MAC address
On a local network, a MAC address is the identifier the manufacturer burns into a device’s network interface and that travels in every link-layer frame. It exists to deliver traffic inside the segment, not to prove which device sent it: any operating system can change it in seconds.
How it works
A MAC address is 48 bits, written as six hexadecimal pairs. The first three octets identify the maker of the interface: they come from a block the IEEE allocates, so a MAC tells you who built the card before you have touched the machine. The manufacturer assigns the remaining three.
It lives at the link layer, which moves frames inside a single network segment. That is the practical difference from an IP address: the IP is what lets traffic leave the segment and cross routers, and the MAC crosses none. A switch learns which MAC it has seen on each port and uses that table to avoid repeating traffic to everyone; ARP is the protocol that maps an IP to the MAC that answers for it on the local network.
Two security uses follow from that: as an inventory label, to know which box is which, and as an admission rule, letting in only a list of known addresses. The first is reasonable. The second is the one worth looking at closely.
What goes wrong
A MAC is not a secret and not a credential: it is a name, and the device itself chooses it. Changing it is an operating system command, with no special privilege on most laptops, so a list of authorised MACs is a list of names anyone can write on their own door.
And those names are in plain view. On wifi, encryption protects the contents of a frame, but 802.11 headers travel in the clear, and that is where the MAC of every device that speaks is carried. So getting past a MAC filter needs no guesswork: listen for a while, note an address that is already authorised, wear it and walk in. That is why real admission control uses 802.1X rather than a list, and why an evil twin access point can clone the legitimate one’s MAC as well as its network name.
The other effect is newer, quieter and runs the other way. Modern phones and laptops randomise their MAC per network, precisely so that a person cannot be tracked from place to place. That breaks the inventory: the address in the logs stops identifying a device, and a hand-maintained allowlist starts blocking legitimate kit every time it reconnects.
Where this shows up in an audit
On a wireless pentest MAC filtering is almost always presented as a layer of security, and the first thing we check is whether it is the only one. We listen to the traffic around the site, pick up an address that is already admitted and try to join with it: if that works, the finding is not that a MAC can be spoofed, which is public knowledge, but that the network is leaning on something never designed to authenticate anyone.
The second question is inventory. Cross the authorised list against the asset inventory and entries usually turn up that no longer match any device the company owns, because nobody removes them when a laptop is retired. The third is network segmentation: what someone already inside that segment can actually reach, which is what decides whether the flaw costs you a printer or costs you the domain.