this page will resolve the mac spoofing process after a spoof is successful (mac cookie off and short ide times network)
i have several ideas to detect 2 devices using the same mac using a mikrotik server only
1-packet response trap method :
two devices with the same mac and ip will generate a double response
arp request - icmp ping/mac ping
2-onlogin script to prevent any further dhcp forwarding after login
if you can help join