TechKnowSurge
CompTIA Security+ 3.2 ISC2 CISSP 4.2 NIST 800-53 IA-3 NIST CSF PR.AA-03
TechKnowSurge Catalog Videos Port Security
VideoSecurityFree

Port Security

Port security controls network access by restricting which devices can connect to a switch port based on MAC addresses, offering a simple but limited layer of physical network protection.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Port security is one of the most accessible methods for controlling access at the network edge, operating by restricting which devices can connect to a switch port based on their MAC address. Every network interface card has a MAC address permanently assigned by its manufacturer, and on a local area network, this address is what devices use to communicate with one another. By associating specific MAC addresses with specific ports, network administrators can prevent unauthorized devices from gaining access simply by plugging into an open switch port, which is a real threat vector when an adversary has physical access to a facility. Port security can be configured in two ways. Static configuration requires an administrator to manually enter allowed MAC addresses for each port, which is more secure but more labor-intensive to maintain. Dynamic configuration allows the switch to learn MAC addresses automatically when a device first connects, which is easier to manage but introduces risk since any device that connects first will be recognized. Whether static or dynamic, administrators can also cap the number of MAC addresses permitted on a single port, which is a practical way to prevent users from attaching their own unmanaged switches and inadvertently disrupting network stability. This same MAC-based filtering approach extends to wireless networks, where access points can be configured to allow only devices with recognized MAC addresses. However, port security in both wired and wireless contexts carries a significant limitation: MAC addresses are not secret. They are visible to any device on the local network segment and can be captured and cloned with minimal technical effort. MAC spoofing makes it straightforward for an attacker to impersonate an approved device and bypass these controls. Port security is therefore best understood as a low-friction baseline control that adds complexity for casual or opportunistic attackers, rather than a robust defense against a determined adversary.

What you'll learn

What's covered

Port Security

Aligned to

CompTIA Security+
3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
ISC2 CISSP
4.2 Secure network components
NIST 800-53
IA-3 Device Identification and Authentication
NIST CSF
PR.AA-03 Users, services, and hardware are authenticated.

Key terms

Port Security
A Cisco switch feature that restricts which devices can connect to a port by limiting the number of allowed MAC addresses or requiring specific MAC addresses to be present. When a violation occurs, the port can be configured to shut down, restrict traffic, or send an alert.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Network Interface Card
NIC
A hardware component that connects a computer to a network.
Switch
A network device that connects devices within a LAN and forwards traffic based on MAC addresses.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Data Exfiltration
The unauthorized transfer of data from a system to an external destination.

Topics

Port Security Mac Address Filtering Network Access Control Switch Configuration Networking Mac Address Learning

Transcript

One of the most basic ways that we can control access to a network is through port security. It is also very simple to set up, which might be why we would want to implement port security. It's not a perfect solution, but it's an easy solution to implement.

The Problem It Solves

Let's say I was an adversary and I wanted to hack into a network. One of the ways I could do that is somehow figure out physical access to get into the network and plug a device into the switch. Largely our networks are open, so once we plug into the switch now we have access to a lot of resources and there's nothing that's controlling my access to that. So I could either plug it in on a machine, or better yet I can just plug in a little box that's hidden from everybody else, hidden out of sight. Now I have free access, and that is going to maybe do some data exfiltration where I'm going to have control within that network through this device. So this is where something like port security can really shine and stop somebody from just coming in and plugging in a random device.

MAC Addresses

Port security uses MAC addresses to limit the access into a network. Local area networks, or Ethernet, in this case right here it's Ethernet that is communicating back and forth. This Ethernet network uses a MAC address for one machine to be able to talk to another machine on this local area network, so it has to have a MAC address.

These MAC addresses are burned into a network interface card. So if your machine has a network interface card, there's a good chance it has two actually. It probably has a wireless one, and it probably has one built into the motherboard. So if there are two of them on there, then it would have two MAC addresses, one per network interface card. And whoever the manufacturer is for that network interface card is the one that has burned in that MAC address into that network interface card. So that's what exists on the computer, some sort of MAC addresses associated with each one of its network interface cards. Now if it connects in, then it will use that MAC address to communicate on that network.

How Port Security Works

Port security just means that we're limiting who can plug into a port based off of their MAC address. So if this is the MAC address of this machine and it's assigned to this port right here, then what happens is that no one else can plug into that port. And also, if it's not allowed, then this machine can't plug into a different port. So we control which port this machine has access to based off of its MAC address.

Static Versus Dynamic

There are static or dynamic port security. What I mean by that is that this port right here can either statically be set up for this MAC address, so no other machine can connect to it unless it has that MAC address, or it could dynamically learn it. So when we plug in this machine, it will learn of this MAC address and now no other machine can plug into that port, because it now is associated with this MAC address. This just makes it easier to manage if it's more dynamic, versus a static where I have to manually go in there and enter those MAC addresses initially. Static would be more secure, versus dynamic would be less secure, because now anybody can plug in and it will learn that MAC address.

If it does learn about it dynamically, then maybe we don't want it to permanently associate with that port. We can have it so it permanently associates with that port, and now only this machine can plug into that port until we reset that port. Or what we could do is we could say, well, after a certain period of time it can do away with that MAC address and another machine can plug into it, which lessens the security but allows it to be more dynamic, where another machine can plug into it.

Limiting the Number of MAC Addresses

Usually what we do, if we're just learning about these MAC addresses temporarily, is we're just limiting how many MAC addresses can use that port. What this does is it allows it so somebody doesn't plug in a switch with many devices that are hanging off of this, because a lot of times we want to be very specific about which network devices we have, how many switches we have, and we don't want stray switches that cause problems on our network. And the sign of a stray switch, or something else that's plugged into this network, is multiple MAC addresses. So what we might do is we might limit it to only two MAC addresses, or only one MAC address, that can be on this port at any given time, which limits it to just a single MAC address, and now only one computer can be plugged into there.

When I worked at a university, this is the way we set it up. We didn't want to control what devices plugged into our switches, but we did want to limit how many devices. We didn't want people to be plugging in their own switches, which could cause problems and interrupt all the rest of the students if they plugged that in wrong. So we controlled how many MAC addresses could be on each of those ports.

Wireless Filtering and the Limits of This Approach

This is a common method also with wireless, to limit who can access a wireless network based off of the MAC address. So we can do wireless MAC address filtering as well.

This is not a great solution though. The problem here is this is readily accessible information, this MAC address here. Anybody on this network, on this local area network, can really see what that MAC address is. If you're communicating wirelessly you can see what that MAC address is. So it's very public information and it's very easy to spoof. It's very easy that I could claim that this is my MAC address and plug into the port.

So it does add a level of security and complexity to the network, so that way I can control who accesses the network. But by no means is this a great solution, because anybody can mimic these MAC addresses and it's very simple to do.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →