159
75
Can most enthusiastic users (even if they are not professionals) use well-known techniques to break through the average home router's security?
Some basic security options are:
Are some of these compromised and what to do to make the home network more secure?
kvhadzhiev
Posted 2014-03-24T22:56:12.970
Reputation: 1 429
148
Without arguing the semantics, yes the statement is true.
There are multiple standards for WIFI encryption including WEP, WPA and WPA2. WEP is compromised, so if you are using it, even with a strong password it can be trivially broken. I believe that WPA is a lot harder to crack though (but you may have security issues relating to WPS which bypass this), and as of October 2017, WPA2 also offers questionable security. Also, even reasonably hard passwords can be brute-forced - Moxie Marlinspike - a well known hacker offers a service to do this by for US$17 using cloud computing - although its not guaranteed.
A strong router password will do nothing to prevent someone on the WIFI side transmitting data through the router, so that is irrelevant.
A hidden network is a myth - while there are boxes to make a network not appear in a list of sites, the clients beacon the WIFI router thus its presense is trivially detected.
MAC filtering is a joke as many (most/all?) WIFI devices can be programmed/reprogrammed to clone an existing MAC address and bypass MAC filtering.
Network security is a big subject, and not something amenable to a Superuser question, but the basics are that security is built up in layers so that even if some are compromised not all are - also, any system can be penetrated given enough time, resources and knowledge, so security is actually not so much a question of "can it be hacked", but "how long will it take" to hack. WPA and a secure password protect against "Joe Average".
If you want to enhance the protection of your WIFI network you can view it as a transport layer only, and encrypt and filter everything going across that layer. This is overkill for the vast majority of people, but one way you could do this would be to set the router to only allow access to a given VPN server under your control, and require each client to authenticate across the WIFI connection across the VPN - thus even if the WIFI is compromised there are other [harder] layers to defeat. A subset of this behaviour is not uncommon in large corporate environments.
A simpler alternative to better securing a home network is to ditch WIFI altogether and require only cabled solutions. If you have things like cellphones or tablets this may not be practical though. In this case you can mitigate the risks (certainly not eliminate them) by reducing the signal strength of your router. You can also shield your home so that frequency leaks less - I've not done it, but strong rumour (researched) has it that even aluminum mesh (like fly screen) across the outside of your house, with good grounding can make a huge difference to the amount of signal that will escape. [ But, of-course, bye-bye cellphone coverage ]
On the protection front, another alternative may be to get your router (if it's capable of doing it, most aren't, but I'd imagine routers running openwrt and possibly tomato/dd-wrt can) to log all packets traversing your network and keeping an eye on it - Hell, even just monitoring for anomalies with total bytes in and out of various interfaces could give you a good degree of protection.
At the end of the day, maybe the question to ask is "What do I need to do to make it not worth a casual hackers time to penetrate my network" or "What is the real cost of having my network compromised", and going from there. There is no quick and easy answer.
Most clients using WPA2 - unless patched - can have their traffic exposed in plaintext using "Key Reinstallation Attacks - KRACK" - which is a weakness in the WPA2 standard. Notably, this does not give access to the network, or the PSK, only to the traffic of the targeted device.
