The MAC stays local to the ethernet LAN.
ah gotcha, so if someone is grabbing new ip's by changing their mac address, something does a reverse lookup on the ip, and bans based on the who owns the ip?
Is there an advantage to that vs. just doing a block of xxx.xxx.xxx.000/24 or xxx.xxx.000.000/16?
I suppose you don't end up chasing every block he appears on but grabbing whole groups like that could grab some collateral innocents, yes?