Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can somebody explain to me how a wireless AP denies access to the network if the client does not have the correct MAC Address.

Does it not send a probe response when a client has not got a correct MAC. Or when the client tries to authenticate, it gets denied.

please can you include reading sources as well, if you know of any.

share|improve this question
up vote 3 down vote accepted

It is really that simple, if the AP has a MAC filter, any device which attempts to authenticate that doesn't have a MAC address on the list will just be denied.

However the problem from a security perspective (which is why this should not be used as a security function) is that it is trivial to spoof a valid MAC address (by sniffing them wirelessly and waiting until the valid user has gone - this is a common technique for avoiding usage costs in airports)

Update to show where MAC address denial happens:

Client --------------Probe-------------> AP

AP -------Probe Response----------> Client

Client ---802.11 Auth Request-----> AP

MAC authentication happens in here. If the client MAC is not on the list the following responses will not get sent:

AP ------802.11 Auth Response---> Client

Client --802.11 Assoc Request----> AP

AP -----802.11 Assoc Respons----> Client

Which is then followed by EAP etc.

share|improve this answer
am i right in thinking then that a probe response is sent from the AP to the client then the Client sends a authentication request and if the MAC does not exist on the ACL. Access is denied. – Mintuz Dec 20 '11 at 14:56
@Mintuz - That is correct. What Rory has left slightly fuzzy though, is whether or not the Auth Response is sent to Clients not on the ACL. I believe the answer to that though, is "no". – Iszi Dec 20 '11 at 17:26
sorry - fixed that now – Rory Alsop Dec 20 '11 at 22:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.