Mac Access List
You set up a mac access list by adding hardware rules to a switch port. A mac access list checks ethernet frame headers and drops frames from unknown devices. Network teams use these lists to keep rogue gear off local network segments. Still, broad rules or shared ports let bad traffic slip right through the switch. Once a machine passes the check, it can reach every open system nearby. How a mac access list filters network traffic Every network card has a physical address burned into its har
Access List: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up a mac access list by adding hardware rules to a switch port. A mac access list checks ethernet frame headers and drops frames from unknown devices. Network teams use these lists to keep rogue gear off local network segments. Still, broad rules or shared ports let bad traffic slip right through the switch. Once a machine passes the check, it can reach every open system nearby.
How a mac access list filters network traffic
Every network card has a physical address burned into its hardware chip. When a computer sends data, the local switch reads the source and target addresses. The admin writes a list of permit and deny statements on the switch. Next, the admin binds that rule list to a physical port or virtual network. The switch checks every incoming frame against the rules from top to bottom. If a rule matches the frame, the switch either forwards or drops the packet. If no rule matches the hardware address, a default rule drops the frame. Some rules also check the ether-type field to filter non-IP traffic on the wire. Teams must update these lists by hand whenever a worker gets a new laptop. In large offices, tracking thousands of hardware addresses creates daily headaches for support staff.
What hardware filtering solves and what it misses
Hardware filtering stops casual visitors from plugging unknown laptops into wall jacks. It also blocks basic layer two floods from untrusted printers or sensors. Yet a hardware address is very easy for an attacker to copy and fake. Any user with local admin rights can change their network card address in seconds. Once a frame passes the switch port check, the switch stops inspecting the session. The switch does not know which human user is sitting at the keyboard. It cannot read the database queries or shell commands inside the network packets. If an approved laptop runs a bad script, the switch forwards every single command. The network rule only decides which wire can talk, not what the user runs. It also cannot rewrite sensitive fields like emails or phone numbers in query results.
Moving from device checks to command controls
Modern teams do not rely on hardware addresses to guard databases or servers. Remote staff work from home networks where office switch rules do not exist. Cloud servers also change virtual network cards whenever they scale up or down. Instead of trusting a network card, teams check user identity on every session. Admins link database and server roles directly to their central identity provider groups. They also inspect individual SQL statements and shell commands while the session runs. High risk commands require a quick peer approval before the server runs them. Data masking rules rewrite card numbers and national IDs in live query outputs. This approach protects production data even when a trusted laptop gets stolen.
Access List: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Can a mac access list block IP traffic?
Most hardware lists only filter non-IP frames or check basic ethernet headers on ports. To filter specific IP addresses or ports, you must use an IP rule list.
How easy is it to bypass hardware address filtering?
An attacker can sniff wireless or wired traffic to find an allowed hardware address. They can then set their own network card to use that exact same address.
Should we use hardware lists for database security?
No, hardware lists only control layer two switch ports and ignore user identity. Database security requires user login checks, command logs, and field masking for emails.