> Because in some situations, this is literally the only means you have to get someone off your network. I'm arguing that it is possible and fairly straightforw

> Because in some situations, this is literally the only means you have to get someone off your network. I'm arguing that it is possible and fairly straightforward to tell why your MAC address got banned Of course that might be the only means to remove someone from layer2 of your network. I don't disagree. I think there are reasons for spoofing MAC addresses (like having it randomized on startup) are complete legitimate and indicate nothing about intent. > If this happened on my company's network, the next step would be tracking the person down with physical security and letting them know the police would be enforcing the ban next time. Absolutely. I just don't think wire fraud should be tacked on to their other crimes on your network just because their MAC address changed.