New versions of network switch firmware often bring additional facilities along with bug-fixes.  We have recently been evaluating some security and robustness enhancements, with a view to rolling them out across the Informatics network.  In particular:

• DHCP protection, which will prevent rogue machines purporting to be DHCP servers on the self-managed subnets.  We occasionally see this, it can be very hard to track down, it is disruptive to everyone else on the subnet, and is almost always some portable piece of kit which has been configured for a home situation and then not reconfigured appropriately for the Informatics network.
• ARP protection, which will prevent a machine from claiming an IP address which has not been allocated to it.  This usually results in a large drop in throughput for both machines, as packets are mis-directed or dropped.  Again, this is often due to misconfiguration, though we have also seen an increase recently as a result of misfeatures in some of Apple’s protocols.
• Dynamic IP lockdown, which will prevent a machine from using an IP address which has not been allocated to it.  There is almost never a good reason for this to happen.

None of these should have any effect on a machine which is properly configured and working normally.  We have been testing the mechanisms for several weeks now and they do appear to work as advertised, and we will therefore be rolling them out across the Informatics network as appropriate.

Network security and robustness enhancements / Computing Systems by is licensed under a