8021Qci

IEEE 802.1Qci is an amendment to the IEEE 802.1Q family that introduces a MAC security mechanism based on per-port ingress filtering. The purpose is to prevent unauthorized or spoofed MAC addresses from entering a bridged network, thereby reducing the risk of MAC spoofing and MAC address table flooding in access networks and other bridged topologies.

The core concept is per-port MAC address validation. Each switch port maintains a set of allowed source MAC addresses (a MAC address validation database) learned from legitimate traffic or explicitly configured. When a frame arrives on a port, the device checks the source MAC address against the allowed set; frames with unknown or disallowed source addresses are dropped, which helps limit rapid growth of the MAC table and mitigates certain denial-of-service scenarios. The mechanism can support dynamic learning, provisioning, and rate-limiting to balance security with normal device mobility.

802.1Qci is designed to operate independently of higher-layer authentication methods and commonly complements existing security controls such as 802.1X. It is particularly relevant for service provider access networks and enterprise networks where multiple customers or devices connect through multiple access points, helping to protect switching infrastructure from common MAC-based attacks while preserving normal forwarding behavior for legitimate traffic.

In deployment, hardware and firmware implement the ingress filtering function as part of the bridge or switch’s security features. Administrators may configure policy settings, determine which addresses are allowed on specific ports, and monitor events related to blocked frames. The standard remains a component of the broader 802.1 QoS and security ecosystem, with interoperability considerations tied to device capability and vendor implementation.