Ieee

IEEE 802.1X is a standard for Port-Based Network Access Control (PNAC) that prevents any device from sending or receiving traffic on a network port until it has successfully authenticated. Originally designed for wired Ethernet and ratified in 2001, it now equally underpins enterprise Wi-Fi (WPA-Enterprise/WPA3-Enterprise), where access points act as the port gatekeeper. The core premise is that physical access to a port — plugging in a cable or being in range of an access point — does not grant network access. The port is logically divided into two channels: the uncontrolled port, which passes only EAP authentication traffic (EAPOL frames), and the controlled port, which is fully blocked until authentication succeeds. Only after the authentication server approves the device does the switch or access point open the controlled port and allow normal traffic. This port-level gate is what separates 802.1X from higher-layer authentication: a device that fails 802.1X receives no IP address, cannot reach any network resource, and cannot even attempt an attack at layer 3.

MACsec (MAC Security, IEEE 802.1AE) is an IEEE standard, first published in 2006 and supported in the Linux kernel since 4.6 (2016), that encrypts and authenticates Ethernet frames at layer 2 — hop by hop between directly connected devices. Its operating layer is what distinguishes it from IPsec (layer 3) and TLS (layer 4): MACsec wraps Ethernet frames, not IP packets or TCP streams, so it can protect every byte that traverses a link segment regardless of what protocol it carries. ARP replies, DHCP offers, LLDP frames, routing protocol adjacencies, and layer-2 broadcast traffic are all encrypted and authenticated alongside application data — something neither IPsec nor TLS can accomplish because both require an IP header to already be present and unenforced. The topology implication of this is that MACsec is link-local and hop-by-hop: it encrypts between two directly adjacent Ethernet peers (a host and a switch, or two switches), decrypts at each hop for forwarding decisions, and re-encrypts toward the next hop. It cannot stretch across a routed boundary; for that, IPsec is the right tool.