I think this article misses the point. Yes, MAC addresses are not to be trusted. They can be easily changed. However, the corollary to "you shouldn't blacklist

I think this article misses the point. Yes, MAC addresses are not to be trusted. They can be easily changed. However, the corollary to "you shouldn't blacklist MAC addresses" is "you shouldn't whitelist them either." Great, you just threw out DHCP, and are going down the network access control blackhole. (802.1X supplicants for everybody!) Most ISPs don't put multiple clients in a layer-2 domain, you can't trust it. So, most ISPs already don't trust MAC addresses, nor do they care. On a college campus, things are different, and locking down the network can only go so far technologically. You need technical measures and good communication to cover 98% of the users (IDS, automatic quarantine systems, simple registration), accommodation for the 1.9% of technically inquisitive/advanced users (forums, workarounds for edge cases), and a big stick for the remaining 0.1%. When I was at WWU, they ran a very liberal network. You could change your MAC address (as long as it wasn't taken from another user), you could run your own WiFi (as long as you took responsibility for it), you could run servers, and almost no protocol was banned (although it might be throttled.) But use someone else's credentials or interfere with the functioning of the network? Stick time. Sounds like the problem at this school is bad communication, and not having a holistic network management system. Not surprising: they're both hard, and most schools don't invest the time with any serious effort. ... and don't get me started on the campuses that ban IRC.