RE: Network "Change Management"

> Does anyone know of a Linux utility that can watch the MAC 
> address tables in Cisco switches and alert admins as to when 
> a new device has been plugged in?

I'm not aware of a utility to do that specifically, but if you know a
little Perl, Net::Telnet::Cisco can be great for things like this. Just
pull the entries out of the switch, read them into a database regularly
and generate some sort of alert condition if there are changes.
 
> Basically, we have your standard client network with DHCP. 
> Internet access is restricted to authenticated users, and so 
> are the file shares.
> However, we've had a few instances where people just plug in 
> their personal laptops which makes me very worried...

My first recommendation here would be to have MAC address authentication
setup on your DHCP server. I believe, ISC's dhcpd supports this. That'll
prevent clueless users from getting a DHCP lease without clearing it
with you first. Your next concern is the clueful user who sees what
subnet his legitimate workstation is on, pings around for a free IP
address and assigns it to his laptop. To prevent that sort of situation,
I'd recommend using MAC ACL's on your switches. That way even if someone
does find a free address and assign it to an unauthorized device, their
frames will never make it past the switch port they're on.

- Darrell