I was having a discussion with a friend of mine in IS industry and he insisted that setting static MAC addresses (i.e. port security) on devices were a effective way to block MAC spoofing. I found this hard to believe as it does not prevent an attacker from sniffing and finding the MAC addresses of legitimate traffic and then spoofing it.
Question then is, would static MAC address on switches and routers help prevent attackers gaining access through MAC spoofing and if so, how?
Assigning a specific MAC address to a specific port guarantees that only a device with this MAC address will get connectivity on this port. This policy is usually done in combination with monitoring the port for policy violations to detect if somebody plugs in a device with another MAC address.
Thus an attacker has to use passive sniffing techniques to get the MAC for the device used on this specific port and then replace the device with its own. But with a simple replacement the other device will no longer work. Since this might get detected the attacker needs to employ a more intelligent solutions. At the end the knowledge and care needed by the attacker to be stealth is much higher than without static MAC assignment and the chance to get detected is higher too. This makes static MAC assigning not a 100% secure solution against MAC spoofing but makes spoofing considerable harder which is in most cases enough.
