Changing Your MAC Address

From Wikibooks, the open-content textbooks collection

Although physical MAC addresses are permanent by design, several mechanisms allow modification, or "spoofing", of the MAC address that is reported by the operating system. This can be useful for privacy reasons, for instance when connecting to a Wi-Fi hotspot, or to ensure interoperability. Some internet service providers bind their service to a specific MAC address; if the user then changes their network card or intends to install a router, the service won't work anymore. Changing the MAC address of the new interface will solve the problem. Similarly, some software licenses are bound to a specific MAC address. Changing the MAC address in this way is not permanent: after a reboot, it will revert to the MAC address physically stored in the card.

Other methods of changing the MAC address are permanent; at least one network card manufacturer bundles networking hardware with software that allows the user to change the MAC address. These network cards usually come with a bootable CD-ROM that executes a utility that permits the user to change the MAC address burned into the EEPROM. When a hardware-based solution is not utilized, the user who intends to change the MAC address must instead rely on a software-based solution. The appropriate software solution is dependent on the operating system installed on the computer. Various software-based solutions are described below.

As a MAC address can be changed, it can be unwise to rely on this as a single method of authentication. IEEE 802.1x is a standard better suited to authenticating devices at a low level.

Contents 1 Linux 2 FreeBSD 3 OpenBSD 4 Mac OS X 5 Windows 6 Other systems 7 Without Root Privileges 8 External Links

[edit] Linux

Under Linux, the MAC address of a network interface card (NIC) can be changed by doing the following. Note that you must be root in order for this to work:

/etc/init.d/networking stop

ifconfig eth0 hw ether 02:01:02:03:04:08

/etc/init.d/networking start

Under Fedora Core 5, and possibly in other Linux distributions, to disable and restart networking, one must stop and start /etc/init.d/network, instead of /etc/init.d/networking. If you have the Iproute2 tools installed, you may prefer to use the ip command instead:

/etc/init.d/network stop

ip link set eth0 address 02:01:02:03:04:08

/etc/init.d/network start

To confirm your setting you may prefer to use ip link ls eth0 or ip addr ls eth0 instead of using ifconfig eth0.

NOTE: You may not be able do this if using a DSL modem (depending on modem vendor or ISP).

In Red Hat Linux and other similar systems (Fedora Core, etc.) an easy way to make it "permanent" across reboots is to just add a variable like this to the ifcfg-eth0 or similar file:

MACADDR=12:34:56:78:90:ab

Upper or lower case on the MAC address are fine, because the network function converts it to upper case.

and service network restart for prompt results.

In Debian just put

hwaddress ether 02:01:02:03:04:08

in the appropriate section of /etc/network/interfaces so that the MAC address is set when the network device is started.

In Gentoo you can do this in global configuration file /etc/conf.d/net for each ethernet card. Example for eth0 device:

mac_eth0="12:34:56:78:90:ab"

You can also use the tool MACChanger to change the MAC address under Linux.

To change MAC address during boot time with MACChanger,add the following line to your /etc/network/interfaces

pre-up macchanger -m 12:34:56:78:90:AB eth0

[edit] FreeBSD

Under FreeBSD, the MAC address can be changed in a similar way:

ifconfig fxp0 ether 02:01:02:03:04:05

This can be done without needing to take the interface down and back up.

[edit] OpenBSD

As of OpenBSD 3.8, the MAC address can be changed as follows:

ifconfig bge3 lladdr 02:01:02:03:04:05

[edit] Mac OS X

Under Mac OS X, the MAC address can be altered in a fashion similar to the Linux and FreeBSD methods:

ifconfig en0 lladdr 02:01:02:03:04:05

or

ifconfig en0 ether 02:01:02:03:04:05

This must be done as the superuser and only works for the computer's ethernet card. Instructions on spoofing AirPort Extreme (2.0) cards are available here. For OS X 10.5, instructions are available here. There are not, as of yet, any known ways to spoof original AirPort (1.0) cards.

[edit] Windows

Under Windows XP, the MAC address can be changed in the Ethernet adapter's Properties menu, in the Advanced tab, as "MAC Address", "Locally Administered Address", "Ethernet Address", "Physical Address" or "Network Address". The exact name depends on the Ethernet driver used; not all drivers support changing the MAC address in this way.

However, a better solution - requiring Administrative User Rights - is to pass over the System Registry Keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}. Here settings for each network interface can be found. The contents of the string value called 'NetworkAddress' will be used to set the MAC address of the adapter when next it is enabled. Resetting the adapter can be accomplished in script with the freely available command line utility devcon from Microsoft, or from the adapters context menu in the Network Connections control panel applet.

Note: to check your MAC address easily under Windows NT4, Windows 2000 or Windows XP: Click "Start", choose "Run...", type CMD and click OK, then type ipconfig /all in the Command Prompt window that appears. The number under physical address is the MAC address. If multiple IP are displayed, you should look under the label "Ethernet adapter x", where x is the name of your connection (which is Local Area Connection by default).

[edit] Other systems

You can use a third-party utility to change the MAC of almost any Ethernet adapter - two of them are listed below in External Links.

Most consumer-grade routers allow for a user-specified MAC address to be given.

[edit] Without Root Privileges

There are a number of techniques for changing your MAC address without root privileges on Unix based systems (Linux, BSD, OSX, etc.). This can be done with such techniques as LD_PRELOAD or ptrace. See the external links for a tutorial.

[edit] External Links

• Macshift - a Free Software Scriptable MAC Address changer for Windows XP.
• Multiple techniques for spoofing a MAC address (root and non-root) on UNIX based systems.