I have Mikrotik RouterOS with hotspot on Intel PC. The computer is connected to switch, and switch is connected to several APs. (user can login using user name and password using HTTP-chap only) .

I have a problem that unauthorized users can scan IP and Mac of active users and change their mac and IP to mach that of the active user to use the internet in the same time. I prevent this on the same AP by using client isolation. I was told that I can buy manged switch to do client isolation and prevent two computer with the same mac and IP.

I enabled client isolation in my AP, and now authorized users can not see the mac and IP of users from the same AP but they still can see the mac and IP of users of other AP. will managed switch solve the problem? ( I will get Dell™ PowerConnect™ 3024 from someone)

http://support.dell.com/support/edocs/n ... /index.htm

It's difficult with most hotspot setups using MAC authentication. The best thing would be to try to find another authentication method.

A managed switch won't really help unless the spoofing is from two different APs that pass through it. If it's on the same AP then the AP itself won't know which is which. That's why the only defense is to use something that requires login credentials from the PC connected to the AP.

It's difficult with most hotspot setups using MAC authentication. The best thing would be to try to find another authentication method.

A managed switch won't really help unless the spoofing is from two different APs that pass through it. If it's on the same AP then the AP itself won't know which is which. That's why the only defense is to use something that requires login credentials from the PC connected to the AP.

user log using user name and password ( I use HTTP chap not Mac for login). The problem that if user A log in. Then user B without logging use netCut or other program to scan IP and mac. Get the IP and Mac of user A. User B change his IP and MAC the same As user A. The internet will work with user B. Two users has the same IP and MAC: one is authorized user that buy the service from me and the other one is unauthorized user that is stealing user A bandwidth.

I discover that unauthorized client can scan IP and Mac using netcut. Then , He or she can change the mac of his WiFi adapter to a Mac address that is the same as an authorized user and the Mikrotik will give him the same IP The user then can use other people internet.

I decide to by this managed switch to solve the problem with NetCut:

used: http://cgi.ebay.com/ws/eBayISAPI.dll?Vi ... 0476757490

Do I need just to create Private VLan for each port and set port going to Mikrotik router as internet port?

Split horizon bridging or bridge firewall. Have used both. Works great for me.

Split horizon bridging or bridge firewall. Have used both. Works great for me.

I have the a PC computer with one ethernet port lan not RB493AH. so I have one port for lan.

With a proper managed switch you will have a bit more control over the network than you will with just a MikroTik acting like a switch.

For the managed switch, you get a device that is designed to be a switch and all of the features that come along with that. Things like how it handles VLANs, and you can put ports into protected mode, the rough equivalent of layer 2 isolation on the AP. You also get all of the ports that you need. If a 493 will cover all of the ports you need for your hotspot, then the horizon option on a bridge will work well. RouterOS is first and foremost what it's name implies, a router, it is not designed to be a switch.

Keep this in mind however, all of these options are only preventing clients from talking to each other over the devices/network itself. This will not prevent someone from sniffing wireless traffic and grabbing the IP and MAC off of them directly and then changing their settings accordingly. This is the nature of wireless, you broadcast everything you are sending and receiving so anyone in range can pick up what is being sent. This is especially true with wireless in a hotspot situation where the more complicated you make it for users to connect to the network, the more you have to pay for support on the network and troubleshooting issues, so it is often not very cost effective to set up encryption on the network instead of just living with people stealing access that way.

Does this managed switch help:
http://flkoliv.com/index.php?q=aHR0cDov ... eC5odG0%3D
?

No switch is ever going to help with someone impersonating another client on the same AP.

No switch is ever going to help with someone impersonating another client on the same AP.

I have no problem with the same AP. User can get IP and MAC of other AP but they can't get the one on the same AP.

I connect to one AP and open NetCut. I can see the mac and IP of users from other AP but I can not see the one from AP that I am connected to.

Take smart smitch. Let's assume that you have 3 APs and one PC router. Than you need 4 ports. for example 1 - for PC router, 2 - for AP1, 3 - AP2, 4 - AP3. Than you need to create 3 vlans with different tags through the switch, for example with tag 1001 through ports 1 and 2, with tag 1002 through ports 1 and 3 and with tag 1003 through ports 1 and 4. Turn off passing of untagged packet on ports 1-4. If you using simple bridges on your APs than instead of ethernet interface put in bridge vlan with corresponding tag (1001 for AP1, 1002 for AP2, 1003 for AP3). Parent for this vlan must be the same ethernet that you kicked from the bridge.

I think, the Layer2 managed switches can solve this problem. For example Linksys SRW series switches have ACL (Access Control List) feature. I haven`t experience. But I think ACL works on Layer2 and it can block traffic sniffing.

I will try these suggestions when I get my managed switch