davidgo
Posted 2014-03-24T22:56:12.970
Reputation: 49 152
as far as i know, WPA(1) is not much more secure than WEP: (edit) info here: http://www.howtogeek.com/167783/htg-explains-the-difference-between-wep-wpa-and-wpa2-wireless-encryption-and-why-it-matters/
– Sirex – 2014-03-24T23:53:06.9902Yes anyone can change their MAC address to a whitelisted one, but doesn't that a) cause immediately noticeable problems for the original owner of the MAC address, and b) isn't that some pretty obscure security by obscurity? When does a computer broadcast its MAC in the clear over a home network? – bright-star – 2014-03-25T02:23:06.367
3The most common time a computer exposes it's MAC address is when it uses a network connection - not really rare. As for obscure - it is not obscure relative to the context of the question which is what an enthusiast could do which presumably includes web-searching effectively. – Ram – 2014-03-25T03:01:51.107
What do you understand by "reasonably hard passwords"? Can a 20-char alpha-numeric password relatively easily be cracked? – landroni – 2014-03-25T05:27:47.860
2
@landroni - No, not easily, however if the password is made up of common words strung together its still well within the realm of cracking. The cracking doesn't need to be done by the machine trying to connect - rather it can harvest the information it needs and send it to the cloud to crack with lots more power, resources and even rainbow tables. A random 20 character password will be pretty bullet proof though. Have a look at https://cloudcracker.com/
– davidgo – 2014-03-25T06:58:45.227And what about a script in the router and on the PC that changes the WiFi password every week - or every day? – clabacchio – 2014-03-25T12:39:44.213
@Sirex that article says the problem in WPA is with WPS (an optional easy button way to get new devices configured for a network) davidgo covered that in his answer. – Dan is Fiddling by Firelight – 2014-03-25T13:06:46.873
2@clabacchio because now you've greatly inconvenienced your users? – Cruncher – 2014-03-25T15:50:45.083
@Cruncher I assume that the security concerns would outweigh user experience if such mechanisms are needed – clabacchio – 2014-03-25T15:53:54.617
1@clabacchio shutting down the network entirely would also make it more "secure". Would users be happy with that? – o0'. – 2014-03-25T17:22:29.447
1What about the WPA-Enterprise variations? Requires (a lot) more work for initial setup and configuration, but should also be much more secure than WPA-PSK. – ntoskrnl – 2014-03-25T20:25:43.340
Enterprise adds protection for authentication on your network but not against people listening to your traffic. – JamesRyan – 2014-03-26T12:12:31.740
A WIFI password has no need to be rememberable, short, easily typeable or anything, since you are rarely connecting new devices. So a sensible password can never be bruteforced - sensible being something like g-87:X/oUZaN'F`\x%se5TA#zg+cmGLd&. – Hans-Peter Störr – 2014-03-26T20:13:58.940
@hstoerr Except that password is trivially hackable by simply reading wherever it's written down for the other members of your family, guests, yourself 6 weeks later... I connect new devices at least once every 3 months (e.g. houseguests), which is just enough time that I would have no way of remembering if the 15th character was an apostrophe or a grave. – deworde – 2014-03-27T12:00:11.847
This is an important related discussion http://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase
– deworde – 2014-03-27T12:05:26.370@hstoerr Also, that password is in fact easier to bruteforce than "The Franglish of Spafflezap TootToot Mcgee the 3rd is not particularly clear". Also, "Poor Spafflezap, he tried so hard to learn Franglish." Good luck rainbow tabling those. – deworde – 2014-03-27T12:09:03.300
1+1. Excellent post, especially "What is the real cost of having my network compromised?". Your protection (of anything) should be equivalent to the cost of losing the protected item. In other words, don't spend tens of thousands of dollars protecting a home network that you only use for social networking. – Greenstone Walker – 2014-03-27T22:51:04.887
1@deworde OK, I assumed you trust the people in your appartement. I am certainly not proposing to remember it: my point was that it is often harmful to even try, since then you are bound to use weaker passwords. BTW: my password has 179 bits of entropy, and yours somewhere between 50 and 100, if english is 0.6 to 1.3 bits per letter, as Wikipedia says. – Hans-Peter Störr – 2014-03-28T07:31:15.687
What is a handshake file? – verve – 2014-03-29T15:29:52.293
A handshake file is a capture of the traffic used when a client negotiates a connection with an wifi router/access point. (See http://www.question-defense.com/2010/01/10/how-to-capture-a-4-way-wpa-handshake)
– davidgo – 2014-03-29T21:06:40.6671@Trevor Alexander: Google ARP Poisoning. – avgvstvs – 2014-03-31T04:27:31.373
52
As others have said, SSID hiding is trivial to break. In fact, your network will show up by default in the Windows 8 network list even if it's not broadcasting its SSID. The network still broadcasts its presence via beacon frames either way; it just doesn't include the SSID in the beacon frame if that option is ticked. The SSID is trivial to obtain from existing network traffic.
MAC filtering is not terribly helpful, either. It might briefly slow down the script kiddie that downloaded a WEP crack, but it's definitely not going to stop anyone that knows what they're doing, since they can just spoof a legitimate MAC address.
As far as WEP is concerned, it is completely broken. The strength of your password doesn't matter much here. If you're using WEP, anyone can download software that will break into your network pretty quickly, even if you have a strong passkey.
WPA is significantly more secure than WEP, but is still considered to be broken. If your hardware supports WPA but not WPA2, it's better than nothing, but a determined user can probably crack it with the right tools.
