How do we prevent loss of sensitive information from MAC spoofing?

Question

While IP addresses are often dynamically assigned during runtime, hardware addresses (so called MAC addresses) are usually statically allotted when a network interface card is manufactured. What happens when an attacker connects to the same network as his target and assigns his network card the same MAC address as the one of his target’s system?

I understand this is called MAC spoofing. Since routers cannot tell to which port the correct system is attached, packets will likely be routed to both devices. An attacker can thus gain access to sensitive information.

How would a user or a sender come to know that an attacker has gained access to sensitive information?

I understand that MAC filtering provides absolutely zero security (Wired networks).

Answer 1

MAC spoofing is more about LAN disruption than stealing information.

I think you have a mistaken idea about routers. Routers do not route to MAC addresses, and on a LAN, a router is simply another host. On a LAN, packets are encapsulated in a frame, and are switched based on the frame. The packet doesn't contain MAC addresses, only the frames do.

Switches are what really get disrupted with MAC spoofing since switches switch based on the MAC address, and switches maintain a MAC address table for which MAC address is on which port. As traffic comes in from a host, the MAC address table is updated so that traffic destined for a MAC address can be sent to the correct port (if there is no entry for a MAC address, it will be flooded to all ports). MAC address spoofing will cause the MAC address table to constantly change, and frames destined for the spoofed address will be sent to to different ports at different times, depending on which port is currently in the MAC address table.

MAC filtering is really less than useless. If your switch has something like Cisco's DHCP snooping and ARP inspection, you can prevent the problem of MAC spoofing. You should investigate what you can do for LAN security (this is a huge topic with entire books written about it, and it is a topic too large for this site).