Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to keep a connection alive, while spoofing/changing the MAC address of your own network adapter (especially wlan adapter), without needing to re-authenticate against 802.1X RADIUS-server with eap-tls?

I need this to secure a network, not to break into one.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I dont think so; 802.1x is based off of source learning so when the MAC changes it will re-learn the new MAC on the ingress interface and attempt to authenticate it as though there were two machines connected through a passive switch. The only way I see this working would be if both MACs are in your authorization tables for your .1x data source AND the user was authorized in both realms (if two realms are in play here).

share|improve this answer

I highly doubt this aswell..

The authentication is based on the mac address.. Thats why you can perform man-in-the-middle and replay attacks..

Using another mac address fails for these attacks.. due to the fact that its not authenticated..

How do you plan to secure this, even if it was a possibility??

im very curious.. :D

share|improve this answer
    
The ending sentence was merely a disclaimer to not be treated as a hacker - bad experiences in the past. I just want to establish that an mac-address is consistent with the certificate. –  HalloDu Nov 17 '10 at 20:09
    
ahh right... :D Secure it by trying to hack it.. thats what i would do.. –  Arenstar Nov 17 '10 at 20:11
    
yes, that's what I wanted to try next time I am on the scene. But it cannot hurt to get some opinions on the matter beforehand and that is easier if nobody thinks you are the bad guy –  HalloDu Nov 17 '10 at 20:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.