0

Is it possible to detect when a device has been MAC filtered on a Wi-Fi network?

I don't know if it's in the 802.11 standard, or if it's just implemented by ignoring the client network packets.

2 Answers 2

4

MAC filtering is implemented by, indeed, ignoring packets whose source MAC address is deemed "inappropriate" by the access point. You won't get a response packet informing you that the access point does not wish to talk to you.

You can test for a blacklist filter by temporarily changing the MAC address of your device: if the device can connect with another MAC address, then its "natural" MAC address is blacklisted. However, most MAC filters work more with whitelists, i.e. a finite short list of allowed MAC addresses, all others being filtered out. This can be tested by configuring your device to mimic the MAC address of another device which is allowed to connect. (For tests only ! Stealing MAC addresses is rude, and usually illegal if you do it in order to work around a security system. Also, having two devices with the same MAC address, up simultaneously, tends to break connectivity for both.)

1
  • This is not correct; at least, not in the implementations I've seen. You will get a rejection frame from the AP, which you can see in a 802.11 sniffer. (It's not a "packet", but packets don't have MAC addresses anyway.) Oct 18, 2020 at 17:33
1

When a non-whitelisted client tries to associate with an Access Point. AP sends the authentication failure response to the client.

Beating MAC-filtering

  1. It is possible to detect if MAC filtering is on/off on wifi network. As said, AP will respond with authentication failure message to client(which you can see using sniffer tool).

  2. Check who is connected to AP and list down their MAC addresses.

  3. Spoof the MAC address of any client to fool the AP.

1
  • To clarify, in the 802.11 standard the "authentication" phase is a leftover wart from the WEP days, and is essentially a no-op: an authentication request provides no credentials and results in an automatic success (unless you've been MAC-filtered). Still, it must be done before associating with the AP to make sure its protocol state machine is in the right place. The WPA2 key negotiation stuff that provides the actual authentication happens after the association phase and is called RSN (Robust Secure Negotiation). Oct 18, 2020 at 17:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .