setting MAC adress instead of IP for a user

[Mr_X]

It will be cool if we can add a MAC adress to a user instead of an IP. It will be usefull for 3 things:

* because when the client has a dynamic IP, i don't want to add lots of IP and I don't want to add *@* (security reason). I have an ADSL and a cable connection. With the ADSL the first two numbers are not every connection the same (even the first number).
* for security, because IP Spoofing can't be used
* it takes a little less time to check MAC (MAC is on layer 2 of ISO model and IP is on layer 3) and banning a MAC is more efficient to ban someone when he has a dynamical IP connection.

[ADDiCT]

FYI: it is very easy to give your network adaptor another MAC address, most (decent) cards have a setting for that in their driver properties

(just saying that a banned MAC address can give u a false feeling of security)

about the 'checking takes less time': it takes just as much time or even more time:
- at 'firewall' level: the packet requesting a TCP connection - contains both remote MAC and IP
- at ioFTPD level: io establishes the connection first to check the ip, i don't think there is a way to check the remote IP before a connection is established. the remote IP is then just 1 api call away, while the remote MAC address, well... i don't have any idea how to get it through winsock

[MaistroX]

This is a REALLY great suggestion, u have my vote for this .

[Mouton]

Originally posted by Mr_X
* for security, because IP Spoofing can't be used

A MAC address can be spoofed MUCH more easily than an IP, like ADDiCT mentionned. Any user can change his MAC address as he see fit.

Originally posted by Mr_X
* it takes a little less time to check MAC (MAC is on layer 2 of ISO model and IP is on layer 3) and banning a MAC is more efficient to ban someone when he has a dynamical IP connection.

ioFTPD doesn't have any idea what the MAC address of the client is. io deals with TCP/IP, not raw ethernet packets. Having it dwelve lower in protocols would require more resource, not less.

[darkone]

Afak mac address of client usually doesn't reach the server - it's only received, when there is no router between.

[Mr_X]

A MAC address can be spoofed MUCH more easily than an IP, like ADDiCT mentionned. Any user can change his MAC address as he see fit.

My cable modem get my NIC's MAC adress and if i change of MAC internet doesn't work anymore (I have to call my provider to ask resetting modem). And less people know MAC spoofing than IP Spoofing

ioFTPD doesn't have any idea what the MAC address of the client is. io deals with TCP/IP, not raw ethernet packets. Having it dwelve lower in protocols would require more resource, not less.

it will require more resource only on connecting. That's not a problem. I don't think there are not lots of people connecting to a ftp at the same time. If yes, it's not a problem because computers have enough ressource to do it.

[ADDiCT]

My cable modem get my NIC's MAC adress and if i change of MAC internet doesn't work anymore (I have to call my provider to ask resetting modem). And less people know MAC spoofing than IP Spoofing

i'm guessing u are on Telenet like me?
if u release your ip before u change your MAC address, it works in an instant. If not, wait a couple of minutes (same time as when u would connect your modem to another computer).

[Mouton]

Well, i think dark's comment is enough for thread to be closed.
Not possible.