2

Suppose there is a password-secured WiFi network that exists to provide users with Internet access only. Edit: Consider a guest/mobile-BYOD network as an example.

Since filtering access to a WiFi network by MAC address is of dubious security benefit (as has been discussed here in detail) and involves certain inconvenience for administrators (a visitor would not be able to use the network at all without admin intervention) and possible privacy concerns for users, what other reasons might there be for gathering a list of MAC addresses from all users of portable devices etc.?

If there are, say, 30 people, each with several devices, that's a lot of MAC addresses to deal with.

Improve this question
2
  • @schroeder Requiring users to identify and register their requested MAC addresses to be white-listed.
    – Spehro 'speff' Pefhany
    Commented Jun 24, 2015 at 19:18
  • 2
    Ah ok - so in ADDITION to the expressed reason of whitelisting MACs, what reasons might there be? You don't state that there is a primary reason for maintaining a list of MACs.
    – schroeder ♦
    Commented Jun 24, 2015 at 19:23

5 Answers 5

Reset to default
2

Unmodified MAC address lists are useful when discovering the type of hardware used on the network. MACs contain the vendor info and can be used to narrow down into the types of hardware used (iPhone, Laptop, etc.).

For me, this is useful to know if an employee has hooked up their personal mobile device on the company network instead of the guest network (as per policy). Although MAC addresses can be spoofed, it's a little harder with things like phones and tablets, and is reliable enough for my purposes.

Improve this answer
1
  • Thanks for the response. This is essentially a "guest/BYOD" network, so no servers or anything else internal would be accessible from that network.
    – Spehro 'speff' Pefhany
    Commented Jun 24, 2015 at 19:19
2

I agree that for the reasons you explained, MAC address authentication is not very difficult to bypass -- although as schroeder points out, this is difficult on non-rooted phones/tablets. Instead, 802.1x authentication or something like Cisco's MacSec offers far superior security.

MAC address lists are often maintained for other reasons. For example, one can lookup a given MAC address's IP address on the network using ARP. So, from your MAC address list, you can determine what DHCP or static address a machine has, which is useful on occasion.

Other than that, it is useful for keeping inventory and identifying computers on the network when NetBIOS name/etc is not available or has been changed to something you don't recognize.

However, from a security perspective, I would consider MAC filtering to be a deprecated practice with superior, albeit more difficult to implement alternatives available. These alternatives are easier to maintain going forward however than updating MAC lists every time a device is swapped out.

If it is a guest network, fully physically or VLAN separated from any production network, with little need for authentication; then perhaps a token-based system or captive WiFi portal type system would be useful. For example, OpenMesh WiFi devices include such functionality which could allow the receptionist at your office to print out "tokens" for access, which could be unlimited in duration. You could also restrict clients to only be able to connect for x days, so neighbors don't find your WiFi to be their backup internet connection.

Improve this answer
1

One non-security use case is in Japan where the JR train line has an access point in each carriage and through your installed app, can use your MAC address to pin point which exact carriage you are riding in. In addition, depending on how many passengers are riding, the number number of MAC addresses can determine how crowded the train is. Potential privacy concerns...oh yeah but handy nonetheless.

Although MACs can be spoofed like IPs and there are other things like iOS 8 ~ 9 MAC randomisation, from a security perspective collecting MACs might be useful in a forensics investigation.

You can also use MAC addresses for configuring security on switches such as Cisco port security.

Improve this answer
2
  • Can you say a bit more about the forensics possibility?
    – Spehro 'speff' Pefhany
    Commented Jun 24, 2015 at 19:27
  • 1
    I italicised might but my rationale is that a non-spoofed MAC can be traced back to a device that the subject under investigation used. It's probably unlikely a suspect would be convicted with only that information but if chain of custody and other protocols are followed (full disclosure - I'm not a professional in forensic investigation) it might be helpful.
    – user79331
    Commented Jun 24, 2015 at 19:51
0

One of the reasons is that some DHCP use MAC adresses when you need to assign static IPs. It is also sometimes used by firewalls and security software (especially in routers).

Improve this answer
-1

Some reasons are:

  1. as mentioned above: some of the router's use DHCP reservations to assign static IPs. Suppose you want to make a local game server, it would be troublesome that every now and then, you have to give different IP to players, it is better to assign a static IP to the machine and to do so router's use MAC address.

  2. MAC filtering: as the name suggests, it can be used to filter out the users that you don't want them to access the network.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .