Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to rate limit an API server. Is it possible to configure a machine to rate limit requests per MAC address? If not, are there any other viable options?

I want to rate limit per MAC, because multiple users could share one IP.

share|improve this question
You want to rate limit per MAC, so all the users are on one single LAN, aren't they? – user130370 Jan 22 '13 at 0:18
I don't know what you mean. – Erik Aigner Jan 22 '13 at 0:24
MAC addresses are administratively assignable these days. Maybe 20 years ago NICs couldn't do this, but faking a different MAC is trivial these days. – Chris S Jan 22 '13 at 1:25
Rate-limiting by MAC is a bad idea, on your LAN everyone on the Internet shares a MAC address -- the MAC address of your router. – David Schwartz Jan 22 '13 at 9:40
up vote 3 down vote accepted

MAC addresses are purely an OSI Layer 2 phenomena. Once a packet passes through a router, MAC address information from the source machine is no longer available.

So as the above person commented, if you're only offering this service to internal users, and those users as well as the service itself are all on the same Layer 2 network, then this might be possible. That seems highly unlikely, though. Conversely, if your users are scattered around the internet, then you'll need to use some other rate limiting scheme (IP, API key, etc.).

share|improve this answer

You need to redesign your application.

You can't rate limit by MAC address because you have absolutely no way to obtain the user's MAC address, since you are not on the user's local network.

The way everyone else does this is to issue unique API keys to each individual user, and then to rate limit usage by API key.

share|improve this answer
The problem is, the web app is a client of the API itself. So if I would issue API keys, someone could just abuse the key of the web (JS) client. – Erik Aigner Jan 22 '13 at 1:22
In that case you have even more redesigning to do... – Michael Hampton Jan 22 '13 at 1:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.