 only grant access if the requesting MAC address is found in the list. MAC filtering appears to be a highly effective security measure but, as MAC addresses are included in transmitted data packets, a hacker could recover permitted MAC addresses by "sniffing" wireless traffic. Although the MAC address is a factory set identifier, that is, in principle, unique to an individual adapter card, a MAC address can also be temporarily reset by software to allow a device to masquerade as (or spoof) another device. This may sound like a built-in fault, but it also has a legitimate use as some ISPs use MAC address filtering to control customer access. If it is necessary to connect more than one device to the Internet using a single ISP connection it will be necessary to reset the MAC addresses of all devices to be the same as the MAC address that was registered with the ISP. Enabling MAC address filtering is a simple button click in the access point set-up procedure, as shown in Figure 8-14. However, keeping the access list up-to-date can be a time consuming administration task, as every authorised client station must have its MAC address manually entered into the list. In a home WLAN this will be easy enough to maintain, but in a dynamic network such as an enterprise or community WLAN, where clients may be changing fairly frequently, the cost of the administration burden may quickly outweigh the security benefits it provides. Operational Security Measures Operational security measures address issues that should be considered during routine operation of a WLAN. The key operational security measures recommended in the NIST checklist are summarised in Table 8-9. Strong User Authentication Remote authentication dial-in user service (RADIUS), as described in the Section "802.1x Authentication Framework, p. 214", is the most Wireless LAN Security D-Link Building Networks for People AirPlus G 802.11g/2.4GHz Wireless Router Advanced Tools Status DI-524 Filter Filters are used to allow or deny LAN users from accessing the Internet 