Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I read in a paper that some middleboxes like firewalls don't have a MAC address for security purposes. I couldn't confirm using Google search. Is this common practice? How is this done?

share|improve this question

closed as not a real question by John Gardeniers, mdpc, Ward, Khaled, Bryan Feb 17 '13 at 14:09

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

If the sole purpose of your firewall is to inspect and discard packets, there is no reason for it to have a MAC address. I mean, the whole point if a MAC address is to give the device a local (unique) identifier that other devices can use to talk to it. Since, in reality, they're only going to want to talk through it, it doesn't really need one.

In terms of implementation detail, the best one would be for it to pretend it's not there (which may violate standards). For example, take a packet. Inspect it, if it looks good, forward it on unmodified. If it looks bad, drop it like nothing happened.

share|improve this answer

How is this done is easily answered. You only need a MAC if you need to be reachable as a destination via IP. Not for the simple task of echoing data (like a simple hub does, or like an unmanaged switch).

And as a firewall you do not need to echo/forward everything, just the ports which are opened.

share|improve this answer

Host's interfaces can be grouped into the "bridge" - equivalent of the ethernet hub that simply retranslate everything incoming on the one interface to the others. All interfaces are works in so-called "promiscuous" mode and received every incoming packet despite of its destination MAC/IP-address at all. Host with bridge and packet filter inside called filtering bridge.

Filtering bridges was a common practice before vlans has been populated. They allow to seperate subnets in various ways and filter the traffic with complex rulesets. In fact, modern switches with vlans - are the same filtering bridges with the same logic inside.

Bridged promiscuous interfaces don't brodcast their MAC/IP over ARP so host become "stealth-host", invisible, insensible and inaccessible, manageable exclusively via console.

share|improve this answer
Can you please provide some articles/links which describe how to do that. – Bruce Feb 17 '13 at 20:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.