MAC Filtering
MAC Filtering referes to the use of MAC addresses to client devices that can authenticate to a WLAN. MAC Filtering is not defined by 802.11 Standard and any implementation of it is Vendor specific.
Here is an example from my ASUS home router.
Weakness:
MAC addresses can easily be spoofed.
Where used:
- Protect legacy radios that do not support stronger security (eg. older bar code scanners)
Best Practice:
- Separate the hand-held devices in a separate VLAN with a MAC filter based on the manufacturer’s OUI address.
LAB: MAC Filtering
I set up the house router to reject connections from one of my laptops and watched the behaviour. I could see that my laptop (Azure_) was sending probe requests to my SSID, even one directed to my specific router (frame 7302). Here is a filter for the house SSID.
Here, I filtered the source MAC address of my rejected Laptop that was sending probes.
However, there were no probe responses being sent back from the router. It seemed as if the router was simply ignoring the requests and not processing or sending anything.
Conclusion
From the test, we see that the AP seems to ignore packets coming from clients with rejected MAC addresses. Am not sure what exactly the behaviour should be at this point hence can only make conclusions as per my home lab setting. Once the filter was removed, I was able to authenticate and associate as usual.
References:
- CWNA-106 Certified Wireless Network Administrator Study Guide by David D. Coleman and David A. Westcott.