Media Access Control Security (MACsec) Tutorial

Wired Ethernet links are often assumed to be inherently safe simply because they require physical cabling, but that assumption doesn’t actually hold up. A frame traveling across a standard Ethernet link is completely unencrypted, so anyone with physical access to that link — tapping a cable, plugging into a hub, or compromising an intermediate device — can sniff it, modify it, or replay it later.

What MACsec Is

Media Access Control Security (MACsec), standardized as IEEE 802.1AE, is a Layer 2, hop-by-hop encryption standard designed to solve exactly this problem. It’s often described as the wired equivalent of WPA2/WPA3 on wireless networks — but instead of protecting a wireless link, it protects a wired link between two directly connected devices, such as two switches, a switch and a router, a server, or an access point. It’s important to understand that MACsec only encrypts traffic on the specific wire between two MACsec peers — it’s a hop-by-hop protection, not true end-to-end encryption across an entire path.