Client MAC Randomisation

What is MAC Randomisation?

MAC Randomisation, also known as a Private wireless address, is used to improve the privacy for client devices. The intention is to mask the 'real' MAC address of the client device and therefore reducing the risk of that device being tracked for location or network analysis purposes.

How can it affect my network?

• Blocked Clients - If you block a specific MAC address the client could turn on/off the randomised MAC feature and reconnect to your network.

• Access lists - Client devices will need to have the randomisation turned off for your network so that their 'real' MAC can be added to the ACL, if they try to reconnect with the randomisation turned on then the devices would not be recognised as being in the ACL

• Splash page authentication - Use of authentication for clients on splash pages and captive portals becomes troublesome as users may need to re-input their credentials or vouchers codes, possibly exhausting any device limits in place.

• Analytics - As randomised MAC addresses change regularly you may end up with skewed results from visitor or presence analytics, the same person could have multiple MACs associated to their device.

• WiFi based tracking - Short term tracking of an individual MAC will be fine, but relating this to return visits or longer term visitors may not provide a full picture of location services.

• DHCP leases - Depending on how often the device reconnects and the random MAC changes you may need reduce the lease time to ensure the scope is not depleted.

How to spot randomised clients.

It is relatively easy to spot a randomised MAC address. There is a bit which gets in the MAC address which will signify if it is a randomised address. If the second character in the MAC address is a 2, 6, A or E it is a randomised address.

In the to examples below we can see that both the Android and Apple devices has MAC randomisation enabled, we can confirm this by noticing the that second character in the MAC is a 2 in both cases.

If we take a look at a list of clients connected to one of our cloud managed wireless networks we can see the range of MAC addresses and how many are already using MAC randomisation.