checking the not allowed changing of IP's

[Szabó Tamás <sztamas@ots.rdscj.ro>]

Hi!

The scenario is the following:

We got a LAN which consists of several hosts running windows 2000 and
one running Debian 2.2rev3(kernel 2.2.19). This Debian has an extra
interface through which is connected to the ISP.

The internal hosts should have access to the internet(only to a few
services) through proxies running on the Debian machine.

This simple configuration is set up and running.

The logging of the internet activity is done based on the IP addresses,
so our policy doesn't allow changing of IP addresses. But currently
there will be no notification of the fact if someone changes it's IP. So
I'm looking for a solution for this...

Are there some nice utilities for this?

I could write a script and put it in crontab to check the ARP-IP
association of hosts periodicaly.
But probably there are already some written, tested utilities out there.
Right?

Another thought:
As I know in Linux I can use whatever MAC address I want(ifconfig allows
me to choose one). I know that this is not really a Debian question but
does somebody know if this is possible in win2000 too?
If yes then this method of checking the ARP-IP association won't be
reliable.

Is there another way to check if someone changed it's IP?


thanks in advance,
Tamas