WPS (wireless protected setup) is the bane of network security. Disable it regardless of what network encryption technology you're using.
WPA2 - in particular the version of it that uses AES - is quite secure. If you have a decent password, your friend is not going to get into your WPA2 secured network without getting the password. Now, if NSA is trying to get into your network, that's another matter. Then you should just turn off your wireless entirely. And probably your internet connection and all of your computers, too. Given enough time and resources, WPA2 (and anything else) can be hacked, but it's likely going to require a lot more time and a lot more capabilities than your average hobbyist is going to have at their disposal.
As David said, the real question is not 'Can this be hacked?' but, rather, "How long will it take someone with a particular set of capabilities to hack it?" Obviously, the answer to that question varies greatly with respect to what that particular set of capabilities is. He's also absolutely correct that security should be done in layers. Stuff you care about shouldn't be going over your network without being encrypted first. So, if someone does break into your wireless, they shouldn't then be able to get into anything meaningful aside from maybe using your internet connection. Any communication that needs to be secure should still use a strong encryption algorithm (like AES,) possibly set up via TLS or some such PKI scheme. Make sure your e-mail and any other sensitive web traffic is encrypted and that you aren't running any services (like file or printer sharing) on your computers without the proper authentication system in place.
Update Oct 17, 2017 - This answer reflects the situation prior to the recent discovery of a major new vulnerability that affects both WPA and WPA2. The Key Reinstallation AttaCK (KRACK) takes advantage of a vulnerability in the handshaking protocol for Wi-Fi. Without going into the messy cryptography details (which you can read about at the linked website,) all Wi-Fi networks should be considered broken until they are patched, regardless of which particular encryption algorithm they're using.
Related InfoSec.SE questions regarding KRACK:
Consequences of the WPA2 KRACK attack
How can I protect myself from KRACK when I can't afford a VPN?
reirab
Posted 2014-03-24T22:56:12.970
Reputation: 1 498
11Good answer, especially the bit about WPA2-AES. I would add that the SSID is used to salt a WPA key, so if you don't want your WPA key rainbow-tabled, best to switch it to something other than "NETGEAR". – zigg – 2014-03-25T15:10:30.430
How hard is it to spoof a MAC address, since you'd have to get one that's on the whitelist. I know anything that is transmitted can be picked up manually, but isn't that a lot of work? – Seth – 2014-03-30T03:54:16.580
No, it's incredibly easy. It's sent in plain text at the beginning of literally every single frame, so all you have to do is capture one single legitimate packet on the network in order to find a MAC on the white list. As I said in my answer, it's trivial for anyone who knows what they're doing. – reirab – 2014-03-30T04:53:05.817
14
Since other answers on this thread are good, I think that, for those requesting a concrete answer (well... this is SuperUser, it is not?), the question could easily be translated as: "What should I know to make my WiFi network secure?".
Without negating (nor confirming) any of the other answers, this is my short answer:
The words of the cryptologist Bruce Schenier could be worthwhile advice for many users to remember:
The only real solution is to unplug the power cord.
This can often be applied to wireless networks: do we constantly need it working?
Many routers have a WiFi button to enable/disable wireless, like the D-Link DSL-2640B .
If not, you can always automate web enabling/disabling of wireless by using tools like iMacros (available as an extension for Firefox or as a standalone program) on Windows and many others on Linux.
And here are two tricks for WPA (please, forget WEP) password (a good WPA password will make attacks very difficult) creation (do not keep the default password) :
And, for the sake of God: disable WPS right now! It is totally flawed.
