i can't block win98 computers

[vladone]

Thanks all for reply!
Now:
1. i try to permit only good mac and deny any else but not work. Win98
still have internet.
2. one solution is probably to block acces for win98 computers to any on port 53 and block in this
 mode DNS service, but is a little strange this solution.
3. i dont understand  how work tcpdump. I used: #tcpdump -i fxp0,
but a dont see all traffic and after close tcpdump i see an great
number of packets dropped by kernel, without any rule for this.
4. with "arp -a" i see and mac for win98 computers. I tried to delete
entries in arp table for win98 hosts but nothing.

Is great if somebody have experience with this situation, or tested
some solutions for this problem.

                                                 Thank all for suggestions!