Possible MAC address reuse

When does the advisory appear?

The detector finds the same normalized MAC address in active RADIUS Accounting sessions on two or more different NAS IP addresses. Each location needs a Start or Interim accounting update from the last five minutes. The dashboard shows the MAC and observed NAS addresses so an operator can investigate.

Authentication logs alone are insufficient to prove two concurrent locations. A switch that does not send current Accounting updates will not contribute to this signal.

What should an operator do?

1. Open Dashboard → Security Events and record the MAC, NAS addresses and observation time.
2. Check active accounting sessions and the physical port or wireless association on each switch or access point.
3. Rule out normal roaming, a switch restart or a delayed Accounting Stop message. Confirm whether the two sessions really overlapped.
4. If impersonation is supported by the network evidence, follow the approved incident procedure to restrict the affected port or device. Verify the resulting VLAN and traffic on the switch.
5. Record the decision and outcome in the incident system; the advisory itself is a live observation, not a completed incident record.

Limits of this signal

• A copied MAC used on the same NAS, used at a different time or used without fresh Accounting may not be detected.
• Wireless roaming and delayed Stop messages can produce false positives.
• A MAC address is not a cryptographic identity. MAB and MAC-bound Wi-Fi keys remain susceptible to cloning.

Where devices support it, use 802.1X with EAP-TLS client certificates for stronger device identity. Keep Accounting enabled and verify its Start, Interim and Stop flow before relying on the advisory.

← All Knowledge Base articles