In one embodiment, a method comprises detecting, by a network device, an endpoint device attempting to access a data network via a data link; and generating, by the network device, a unique device signature for identifying the endpoint device based on the network device identifying a sequence of link layer data packets transmitted by the endpoint device upon connection to the data link, the unique device signature identifying a behavior of the endpoint device independent of any link layer address used by the endpoint device.