Subject: FW: MAC based filters and DHCP

From: "Simpson, John R" <[email-masked]>
Date: Tue, 26 Oct 1999 13:22:28 -0400 (EDT)

> Greetings,
     I tried to send this to the DHCP-INTEREST list, but I ran into some
administrative issues that are still being worked out.

>      What's the best way to ignore client requests based on manufacturer
> MAC identifier when using the ISC DHCP server?  Is it possible with
> version 2, or do I need to use the beta version 3?  We've got some
> terminal servers that use BOOTP with the DHCP option enabled and we want
> the DHCP server to ignore their requests.  A filter based on the first
> three bytes of their MAC address would do it, but I haven't figured out
> how to implement it yet.  I've learned a lot by reading through the man
> pages included with the source distribution, and just ordered the DHCP
> book by Ralph Droms & Ted Lemon -- DHCP is a lot more feature-rich than
> the last time I worked with it.
> 
>       There are some features in both the version 2 and version 3
> dhcp.conf  man pages that look promising, but I haven't found anything
> that explicitly shows using a partial MAC address to deny a request.  What
> am I (hopefully) missing?
> 
> Thanks in advance,
> 
> John Simpson
> ------------------------------------------------
> John R. Simpson                                  (937) 485-2269
> IVDS Network Architecture             (fax) (937) 485-2427
> Reynolds and Reynolds  mailto:[email-masked]
>

---

From: Ted Lemon <[email-masked]>
Date: Tue, 26 Oct 1999 16:05:02 -0400 (EDT)

The answer is that you can do that in 2.0 and 3.0 - just write host
declarations, as described in the documentation and in the sample
dhcpd.conf file (don't put in a fixed-address declaration if you don't
need one), and then write "deny unknown-clients;" at the top of the
configuration file.   If you need to ignore requests based on the
first three bytes of the MAC address, you'd do that like so (only in
3.0):

if substring (hardware, 1, 3) = xx:xx:xx {
  deny booting;
}

Where xx:xx:xx is the three-byte manufacturer code.   If you're going
to support a lot of manufacturer codes, I'd suggest this:

class "ignore" {
  match substring (hardware, 1, 3);
  deny booting;
}

subclass "ignore" xx:xx:xx;
subclass "ignore" yy:yy:yy;

et cetera.  The advantage of the last choice, for large numbers of
manufacturer IDs, is that the comparison is hashed, so you don't have
to compare as many keys, and so it's quicker.

I thought I'd replied to you last time I saw your query - I'm sorry if
I didn't!   :'}

			       _MelloN_