I wan't to limit access for unknown computers in my network.
I have set up eth-lan with arp: reply only; set up dhcp with pool: static only, made some static ARP addresses.

From this point - no one can get dhcp, so can't get any kind of network with just plugging in cable.

But if someone put in static ips in own laptop - they won't have access to internet, but can have access to other computers/servers in same broadcast network (/24).

so i wan't to have some monitoring/script to see:
a) if someone unknown is asking for dhcp this code logs every dhcp request (also allowed ones). any idea to implement this excluding allowed addreses?
i was thinking about adding to address list, but there is ip addresses, not mac.

b) if someone has set up static ip
here i figured out that i could add for all static dhcp leases address-list parameter then i have a filter which allows access for computers and log & block access to internet/other networks: i know this one won't block access to that broadcasting /24 network, but my idea is that if computer will have set up all ips (not only ip and mask, everything else left blank), it will genereate some traffic, that will be catched in log.

ideally it would be great to receive an email with computers MAC address. problem is to filter only one entry, not to have 100 emails in minute (because log fills up pretty quickly).
does anyone could give some ideas?
i can't find to have an option for running some script in rules action, so there problably none!?

I recommend remove address from routerboard interface and go to lower layers:

1 VLAN from pc client to router, and for more security, static ip as link, same as pppoe
2 PPPoE from pc with username and passwd to access

I recommend remove address from routerboard interface and go to lower layers:

1 VLAN from pc client to router, and for more security, static ip as link, same as pppoe
2 PPPoE from pc with username and passwd to access

1. Your idea is to set up static ips for computers? if so, it will take a long time to go around all 400 pc's to set up static ips
2. I think it will make some problems, because computers are in windows domain network.

No manual
you can use for the vlan dhcp servers, and for pppoe a pool, is auto.

the more secure solution is pppoe with different user and password by 400pc. or tunnel L2TP or other

other way is get the mac of all pcs and filter... mac ACL, easy to hack, put the same mac of other pc, plug cable and run...

other way is the osi level 0. put your switches in a locker

is your election.