North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: Ethernet EP - MAC Address Filtering

  • From: Deepak Jain
  • Date: Fri Feb 08 15:54:17 2002

-----Original Message-----
From: [email protected] [mailto:[email protected]]On Behalf Of
David McGaugh
Sent: Friday, February 08, 2002 3:18 PM
To: [email protected]
Subject: Ethernet EP - MAC Address Filtering

Just curious if anyone is performing MAC Address Filtering at any of
the Ethernet Exchange Points. If so has it been found to be easy to
administer or difficult where by peers may be changing Layer 3 devices
or Interfaces without notice? Alternately is MAC Address Filtering
considered an unneeded security measure?



Speaking of this, is MAC Address filtering [at an IX] really designed to
eliminate the possibility of new hardware showing up on the port or is it
more the idea of keeping lots of boxes from showing up directly [like
hanging another switch off the port]. If its the latter, a seemingly
sensible approach would be to limit the number of unique MAC addresses to
like 2-4 per port.

This way you can change your equipment without prior notice, but you can't
(as easily) violate the integrity of the switching fabric.

I know for our network ports we limit to no more than 2 unique MACs in a
certain time period [~5 minutes or so] which again, allows swapping of
equipment without compromising anything that MAC layer filtering is supposed
to protect.

Deepak Jain