Sopalajo de Arrierez
Posted 2014-03-24T22:56:12.970
Reputation: 5 328
12Please, forget WPA and WPA2-TKIP. Use your tricks on WPA2-AES. – Darth Android – 2014-03-25T18:45:47.140
2What would be the point of a easily rememberable wifi password? After all you are very rarely connecting devices. Just use a good long random password - like Lm,-TMzQ7cf\6."owhAnpqC* . – Hans-Peter Störr – 2014-03-26T19:52:50.473
2If you have a static set of devices that rarely changes, OK. A of people have friends with gadgets they need to enable, and random passwords are problematic here. (There may be other solutions like a guest network, but that will still allow access to non-guest guests who want to use your resources) – davidgo – 2014-03-26T20:19:50.410
@davidgo OK, so for them the password should be more typeable. But I still think that the given guidelines are very good for passwords in general, but not for WiFi passwords. Being rememberable unnecessarily weakens them. Better use BduXboZfiXneLkiWfaWqoQriNvi and write it down somewhere. – Hans-Peter Störr – 2014-03-26T21:43:36.567
3@hstoerr, in my experience as an end-user and enterprise consultant, I have (nearly) always found that complex password are annoying and finaly discarded. You need a compromise solution. – Sopalajo de Arrierez – 2014-03-27T02:49:47.230
@DarthAndroid, the door to enter a WPA WiFi is a matter of bruteforcing the hash (named handshake), no matter if it is WPA, WPA2, WPA-PSK, WPA-TKIP or even WPA-AES. For that reason the best bruteforcing method as for today ( http://hashcat.net ) has the same attack switch for any of them.
– Sopalajo de Arrierez – 2014-03-27T02:53:33.9931
Keep in mind that having a password of You have two sons and 3 cats, and you love them. is more memorable than, and orders of magnitude harder to bruteforce than Yh2sa3c,aylt. See also http://xkcd.com/936/
2You are right, @IQAndreas: it is more memorable and harder to crack. But not easier to type. And, in my tests with HashCat, just for the shortest mode Yh2sa3c,aylt., it will last an estimate time of more than 10 years to bruteforce (even using one of the fastest personal computers you can afford today). – Sopalajo de Arrierez – 2014-03-28T10:40:18.857
I have a random passcode for our wifi, generated psuedorandomly, that I have memorized. Its not that hard to memorize a passcode – sww1235 – 2014-03-28T17:36:16.010
@SopalajodeArrierez: Muscle memory will likely make the longer one significantly easier to type for the standard use case of a wifi key, which is generally typed in rarely. If you input it often then the second will become more efficient, but it won't start that way. – Phoshi – 2014-04-01T09:25:30.240
7
None of the things you mention (apart from the network password) really affect the hacking of a Wi-Fi network. Insomuch as a MAC address filter and hidden SSID does nothing really to help in terms of security.
What really matters is the encryption type used on the network. Older network encryptions like WEP were trivial to break because with enough traffic you could decode them, and you could force them to generate the traffic you needed.
Newer ones like WPA2 are much more secure however. Now, nothing is 'secure' against all adversaries, but this is usually enough for home Wi-Fi.
It's a large topic, and this only touches on the tip of the iceberg, but hopefully it helps.
Sirex
Posted 2014-03-24T22:56:12.970
Reputation: 10 321
6
WEP and WPA1/2 (with WPS enabled) can be hacked trivially; the former by using captured IV's and the latter with a WPS PIN bruteforce (only 11,000 possible combos, from a 3 part pin; 4 digits [10,000 possible] + 3 digits [1,000 possible] + 1 digit checksum [computed from the rest]).
WPA1/2 are tougher with a strong password, but using GPU cracking and a bruteforce technique can bust some of the weaker ones.
I've personally cracked WEP and WPS on my work network (with permission, I was demonstrating the vulnerabilities to my employers), but I've yet to successfully crack WPA.
hanetzer
Posted 2014-03-24T22:56:12.970
Reputation: 252
5
This is a great question, and the guidelines for having very secure wireless should be well known. Configure your router/gateway/AP so that:
That's it! For all practical purposes you now have completely secure wireless.
Jason
Posted 2014-03-24T22:56:12.970
Reputation: 5 925
1@Jason One question immediately; what do you have against spaces? – deworde – 2014-03-27T12:07:18.010
1@ryyker I did say for practical purposes. – Jason – 2014-03-27T15:22:44.147
1@deworde I don't, but some cheap routers and connection managers do. – Jason – 2014-03-27T15:23:21.390
3
Over in the Cisco Learning Network forum, a thread-starter asked:
Can WPA/TKIP be cracked? Either someone in my guesthouse used up 80 gigs of data or someone close by cracked the password and used it. I suspect someone in the guest house because i find it hard to believe WPA/TKIP can be cracked and even if it can be cracked it would not be easy to do. How difficult if at all is it to crack WPA/TKIP? I want to change the password for them anyway, can i use - and _ and? characters?
An obviously very smart fellow named "Zach" made this posting which the thread-starter, here (and others, here, too, if they're interested), should read.
