IP/MAC pairs

 I have linux bridge with 3 interfaces:
					ISP
					 ^
					 |
					 |
		          SUB1 <-------bridge-------> SUB2

 So, my network have 3 ethernet "segment's", I need  prevent arp-spoofing and changing
MAC/IP pairs by users. I found 2 ways:

1) make file with 254 strings "00:11:22:33:44:55=192.168.0.1,etc" and then load it into the ebtables:
ebtables -A FORWARD -p IPv4 --among-src-file /etc/ethers -j ACCEPT

2) add 254 rules to ebtables such as:
ebtables -A FORWARD -p IPv4 --ip-src 192.168.0.1 -s ! 00:11:22:33:44:55 -j DROP

And, my questions: which method will work fastly? Are there other ways to do this?
------
tech info:
# uname -a
Linux 2.6.8 #2 Mon Feb 19 16:36:59 UTC 2007 i686 GNU/Linux

# ebtables -V
ebtables v2.0.8-rc3 (December 2006)


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV