MAC Filtering

What is MAC Filtering?

MAC Filtering is a form of network access control and a basic security measure in which a switch, access point or firewall admits or rejects traffic based on the MAC address (Media Access Control address) of a device’s network interface. The administrator maintains a list of permitted (allowlist) or blocked (denylist) addresses, and frames from any other address are dropped. MAC Filtering operates at layer 2 of the OSI model and is therefore a simple form of access control, but not authentication: a MAC address is an identifier that anyone can see and copy.

In OT networks, where the same PLCs, HMIs and I/O stations sit in the same place for years, a fixed list of known devices is very achievable. There, MAC Filtering is a useful barrier against accidental or unauthorised connections, provided you understand its limits.

🧠 How does MAC Filtering work?

A MAC address is 48 bits long and is usually written as six hexadecimal pairs, such as 00:1A:2B:3C:4D:5E. The first 24 bits form the OUI, the manufacturer’s code. Every Ethernet frame and every Wi-Fi frame carries the sender’s source MAC address, and that is the address the filter uses:

1. Define the list - the administrator enters the permitted or blocked addresses on the switch, the access point or a central server.
2. Receive the frame - the network device reads the source address from the header.
3. Compare - if the address is on the allowlist, the frame is forwarded. If it is not (or it is on the denylist), the frame is discarded.
4. React and report - depending on the platform, the device simply drops the frame, sends an alert via Syslog or shuts the port down.

An allowlist (formerly whitelist) is the only variant that makes sense for security. A denylist (blacklist) only stops one known address; an attacker simply picks a different one.

🔄 What forms of MAC Filtering exist?

The term is used for several different functions. They differ in where the list lives and what happens on a violation:

MAB is the centrally managed variant. On Cisco switches, MAB as a fallback only starts once 802.1X receives no response; with the default settings (30 seconds per attempt, two retries) that takes 90 seconds. Cisco itself explicitly states that MAB is not a strong authentication method, because a spoofed address of a valid device is enough to pass.

⚠️ Why is MAC Filtering not real security?

The weak spot is that a MAC address is not a secret:

• Visible on the network - on Wi-Fi, MAC addresses travel unencrypted in the frame header, even with WPA2 or WPA3. These only encrypt the payload. Anyone listening can see straight away which addresses are permitted.
• Easy to forge - practically every operating system lets you change the MAC address in software. This MAC spoofing takes an attacker less than a minute.
• Often physically readable - many field devices and PLCs have the address printed on the rating plate.
• No user - the filter recognises a device, not the person behind it.
• Random addresses - Android (from version 10) and iOS (from version 14) use a random, locally administered MAC address per Wi-Fi network by default. Android keeps that address stable per network; an iPhone or iPad may get a new address after the network has been forgotten and added again, so the allowlist no longer matches.

On the other hand, a spoofed address is only useful once the attacker is already on the network or within radio range. MAC Filtering therefore mainly stops untargeted connections: a service laptop on a spare port, a router someone brought in, or a rogue device. Against a determined attacker it offers little.

🏭 Where does MAC Filtering make sense in OT environments?

MAC Filtering fits best where the device population is static and stronger authentication is not (yet) feasible:

• Switches in control cabinets - levels 1 and 2 of the Purdue Model, where every port connects to one fixed device. Port security is the usual implementation here.
• Industrial Wi-Fi - handheld scanners, AGVs and mobile HMIs on a separate SSID. Always combine the filter with WPA2 or WPA3-Enterprise; the filter on its own is not enough.
• Legacy equipment without 802.1X - older PLCs and remote I/O cannot authenticate to a RADIUS server. MAB or a local allowlist is then the most you can do.
• Maintenance ports - a list of known service laptops makes it easier to spot an unknown device, although a disabled port is better still.

Watch out for ports where this goes wrong. Uplinks between switches and ring ports see many addresses pass through. PROFINET devices with a built-in switch for daisy-chaining bring the addresses of downstream devices with them, and virtual machines can change address when they migrate.

🔧 How do you introduce MAC Filtering step by step?

