With change control, physical access, SNMP monitoring, etc. I just can't see
a layer 2 device/topology change in core/edge devices going unnoticed by
other means. But then, per PT Barnum, you can never go wrong underestimating
intellegence.
While SOHO is out of scope, I will have to pull a personal experience
with DSL MAC-level for the Mac out of one of my books, and throw it
into the OPSEC humor library. By the time I finally got my answer, I
was beating my head against the desk so it would feel good when I
stopped.