Setting Statis IP vs binding MAC to IP in settings

[tomgru]

Can't seem to find the answer to this.

What's the difference between setting a static IP, vs. binding a MAC to an IP address?

 

[CaptainSTX]

Can't seem to find the answer to this.

What's the difference between setting a static IP, vs. binding a MAC to an IP address?

For one if you bind a MAC to an IP then it makes it more difficult for someone to spoof an IP on a device and then get all the network privileges that a particular IP is given. That being said you can spoof a MAC address but that IMHO is less common that spoofing an IP.

 

[tomgru]

For one if you bind a MAC to an IP then it makes it more difficult for someone to spoof an IP on a device and then get all the network privileges that a particular IP is given. That being said you can spoof a MAC address but that IMHO is less common that spoofing an IP.

Thanks... but still a bit confused.

would you ever do both, or is 'binding' just a more complete version of assigning a static IP?

 

[CaptainSTX]

Thanks... but still a bit confused.

would you ever do both, or is 'binding' just a more complete version of assigning a static IP?

Someone else will have to chime in on that. Twice as much work but it probably would be more secure. It might be worth doing if you are trying to use parental controls and you have a crafty teenager who gets around it by changing their devices IP.

I primarily assign static IPs to devices on my network to group similar types of devices together i.e. network hardware 1-50, PCs 60 - 90, etc. Everything that connects regularly to my LAN has an assigned static IP. I force all randomly DHCPs into a narrow range so when a look at a network map it is easy for me to spot casual or suspicious connections.

One thing you can do to help prevent someone from trying to connect to the administrative page of your router or other hardware that allows you to assign a specific IP for administrative purposes is to use an IP that isn't assigned to any device either statically or through the DHCP pool. That way someone scanning your network won't be able to guess which device's IP might have administrative purposes and instead would have to try all 254 IPs in a subnet.

The disadvantage is that you then have to go in and spoof/change the device's IP to the IP that has administrative privileges before you can log in.