MAC address filtering

Networks · MAC address filtering

Same device. Two doors. Opposite results.

A device asks to join. First choose how the router's filter is set up, then choose whether the MAC address the device sends is on the list. Try all four routes.

How the filter is set up → Is the address the device sends on the list?

On A device asks to join the network. 2 branches to choose from.

Walk every route and see where an unknown device ends up.

What you need to know

• Every network card is given a unique MAC address when it is made. It identifies the card, not the person using it.
• Have a goTwo brand-new phones come off the same production line, one straight after the other. Could they share a MAC address?

  No. Each network card gets its own unique address when it is made.

  The address is given to the card at manufacture to identify that one card, so two cards sharing one would defeat the point.

• A MAC address is written as six pairs of hexadecimal digits, like 3C:22:FB:8A:19:D0.
• MAC address filtering means the router or wireless access point checks the address a device sends before letting it join.
• With an allow list, only addresses on the list can connect. An unknown device is refused.
• With a block list, addresses on the list are refused. An unknown device is connected.
• Have a goA school wants to keep out every device it doesn't already know about. Which list type should it choose?

  An allow list.

  A block list only refuses addresses someone has already named, so a brand-new stranger would walk straight in.

• The router decides using only the address the device sends. It can't tell a copied address from the real one.
• Spoofing is copying a MAC address that has been observed onto another device, so the router treats that device as the original.
• Have a goMax's laptop is on his school's block list, so it's refused. He watches Zoe's laptop (not on the list) connect, then copies her address onto his. In or out?

  In. His laptop now sends Zoe's address, which isn't on the block list.

  Max is still the same person, but the router only reads the address it is sent, so it can't tell a copy from the original.

• Filtering reduces unauthorised access, but keeping the list up to date is slow on a large network where devices are added often.
• So it isn't secure on its own. It is used alongside authentication and encryption.

The big picture

A router or wireless access point can read the MAC address a device sends and check it against an allow list or a block list. That reduces unauthorised access, but because it trusts whatever address it is sent, it is not secure on its own.

⚠ Watch out

Thinking MAC address filtering makes a network secure on its own, or that a MAC address is a secret like a password. It identifies the network card and can be observed and copied, so filtering only reduces risk.

Memory hook

Allow list = guest list: not on it, not in. Block list = banned list: not named, you're in. Either way the router only reads the badge, and badges can be copied.

Check yourself

A café's allow list holds only the owner's laptop and till. A customer's phone tries to join. Connected or refused? And what if it were a block list that doesn't name the phone?