WiFi网络设备仿冒检测：MAC地址仿冒后的日志排查与身份验证

1. Can spoofed devices in a WiFi network be detected? #

Absolutely—while spoofing (especially MAC addresses and device names) is relatively easy for basic attackers, there are reliable ways to spot these fake devices:

• MAC address conflict alerts: Most routers log warnings when two devices with identical MAC addresses connect. This is a clear red flag, since valid hardware uses unique MACs (reused MACs from cheap gear are rare in trusted networks).
• ARP traffic inconsistencies: Spoofed devices often send unexpected ARP replies or claim the same IP/MAC pair as a legitimate device. Router logs will capture these anomalies.
• Behavioral mismatches: Compare the device’s activity to the real trusted device. For example, if your "trusted desktop" suddenly starts port scanning or connects at 2 AM when the real device is powered off, that’s suspicious.
• Wireless fingerprinting: Advanced routers or monitoring tools can detect unique hardware signatures—like signal strength variance, transmission timing, or supported 802.11 features. These are far harder to spoof than a MAC address.

2. How to detect spoofed devices via router logs when attackers fake MAC and device name? Can routers identify unalterable vendor info? Is full device identity forgery impossible? #

Let’s break this down into actionable parts:

Detecting spoofed devices via router logs #

Router logs hold critical clues even when MAC/name are faked:

• OUI mismatch checks: The first 3 octets of a MAC address (OUI, Organizationally Unique Identifier) are assigned to specific hardware vendors. Routers log this OUI alongside the MAC. If an attacker spoofs your iPhone’s MAC but uses an OUI tied to a no-name hardware brand, that’s an obvious warning.
• Connection pattern anomalies: Logs track device connect/disconnect times. If the "trusted laptop" connects while the real device is already online, or connects from a part of your space where the real device can’t reach, that’s suspicious.
• Unexpected traffic types: Look for logs showing the spoofed device sending outbound traffic to unknown IPs, or using ports/protocols the real device never uses.

Can routers identify unalterable vendor info? #

Yes and no. Routers use the OUI from the spoofed MAC to look up a vendor—but they can’t see the actual hardware OUI embedded in the attacker’s wireless chip. However, if an attacker uses a random MAC with an invalid/unregistered OUI, most routers will flag it as an "unknown vendor," which is a clear warning sign. Attackers can spoof valid OUIs, but this doesn’t change their hardware’s true identity (just what the router sees).

Is full device identity forgery impossible? #

You’re mostly right—full, perfect forgery of a device’s identity is extremely difficult, and impractical for most attackers:

• Beyond MAC/name, wireless devices have unique hardware fingerprints: radio frequency offsets, signal attenuation patterns, and frame timing behaviors hardcoded into their chips. These can’t be easily modified with basic tools.
• Advanced enterprise routers or monitoring tools can pick up these fingerprints, even if the MAC is spoofed.
• That said, "full forgery" isn’t technically impossible—state-sponsored actors or highly skilled attackers might replicate these signatures with custom firmware or specialized gear. But for home/small business networks, this level of spoofing is not a realistic threat.

内容的提问来源于stack exchange，提问作者P. Kod