(Wasn't sure but this question might be better in Network Engineering)
Say I'm at a wireless access point that is password protected and I don't know the password. I do know that the people around me are connected to that access point. How does a router know what devices are and are not connected to the network? What stops me from impersonating one of the devices that is connected to the network and thus use the network access of the access point? Is this solely based on the MAC address of a device? If so, can't this be spoofed with ease?