Rogue device detection including MAC address spoofing detection

A system comprising:

• a memory;
• and
• a processing device, operatively coupled to the memory, to:
• monitor each media access control (MAC) address of a plurality of devices communicatively coupled to a network;
• access information comprising a respective timestamp associated with when each device of the plurality of devices was communicatively coupled to the network and each port associated with each device of the plurality of devices, wherein each device of the plurality of devices is communicatively coupled to an associated port;
• determine that a first MAC address of a first communication associated with a first port and a first timestamp matches a second MAC address of a second communication associated with a second port and a second timestamp;
• identifying a device associated with the first MAC address associated with the first port or the second MAC address associated with the second port as associated with a MAC address spoofing event based on the first MAC address matching the second MAC address, wherein the first port differs from the second port and the first timestamp and the second timestamp are within a threshold amount of time from one another;
• perform an action in response to identifying the device associated with the MAC address spoofing event;
• clear a first record associated with the first MAC address and a second record associated with the second MAC address;
• a configurable period after the clearing, create at least one of a first new record associated with the first network device or a second new record associated with the second network device.

A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:

• access a first media access control (MAC) address associated with a first communication on a first port of a first network device, the first communication being associated with a first timestamp;
• access a second media access control (MAC) address associated with a second communication on a second port of a second network device, the second communication being associated with a second timestamp;
• determine that the second MAC address matches the first MAC address;
• identify a device associated with the first communication or the second communication as being associated with a spoofing event based on the second MAC address matching the first MAC address, based on the second port differing from the first port, and based on the first timestamp and the second timestamp being within a threshold amount of time from one another;
• perform an action associated with the first or second port of the second network device responsive to identifying the device associated with the first communication or the second communication as being associated with a spoofing event;
• clear a first record associated with the first MAC address and a second record associated with the second MAC address;
• a configurable period after the clearing, create at least one of a first new record associated with the first network device or a second new record associated with the second network device.