In particular, read from about two-thirds of the way down his posting, where he begins with the words "The solutions:".
I'm using my gateway's "WPA-PSK (TKIP)/WPA2-PSK (AES)" setting. In keeping with this of Zach's posting...
Change the name of your router to something unique. Your ESSID is used by your wlan supplicant as a cryptographic salt over the PMK. Changing this will eliminate pre-computation attacks.
...I've long used my own unique ESSID. Additionally, in keeping with his...
Make a unique password incorpating unique characters, numbers, capitals. multiple words, and lowercase letters. This is more important than length. Increasing the length of the password will only increase the passwords strength but it doesn't need to be obscenely long. Strength lies in variance of potential. This will eliminate dictionary attacks and make brute-force impossible without a super-computer.
...mine is 25 characters which consist of letters, numbers, upper-and-lowercase, and special characters. No part of it spells anything.
I do several other things both which Zach does and doesn't enumerate there; but in addition to the above, and said other things, and in at least the spirit of what he wrote here...
Enable detailed logging and if possible forward that to your email.
...I long ago wrote a bit of scripting code that auto-launches with Windows startup, and just runs in the system tray; which code periodically, throughout the day, hard-refreshes and then parses the webpage in my gateway which lists all connected devices; and it then tells me both as a pop-up-with-triple-beep-through-the-motherboard-speaker (not the regular audio speakers, just in case they're muted or something) on my desktop-replacement-laptop computer's screen, and also via text to my phone (which is either in a pouch on my belt, or at least never more than five feet from me, 24/7/365), if anything new has shown-up.
For those without that skill, there are several "who's on my WI-FI" type apps out there, some of them free. A good and simple one is [this badboy][3]. Just auto-start it with Windows, let it sit in the system tray, and tell it to "beep on new device" and you'll have something similar to what my script does (except that it won't SMS you). However, using [a simple scripting tool][5] you can cause an SMS or email to be sent to your phone when a new device on the LAN makes the app beep.
Hope that helps.
Gregg DesElms
Posted 2014-03-24T22:56:12.970
Reputation: 31
The last paragraph of your answer appears to be missing two links. – I say Reinstate Monica – 2017-05-21T02:10:36.057
2
Another consideration to any security analysis is the assets that need protection, and the value of those assets to the owner and a potential attacker. I would guess that your banking login, credit card number, and other login credentials are probably the most valuable information going over a home network and most of this should be covered by TLS/SSL encryption over an https connection. So it seems like if you use a WPA2 key on your wifi router, and make sure your browser uses https whenever possible (using a tool like eff's https everywhere), you're rather safe. (A potential attacker would have to go to the trouble of cracking your WPA2 key to maybe get a password that doesn't go over https or the http pages you're browsing.)
user119824
Posted 2014-03-24T22:56:12.970
Reputation: 41
2
Doubtful.
I disagree with davidgo's answer. While it is well researched and I agree with most of his information, I think it is a little pessimistic.
There are vulnerabilities in WPA2 covered already in the other answers. However none of these are unavoidable.
In particular, it should be noted that the brute force attack mentioned by davidgo is an attack on a weakness in MS-CHAPv2. See the cited author's reference [ https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/ ]. If Ms-CHAP is not used, this weakness cannot be exploited.
(deleted based on comment from author - wrong reference)
With the right pass phrase, SSID and avoiding compromised technology, I see no reason why a WPA2 secured network using AES256 would not be secure at the moment. Brute force attacks on such networks are not feasible, and even Moxy Marlinspike suggests this.
However, where I agree with davidgo's response is that most users don't make these efforts. I know that my own home network can be exploited, and even though I know how to fix it, it just isn't worth my time and effort.
timbo
Posted 2014-03-24T22:56:12.970
Reputation: 161
MS-CHAP is something different (Its used on PPTP, ie VPN connections and not Wireless connections, unless you are running PPTP over Wifi which is largely pointless. MS-CHAP is known to be fully broken). What I was referring to with Cloudcracker is something else. You prepare and send a sample of network traffic and the service tries to brute force it. Among other things it attempts to crack WPA and WPA2 passwords. The link is https://www.cloudcracker.com (nothing after that). I agree that WITH A STRONG PASSWORD, WPA2 is probably not practical to bruteforce.
