This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is it feasible to block based on MAC-address?

A curiosity question:

Firewalls typically allow or deny access based on IP-address. But due to dynamic IPs, it's hard to block a specific IP on a permanent basis.

Game servers have this problem when they try to ban badboy players. They ban based on IP-address, but a well-informed player simply gets his dynamic IP-address renewed and he gets back in. Regardless, a dynamic IP will eventually change and the player gets back in.

Is there any technical reason that a Firewall, or any other program, can't block based on a MAC-address?

Rock D.

This thread was automatically locked due to age.

Parents

0 blue_01 over 23 years ago

the firewalls don't receive the MAC adresses:

routers between the external computer and the firewall don't transmit MAC adresses.
Cancel
Vote Up 0 Vote Down

Cancel
0 jjones11 over 23 years ago in reply to blue_01

I believe you are wrong. All you have to do is look in you packet log and each and every entry has both MAC addresses, source and destination.
Cancel
Vote Up 0 Vote Down

Cancel
0 Ari Maniatis over 23 years ago in reply to jjones11

This is not how it works. MAC addresses are only used by the ethernet network layer (ie. NICs, switches, etc) to direct ethernet frames. They are not part of the information at the IP layer.

A firewall could theoretically use MAC addresses only to create rules for machines on a local switch or hub.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Ari Maniatis over 23 years ago in reply to jjones11

This is not how it works. MAC addresses are only used by the ethernet network layer (ie. NICs, switches, etc) to direct ethernet frames. They are not part of the information at the IP layer.

A firewall could theoretically use MAC addresses only to create rules for machines on a local switch or hub.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 jjones11 over 23 years ago in reply to Ari Maniatis

Okay. So you are saying that the MAC address changes from hop to hop? That would make sense.

Thanks for shedding some light. [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 askar over 23 years ago in reply to jjones11

MAC address only exist on Ethernet networks. Routers do not retransmit MAC address.
Cancel
Vote Up 0 Vote Down

Cancel