Suppose that in some scenario using SSL, a hacker has succeeded in obtaining the MAC address, but not the encryption.

Can this be detected?

Also, suppose he changes the MAC address: what should he also change in the IP and TCP layers?

1 Answer 1


TLS protects the application data only. It neither protects nor detects changes in the lower layers, i.e. neither TCP ports, nor IP addresses, nor MAC addresses. This would also not make much sense since otherwise TLS would not work over LAN borders (MAC address is specific to LAN, i.e. changes when passing LAN borders) and it would not be possible to use TCP level (non-intercepting) proxies and load balancers (i.e. IP and port changes).

Not the answer you're looking for? Browse other questions tagged .