"Split the network
I'm starting here by splitting the network into two parts, the
trusted half and the untrusted half. The trusted half has one
netblock, the untrusted a different netblock. We use the DHCP
server to identify mac addresses to give out the relevant
addresses...