In CISCO routers, they provide a provision to change the MAC-Address. My question is MAC-Address is supposed to be a burned-in address i.e. a permanent address. If we allow the mac-address to be changed then it won't be unique anymore. Why do we allow this? What's the rationale behind this? Is it legal to change the mac-address? In my opinion, it's a security breach like how will you trace which device has done some wrong thing. Like, it will break the cybersecurity.
2
-
1Given the purpose of MAC addresses (locally unique addressing on L2 media), reliance upon such addressing as a reliable means of identity and security mechanism is the first problem.– rnxrxAug 9, 2018 at 2:32
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.– Ron Maupin ♦Dec 25, 2018 at 9:12
Add a comment
|
2 Answers
If we allow the mac-address to be changed then it won't be unique anymore.
A MAC address is not as unique as you may think. What is supposed to be unique is the OUI assigned by the IEEE to an organization. The organization with the OUI can assign MAC addresses in the OUI as it sees fit. It can make ethernet, Wi-Fi, and token ring NICs, and reuse the same MAC address on each type of network. Some organizations reuse MAC addresses in different parts of the world. A MAC address need only be unique on the LAN to which it is attached.
You can change the MAC address on just about any host with an IEEE protocol NIC. You are supposed to set the U/L bit to show that it is a locally administered MAC address, but many people do not do this. None of the burned-in addresses should have that bit set. There are/have been businesses, that wanted known MAC addresses on a particular host, so they go to the trouble of manually setting the MAC address on the hosts. That can prevent problems with things like replacing NICs in a server or other host, and having software break because of that.
Some of this goes back into history when we used strictly layer-2 networks and software.
answered Aug 8, 2018 at 21:21
-
suppose, I am living in an apartment and one of the house changed their mac-address and started sending unwanted traffic. How are you going to trace them like what device was sending the unwanted traffic? Since, you can trace with the device mac-address but not with the changed mac-address. Similarly, in the library LAN this can happen. In my opinion, this is a security hole. Aug 8, 2018 at 21:27
-
That can be a problem. Remember that that many protocols, e.g. ethernet, were developed many years before there was a public Internet. These were government and academic funded efforts that were built among cooperating people without a thought for security. By the time things became ubiquitous, the protocols were entrenched, and changing things would break what was currently in use. The businesses that depended on being able to set fixed, known MAC addresses would have their networks broken if they suddenly could no longer change the MAC addresses, so the drivers still let you change them– Ron Maupin ♦Aug 8, 2018 at 21:33
-
1@dexterous_stranger, we have things like Cisco's DHCP Snooping and Dynamic ARP Inspection to prevent such problems in businesses. Home/residential and public networks may or may not have such mitigations, and questions about those type of networks are off-topic here.– Ron Maupin ♦Aug 8, 2018 at 21:45
-
@dexterous_stranger This question on SO demonstrates a real need for being able the change a MAC address if the current NIC goes bad, or is replaced to upgrade to a faster network: "We have an old legacy application that uses Mac address for validating a license."– Ron Maupin ♦Aug 8, 2018 at 22:26
-
MAC as a trace is only useful if you have a record of every single device's MAC. Nobody does that. (I have a few recorded merely as a side effect of the MAC being the serial number) For WiFi, a MAC doesn't tell you what it is or where it is; and the OUI, if accurate, isn't going to help -- how many Apple, Google, Samsung, etc. devices do you have? And when it's some random chinese chip vendor?– RickyAug 9, 2018 at 0:12
There are - well, let's make that used to be - networking protocols and program suites which took great benefit of predictable LAA (as in Locally Administered Adress) at the MAC layer. Those were more prevalent in the days when IPv4 was not quite as ubiquitous as it is today.
One example: I remember setting LAA adresses on Token Ring adapters back in the late 1990ies - the MAC address was used to identify the PC of a given desk or user - much like people still do with IP adresses and fixed DHCP leases. When a PC had to be replaced, we'd configure the Token Ring driver with it the LAA MAC address of the user or desk, so it could be found easily. The main use case was a kind of a remote desktop/support/screen sharing tool (much like teamviewer is today) for OS/2 (sic!) that would work with some L2-protocol.
I'm sure that others will have more LAA related stories to share ;-)
answered Aug 8, 2018 at 21:21
