I am a student of information technology and I am doing a project on avoiding MAC spoofing by using MAC encryption.

My goal is to encrypt the MAC address inside the packet and send that packet to the router over the WiFi network.

On the router side, I want to decrypt the MAC address from the packet and store it in such a way that no unauthorized user can see that MAC address, thus avoiding MAC spoofing.

I want to know whether is it possible to encrypt MAC address and if it is possible to decrypt that MAC address at the router side?

  • 3
    It's not possible to encrypt the MAC and keep the packet deliverable. It's like encrypting the addresses on an envelope and expecting the post office to deliver it. – ThoriumBR Sep 4 '14 at 13:52
  • Instead of trying to secure mac whitelisting you can use WPA2-Enterprise with individual passwords. – user10008 Sep 4 '14 at 15:30

You cannot encrypt the MAC address itself and "send that packet to the router" - the MAC is required to enable the packet to reach the router and enable the router to send packets back. It's simply not possible to "hide" the MAC address.

While it's theoretically possible to put some sort of signing (related to encryption) in place, using encryption primitives to attest to the validity of packet-MAC pairings, the protocols do not currently support that to the best of my knowledge. I think you'll find that anyone approaching this problem does so at a higher level - transport (IPSec) or application (HTTPS). Not least because any authentication of the physical layer is non-routable; the MAC address only has significance within the local network, and any work done to secure it will not scale more than one hop.

As an exercise allow me to suggest that you perform a packet capture of traffic during at least two routed hops (e.g., at the web client, at the web server, a router in between). Look at the MAC addresses involved. They change and have no authoritative relation to the sender or receiver. Taking the measures you've suggested to secure them would not be applicable.

| improve this answer | |
  • I second the 'signing' approach. – schroeder Sep 4 '14 at 14:41
  • Yes. The "signing" part complies with my interpretation of the intention of the OP. I'd emphasize that part of this answer, because that is a valuable insight. – agtoever Sep 4 '14 at 16:57
  • sir, may i know why it is not possible to hide the MAC address. – abhishek Sep 8 '14 at 10:29
  • Because the MAC address is the sole, fundamental piece of information that's required in order for a packet to be received by the station it's being sent to. It must be seen because the reason it is seen is to allow receiving stations to determine if the packet is intended to be read by them or not. It is the first and only piece of information read by a station and used to determine whether to receive or ignore a packet. Note also that even IPSec tunnel mode, which hides the IP address, works by wrapping the packet in another address. Addresses must always be visible, MAC or IP. – gowenfawr Sep 8 '14 at 10:44

I don't see how this could be accomplished based on networking fundamentals.

In order to encrypt the MAC there needs to a key exchange between the two communicating parties, which means that even if you could rewrite IPv4 / TCP/IP to encrypt the MAC, the MAC would still be transmitted at some point over the network unencrypted.

IPv6 does a much better job of implementing security at supports:


IPSec traffic is encrypted. Captured IPSec traffic cannot be deciphered without the encryption key.


IPSec traffic is digitally signed with the shared encryption key so that the receiver can verify that it was sent by the IPSec peer.

Data integrity

IPSec traffic contains a cryptographic checksum that incorporates the encryption key. The receiver can verify that the packet was not modified in transit.

Source: http://technet.microsoft.com/en-us/library/cc775898(v=ws.10).aspx

You can also find more information on IPv6 features here: http://www.sans.org/reading-room/whitepapers/protocols/security-features-ipv6-380

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.