With pretty much every manufacturer of Cellphones (and growing in other devices), MAC address randomization is making it impossible to block those using this functionality from accessing a public WiFi network to be a public nuisance.

The thought that the Manufacturer MAC list could be imported as a file to hash match against connecting devices, allowing the Controllers (and Access Points) to reject connections on an SSID with a "Allow Manufacturer MACs Only" option, meaning devices connecting must offer up their manufacturer's authentic MAC address.  Now this won't stop them from abusing the system by way of putting in one from another device manufacturer, but it would help with those who aren't aimed at causing grief on a public SSID where we cannot block or limit them.

This randomization of MAC address does pose a security concern as if a password is stolen from someone, that device could wind up on a private network and you couldn't tell what it was or for that matter, how many times it's been there as they'll show up as a new device each time.  Location tracking is "somewhat" possible by way of using the APs to locate the device, only if there is sufficient APs to triangluate.

The maps on the Controller would work very well to "determine" where a device is in relationship to the APs, if there is enough horsepower in the Controller to do so.

Anyone have any thoughts?