Before Your Provider Does
MAC Guard scans your ARP tables, cross-references your hosting provider's allowed MAC list, and alerts you the moment an unregistered device appears — before it gets your server suspended.
From raw ARP table scanning to automated provider compliance — MAC Guard handles the full lifecycle.
ip neigh, /proc/net/arp, and VLAN interfaces — no root required for passive scanning.Install the agent, configure your provider, and let MAC Guard handle the rest.
From cloud VMs to bare-metal hypervisors — unregistered MACs are a silent ticking clock.
On multi-tenant cloud networks, unexpected MACs appearing on your subnets can indicate ARP spoofing, misconfigured bridges, or an attacker performing lateral movement. Providers may flag your account or silently block traffic without explanation.
MAC Guard gives you a complete, real-time inventory of every MAC on every interface. The moment something unexpected shows up — whether it's a new VM that wasn't onboarded properly, a container escaping its network namespace, or an active attacker — you know within seconds.
This is one of the most common — and most painful — incidents in the MSP world. You're running 3 Proxmox nodes on Hetzner dedicated servers, bridging VMs through vmbr0. The setup works great until a junior engineer clones a production VM to spin up a dev environment. The clone inherits the original's MAC address — then a new MAC gets auto-assigned to the original when it restarts.
Hetzner requires MAC address registration for all VMs on dedicated servers (their network enforcement is strict — unregistered MACs get silently dropped at the hypervisor level, then escalated to account suspension if detected repeatedly). Neither Proxmox nor the engineer flags this. Within hours, Hetzner's MAC enforcement detects an unregistered MAC on your server and begins throttling traffic. You don't find out until clients start calling about downtime.
09:15 — Dev VM cloned from prod. New MAC appears on vmbr0.
11:40 — Hetzner's enforcement detects unregistered MAC. Silent traffic throttle begins.
14:20 — Client reports intermittent connectivity. You start debugging the wrong thing (Proxmox config, BGP routes).
16:55 — Hetzner support ticket opened. Support confirms: unregistered MAC, account flagged.
17:30 — MAC registered manually. Traffic restored. 3+ hours of client-visible downtime.
MAC Guard's agent runs on each Proxmox host, scanning vmbr0 every 5 minutes. The Hetzner provider adapter cross-references your registered MAC list via Hetzner's Robot API. The moment the cloned VM's MAC appears — 09:16 — MAC Guard flags it as "unregistered" and fires an alert.
Why this matters for MSPs running Proxmox/KVM on bare-metal:
3-day free trial on all plans. No credit card required.
3-day free trial · No credit card required · Cancel anytime · View full platform pricing →
Custom deployments for Fortune 500 companies, government agencies, military operations, and critical infrastructure. Bespoke pricing, dedicated support, compliance packages, and on-premise options tailored to your organization.
Product Explainer
~90-second animated walkthrough with AI narration — press ▶ Play to start.
MAC Guard installs in 3 minutes. The first alert that prevents a Hetzner suspension pays for itself in the first week.
3-day free trial · No credit card required · Cancel anytime