5

i have googled about mac address spoofing.All I know is that MAC filtering is not much of a protection in wireless network.And in wired network it only works for routers that support MAC Filtering.Is there any other way to protect wired networks from MAC spoofing?

2
  • 8
    MAC filtering is an archaic way of protecting networks. It's trivial to find out and takes seconds to spoof. The next level in protecting your network is 802.1x, which provides more extensive sign-on features.
    – Ryan Foley
    Nov 12 '14 at 5:47
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 5 at 17:34
4

To answer the primary question: MAC filters provide absolutely zero security. A user can set their MAC to whatever they want -- and many NICs have a well documented eeprom interface/structure with tools to change them permanently. Wired networks are no harder to "monitor" for allowed MACs to spoof than wireless, 'tho one does have to gain physical access. (but they'll going to have that access anyway if they're trying this.)

2

ARP inspection and/or IP Source Guard along with dot1x is a better option.

A simpler way is also port-security on interfaces and allow only one MAC per host. The initial MAC must be learnt upon first boot/ARP from the host subsequent MAC's are blocked and interface may be put into a error disable state.

2
  • 1
    DHCP Snooping and ARP inspection are good but tangential to the solution. Ryan Foley is right, identity is best established by dot1x Nov 12 '14 at 9:49
  • @polihrono_crepes and all - would you mind sharing a cisco config? I'm interested in a working solution that also takes into account wired BYOD.
    – user4565
    Nov 13 '14 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.