]

What I am trying to do is locate the physical computer that has the ip address. I can get the mac address through the ARP command and I can get the NETBIOS name through the NBTSTAT command but I would these do not help me other than getting the brand of the NIC and the OS computer name. I just want to stop all network access through a switched network so the user has to ask someone for assistance.

 

[IFRs]

Can your router filter MAC adresses?

 

[rfr100]

Have you done a tracert ?
At least then you can find what switch it's on. Might help in narrowing down the location of the offending machine.

The other option, depending on site size and NOS is to check the Security Logs for Logon/Logoff events. Trawling the logs you will (eventually) find the logon from that machine/IP. If you have the logon name you should be able to find the user no problem.

 

[raztaboule]

how many switches have you got ?
you can check the arp tables on the swich and when you find the port where the computer is connected bring it down.
I'm not a good windows administrator but i think you can also get this computer rid of the domaine on PDC.

 

[rfr100]

Good call.

When you find the machine name disable the computer account.

Bet you'll hear about it pretty damn quick.