1. Take inventory - record for each switch port and each SSID which device with which MAC address belongs there. An up-to-date asset inventory, supplemented by passive asset discovery, is the foundation.
2. Disable unused ports - that is stronger than any filter.
3. Start in monitoring mode - let the filter only record at first, for example MAB in the monitor mode of your NAC solution (access stays open, deviations are logged), and check for a few weeks whether legitimate devices are affected. The restrict mode of port security is not a monitoring mode: it already drops frames from unknown addresses, but reports them without shutting the port down.
4. Enforce the allowlist - during a maintenance window, with a fallback plan in case a critical connection drops.
5. Forward alerts - to your SIEM or network monitoring, and let anomaly detection watch for the same MAC address appearing in two places.
6. Embed it in change management - every replacement of a PLC, HMI or network card means a new MAC address. Make updating the list part of the replacement procedure.

Complement MAC Filtering with DHCP Snooping, Dynamic ARP Inspection and layer-3 ACLs, and use network segmentation to limit what an intruding device can reach.

🔐 How does MAC Filtering fit into standards and legislation?

IEC 62443-3-3 requires device identification and authentication (SR 1.2) from security level 2 upwards. MAC Filtering identifies but does not authenticate; at SL 1 the standard does not yet require it and MAC Filtering is a reasonable extra barrier, at SL 2 and higher it only counts as a supplementary measure alongside something stronger. SR 7.7 (least functionality) calls for unnecessary ports to be disabled. CIS Controls v8 covers port-level access control in safeguard 13.9, with 802.1X as the preferred approach.

For Dutch organisations covered by the Cyberbeveiligingswet (the Dutch NIS2 implementation, in force since 15 August 2026), MAC Filtering is a low-threshold measure within the duty of care. It only counts if you follow up alerts and keep the list current. In a Zero Trust approach, a MAC address is at most one signal alongside stronger identity attributes.

❓ Frequently asked questions

Is MAC Filtering secure enough for an OT network?

No, MAC Filtering on its own is not secure enough, because a MAC address is visible and easy to forge. It stops accidental and unauthorised connections, but not a targeted attacker. Use it as one layer within defence in depth, together with segmentation, firewalls and monitoring.

What is the difference between MAC Filtering and port security?

MAC Filtering is the general term for access based on MAC addresses, on a switch, access point or server. Port security is a specific switch feature that determines per port which and how many MAC addresses may be learned, and that can shut the port down on a violation. Port security is therefore one form of MAC Filtering.

Does MAC Filtering work on Wi-Fi with phones and tablets?

MAC Filtering on Wi-Fi works poorly with modern phones and tablets. Android from version 10 and iOS from version 14 use a random MAC address per network by default, so the address on the allowlist does not match the real device. Disable the private address per network on managed devices, or use WPA2 or WPA3-Enterprise with certificates.

What is MAC Authentication Bypass (MAB)?

MAC Authentication Bypass is a method in which a switch sends a device’s MAC address as username and password to a RADIUS server, which grants or denies access. MAB is intended for devices without an 802.1X client, such as many PLCs and printers. It is centrally managed MAC Filtering and therefore just as vulnerable to spoofing.

Should I use an allowlist or a denylist?

For MAC Filtering, always use an allowlist containing only known devices. A denylist only blocks the addresses you already know, and an attacker simply picks another one. An allowlist also forces you to keep an up-to-date inventory, which is valuable in OT in its own right.

What happens with MAC Filtering when I replace a PLC?

A replacement PLC has a different MAC address and is rejected by MAC Filtering until the list is updated. That can prolong a production stoppage if the procedure is not right. Make updating the allowlist a fixed step in your replacement and change procedure.

📌 In summary

MAC Filtering restricts network access to devices with a known MAC address, via a Wi-Fi filter, a MAC ACL, port security, MAC binding or MAB. In static OT networks with fixed equipment it is very achievable and stops untargeted connections. Because a MAC address is public and easy to forge, and modern mobile devices use random addresses, it never replaces real authentication.

MAC Filtering is a simple layer-2 barrier, not authentication: deploy it with an allowlist, alerts and change management, and combine it with 802.1X, segmentation and monitoring.