Security Reference Guide

MAC Filtering

Last updated Jan 1, 2004.

By default, every device on a wireless network has a unique address that's used to distinguish one wireless network interface card (WNIC) from another. This address is called the Media Access Control (MAC) address. In theory, since every WNIC has been pre-assigned a unique MAC address by the hardware vendor, an access point can be set up to only allow a pre-selected list of WNICs to connect. For example, the Linksys WAP11 includes a MAC filtering option in its software that allows an administrator to define who can connect to the WLAN by listing all the allowed MAC addresses. Once you have the MAC address of all the connecting WNICs, you can set up MAC filtering and enable it accordingly. This will stop many connection attempts made by unauthorized addresses.

However, while in theory this is an excellent way to stop hackers from accessing your WLAN, there's a serious flaw in MAC filtering: MAC addresses can be spoofed (faked) by changing WNIC settings. For example, the Dell TrueMobile includes software that allows a hacker to alter his MAC address to any address he chooses. Thus, this option is about as useful as trying to keep people from accessing a chat room by restricting chat handle names. To bypass such a restriction, a person only has to change his or her name.

Why would a software/hardware vendor want to allow a user to change a MAC address? Having the power to adjust a MAC address can provide a network administrator with more tools to keep control over the network. However, this increased power gives just as much control to an attacker. This is one example of how the ancient power struggle between user needs and security often plays right into an attacker's hands.

Regardless, if MAC filtering is an option, you should implement it on your WLAN. Just as with enabling WEP, MAC filtering does require a modicum of sniffing and network expertise. Thus, it can also serve as an intellectual barrier to most of the potential intruders of your wireless network. Note that if your WLAN supports more than 100 users, managing the MAC control list could be a time-consuming chore.