I have a ethernet lan segment running dhcp server with static list of addresses. A device which is not in the list will not get an IP address. That is what I want. But what if anyone connects a device with static IP address? How to protect the lan against such action?
Follow the directions below, but the quick answer is: Add all valid IP/MAC combinations to the ARP table. Then set the private interface on the router to arp=reply-only
http://wiki.mikrotik.com/wiki/How_to_secure_a_network_using_ARP
-Josh