MAC address theft detection in a distributed link layer switched network based on trust level comparison

An apparatus implemented as a physical machine, the apparatus comprising:

• non-transitory machine readable media configured for storing executable machine readable code;
• a device interface circuit configured for providing a link layer connection for a network device in communication with the apparatus;
• and
• a processor circuit configured for executing the machine readable code, and when executing the machine readable code operable for:
• determining, by the apparatus implemented as a link layer switch within a distributed link layer switched data network, a trust metric for a media access control (MAC) address used by the network device on the link layer connection;
• receiving a query originated by a second link layer switch in the distributed link layer switched data network, the query specifying the MAC address and a corresponding specified trust metric;
• and
• responding to the query based on determining whether the corresponding specified trust metric indicates a higher trust level than the trust metric for the MAC address used by the network device on the link layer connection.

One or more non-transitory tangible media encoded with logic for execution by a machine and when executed by the machine operable for:

• determining, by the machine implemented as a link layer switch within a distributed link layer switched data network, a trust metric for a media access control (MAC) address used by a network device on a link layer connection provided by the link layer switch;
• receiving a query originated by a second link layer switch in the distributed link layer switched data network, the query specifying the MAC address and a corresponding specified trust metric;
• and
• responding to the query based on determining whether the corresponding specified trust metric indicates a higher trust level than the trust metric for the MAC address used by the network device on the link layer connection.