MAC address filtering

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does MAC address filtering on a router do?

A It scrambles all data so nobody can read it

B It only lets devices whose MAC addresses are on an allowed list join the network

2. Mia adds her phone's MAC address to her router's allow list. Her friend's laptop is not on the list. What happens when the laptop tries to join?

A The router lets the laptop join because it knows the Wi-Fi password

B The router refuses the laptop

3. Why is MAC filtering considered a weak form of security on its own?

A A MAC address can be copied (spoofed) by an attacker

B A MAC address changes every time a device connects

4. An attacker watches the Wi-Fi and sees an allowed MAC address. What can they do?

A Set their own device to use that MAC address (spoof it) to get past the filter

B Nothing, because the filter hides every MAC address

5. Which is true about setting up MAC filtering?

A It is easy to set up: you type each allowed MAC address into the router's list

B It is hard to set up: you must install special encryption software on every device

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1allow 3C:52:82:1A:9F:07		AAdds this device's MAC address to the router's allow list so it can join the network
2spoof_mac(laptop, 3C:52:82:1A:9F:07)		Bif mac in allow_list: accept() else: block()
3MAC filtering only accepts devices on the allow list and blocks all others		CMAC filtering uses MAC addresses, not IP addresses. The allow list should contain the phone's MAC address, such as 3C:52:82:1A:9F:07.
4Layer MAC filtering with a strong Wi-Fi password so one weak control is not the only protection		Dwifi_password = strong mac_filter = on
5mac_filter = on # now the network is fully secure		EMAC filtering alone does not make a network fully secure, because MAC addresses can be copied (spoofed). It should be layered with a strong Wi-Fi password.
6allow_list = [guest_phone] # phone uses its IP address		FMakes a device pretend to have another device's MAC address, which can trick MAC filtering

Definitions

MAC filtering

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF deviceMac __ allowedList THEN ALLOW device ELSE DENY device

allowedList = ["A4:5E:60:C1:22:9B"] router.macFilter = __

attackerMac = allowedMac IF attackerMac IN allowedList THEN _____ attacker

IF macOk ___ passwordOk THEN ALLOW device ELSE DENY device

IF deviceMac ___ IN allowedList THEN DENY device

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A SET mode TO allow_everyone

B ADD aa:bb:cc:11:22:33 TO list

C SET filtering TO on

Question 2

A device = new_phone

B mac = device.mac

C IF mac IN allowed_list THEN

D block_join()

E ELSE

F block_join()

Question 3

A allow = ['A1:B2:C3:D4:E5:F6']

B if mac not in allow:

C print('Joined')

D else:

E print('Blocked')

Question 4

A attacker sniffs the Wi-Fi

B attacker sees an allowed MAC

C attacker keeps their own MAC

D router thinks it is trusted

Question 5

A SET wifi_password TO strong

B SET mac_filter TO on

C RESULT: use MAC filter alone

Answer Key

MAC address filtering

Section A: Quick Questions

B — It only lets devices whose MAC addresses are on an allowed list join the network

B — The router refuses the laptop

A — A MAC address can be copied (spoofed) by an attacker

A — Set their own device to use that MAC address (spoof it) to get past the filter

A — It is easy to set up: you type each allowed MAC address into the router's list

Section B: Match the Pairs

allow 3C:52:82:1A:9F:07 → Adds this device's MAC address to the router's allow list so it can join the network

spoof_mac(laptop, 3C:52:82:1A:9F:07) → Makes a device pretend to have another device's MAC address, which can trick MAC filtering

MAC filtering only accepts devices on the allow list and blocks all others → if mac in allow_list: accept() else: block()

Layer MAC filtering with a strong Wi-Fi password so one weak control is not the only protection → wifi_password = strong mac_filter = on

mac_filter = on # now the network is fully secure → MAC filtering alone does not make a network fully secure, because MAC addresses can be copied (spoofed). It should be layered with a strong Wi-Fi password.

allow_list = [guest_phone] # phone uses its IP address → MAC filtering uses MAC addresses, not IP addresses. The allow list should contain the phone's MAC address, such as 3C:52:82:1A:9F:07.

Section C: Definitions

MAC filtering — A router setting that only lets devices with MAC addresses on an allowed list join. It is easy to set up but weak, because a MAC address can be copied (spoofed).

Section D: Fill in the Blanks

IF deviceMac IN allowedList THEN
    ALLOW device
ELSE DENY device

allowedList = ["A4:5E:60:C1:22:9B"]
router.macFilter = ON

attackerMac = allowedMac
IF attackerMac IN allowedList THEN
    ALLOW attacker

IF macOk AND passwordOk THEN
    ALLOW device
ELSE DENY device

IF deviceMac NOT IN allowedList THEN
    DENY device

Section E: Spot the Error

A — MAC filtering needs allow list mode so only listed devices can join. Allowing everyone turns the filter off. It should be: SET mode TO allow_list

D — A device whose MAC address is on the allowed list should be let in. Line 4 blocks it. It should be: allow_join()

B — This test lets in devices that are NOT on the allow list and blocks the ones that are. It should be: if mac in allow:

C — Spoofing means copying an allowed MAC address. If the attacker kept their own MAC, the router would not trust them. It should be: attacker copies the MAC

C — MAC filtering is weak because MACs can be spoofed, so it should be layered with a strong Wi-Fi password. It should be: RESULT: use both together