> It means you're not welcome on the network anymore.
I thought it meant, that specific MAC address is not welcome anymore. Otherwise, why would you allow that person to reconnect again just because they changed their MAC address?
No it's not. What if they blocked the MAC because they detected botnet activity? There is absolutely no desire in this case to ban the person, or even to ban the entire computer if it has multiple OSs.
There is really no way to tell just from a MAC ban what the intent is.
>"Otherwise, why would you allow that person to reconnect again just because they changed their MAC address?"
Because in some situations, this is literally the only means you have to get someone off your network. I'm arguing that it is possible and fairly straightforward to tell why your MAC address got banned. The most obvious is by looking back at your history on the network. You know if you've done something questionable. Another way is to call the helpdesk and ask why you've been banned.
At no point is "I didn't know why" going to be a valid reason for spoofing a MAC address to get around a network ban. If you have the know-how to spoof your MAC address, you have the know-how to understand why it's necessary.
If this happened on my company's network, the next step would be tracking the person down with physical security and letting them know the police would be enforcing the ban next time.
> Because in some situations, this is literally the only means you have to get someone off your network. I'm arguing that it is possible and fairly straightforward to tell why your MAC address got banned
Of course that might be the only means to remove someone from layer2 of your network. I don't disagree. I think there are reasons for spoofing MAC addresses (like having it randomized on startup) are complete legitimate and indicate nothing about intent.
> If this happened on my company's network, the next step would be tracking the person down with physical security and letting them know the police would be enforcing the ban next time.
Absolutely. I just don't think wire fraud should be tacked on to their other crimes on your network just because their MAC address changed.
I thought it meant, that specific MAC address is not welcome anymore. Otherwise, why would you allow that person to reconnect again just because they changed their MAC address?