1

I have read a lot of comments that suggest allowing specific mac addresses is not effective as anyone can spoof a mac address. I have a couple of questions;

  1. How would they obtain a list of approved mac addresses if they are not connected to the network?

  2. If someone has previously obtained the network key, and you change the password, are they still able to connect with just the key? (I am assuming the passphrase you pick is just converted to the key, is this assumption wrong?)

I ask because I am in the process of improving my network security after discovering others on it. Currently I have implemented the following;

Disabled WPS, New solid WPA-2 Personal Passphrase, Implemented an "allowed access" list of MAC addresses.

Improve this question
1
  • 1
    MAC addresses are always transmitted in clear, making them useless for authentication.
    – André Borie
    Jan 21, 2017 at 21:26

1 Answer 1

Reset to default
1

  1. They would not need to obtain the list, just a single allowed MAC address suffices. Spoofing the network and deauthing a single client (forcing them to connect to their hotspot instead of yours) would allow anyone to obtain such a MAC address.

  2. No, and your assumption is correct. The WPA key is derived from the password and the router will not allow anyone to connect with a WPA key that is not currently valid.

Edit:
Assuming your network contains mobile devices that regularly go outside the range of the network, one could simply sit just outside the range of your network with another (rogue) hotspot with the same SSID, wait for one of your devices to come out and connect to their network, revealing the authorized device's MAC address.

Improve this answer
2
  • You don't need a rogue hotspot to get MAC addresses that are associated with a given ESSID. You can simply sniff and passively note the MAC addresses.
    – multithr3at3d
    Jan 22, 2017 at 20:00
  • @korockinout13 - I live in an apartment building with dozens of access points. If someone were to sniff traffic on my network would they be able to see that mac authentication is required? How would they know to take the additional step of spoofing the MAC address if most networks do not require it?
    – BeyondCM
    Jan 22, 2017 at 22:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .