Hack the Route Start free Open app Identity and access
802.1X and EAP
Port login: a switch port (or Wi-Fi association) passes only login frames until the device proves who is using it.
Three roles: the supplicant (the device, e.g. wpa_supplicant), the authenticator (the switch or access
point) and the authentication server (RADIUS). The supplicant speaks EAP in Ethernet frames called EAPOL
(ethertype 0x888e, to the group address 01:80:c2:00:00:03, which bridges never forward); the switch relays each EAP
message to RADIUS and opens the port on Access-Accept. EAP is only a frame for methods: EAP-MD5 (identity in the
clear, offline guessable, deprecated), PEAP/EAP-TTLS (a password check inside TLS to the server, whose certificate
the client must verify), EAP-TLS (a certificate on each device: the strongest). A MAC allow-list is no substitute:
a MAC address is chosen by the sender.