– davidgo – 2014-06-29T05:58:24.273
26With the right tools and enough time anything is possible. – joeqwerty – 2014-03-24T22:57:46.927
61MAC filtering is absolutely pointless – Ramhound – 2014-03-25T01:30:04.963
@Ramhound I wouldn't say any security measure is pointless, unless it introduces security holes. The knowledge base for MAC spoofing I would agree is the same as identifying 802.11 authentication vulnerabilities but I definitely would not go so far as to say pointless – Mondrianaire – 2014-03-25T17:35:45.250
5@Mondrianaire - I would. Its trivial to mask your actual MAC address. An access point will basically broadcast the MAC addresses it will listen to. Furthermore in order to connect to an access point the MAC Address is sent unencrypted over the network. – Ramhound – 2014-03-25T18:38:57.630
12@Mondrianaire For internet access, my college network required signing up, and later would identify you by MAC address. It was trivial to spoof the address of one of my dorm neighbors. If I had done anything bad using that connection, it would have been identified as her doing it. I'd say MAC address filtering is one of those things that is too easy to create a false sense of security. – Izkata – 2014-03-25T18:53:27.477
@Ramhound I am in no way arguing what degree of security MAC filtering adds, only that *if a properly implemented security measure does not decrease security, it is not trivial to implement*. It is absolutely probable that someone who Youtubed 'how to hack the wifi' ran across a tutorial on reaver and are just plugging and chugging. After all, even though your back door might have a deadbolt, I bet the screen door still has a locking mechanism. Example thread: http://www.backtrack-linux.org/forums/archive/index.php/t-47038.html
– Mondrianaire – 2014-03-25T19:17:37.9838Well I am saying MAC filtering is not a security feature – Ramhound – 2014-03-25T19:19:37.083
10@Mondrianaire - It does introduce a hole. If someone is masking their MAC address as a belongs-here address, it's one less clue that someone who isn't supposed to be there has been on your network. If you aren't filtering MAC addresses, they probably won't bother to do that. – Compro01 – 2014-03-27T05:00:27.763
There are codes that allows you to clone MAC address, which is especially common in routers. When I saw that it can be cloned, it already told me that MAC address filtering should be as a "secondary" addition to your security, but definitely not part of top level of the security implementation. – Faron – 2014-03-27T21:46:31.057
Can anyone advise why MAC filtering is not a security feature? I understand a MAC address can easily be spoofed but how can the attacker know one of the MAC addresses on the whitelist without being connected to the network? – Andy – 2014-03-28T12:17:11.743
I did it a few years ago with a guide and simple knoppix distro full of security tools. Took only 45 seconds to get the WEP code with only 1 hour of logging the IV's. – DustinDavis – 2014-03-28T19:40:17.780
@Mondrianaire The locking mechanism on screen doors is to prevent the wind from pushing the screen open when you want the airflow into the house (and to keep the bugs out). – Izkata – 2014-03-29T18:38:50.720
@izkata The latching mechanism is separate from the locking mechanism. – Mondrianaire – 2014-03-29T20:13:30.973
@Mondrianaire In which case, no, none of our 3 screen doors had a locking mechanism. – Izkata – 2014-03-29T23:18:22.957
@izkata You have obviously lost the point of the argument in semantics. – Mondrianaire – 2014-03-29T23:49:19.163
1
Safes and door locks are rated in time to bypass (http://www.lockwiki.com/index.php/UL_437). Security is never a yes/no question. A better question to ask is how long do different security measures protect against covert entry.
– ghangas – 2014-03-30T19:02:50.2771
Defense in Depth (http://en.wikipedia.org/wiki/Defense_in_depth) "Rather than defeating an attacker with a single, strong defensive line, defence in depth relies on the tendency of an attack to lose momentum over a period of time or as it covers a larger area." The point of layering WPA2, a hidden SSID, MAC access filtering, strong passwords, and everything else together is never to defeat intrusion attempts. The point is to make the attempt egregious enough that the attacker will move on to an easier target.
– JMD – 2014-03-31T16:37:07.187I have the same question as Andy, while Mac Address is not the end all, doesn't help in that you would need to know the Mac Address to filter first. Also if two devices are connected with the same MAC address (or the second one tries to connect) wouldn't that be an indication of a problem. Are there any routers out there that will prevent two of the same MAC Addresses? – Mike – 2014-03-31T18:33:32.347