MAC address spoofing
This article gives several methods to spoof a Media Access Control (MAC) address.
Manually
There are two methods for spoofing a MAC address: installing and configuring either iproute2 or macchanger . Both of them are outlined below.
iproute2
First, you can check your current MAC address with the command:
where interface is the name of your network interface.
The section that interests us at the moment is the one that has «link/ether» followed by a 6-byte number. It will probably look something like this:
The first step to spoofing the MAC address is to bring the network interface down. It can be accomplished with the command:
Next, we actually spoof our MAC. Any hexadecimal value will do, but some networks may be configured to refuse to assign IP addresses to a client whose MAC does not match up with any of known vendors. Therefore, unless you control the network(s) you are connecting to, use MAC prefix of any real vendor (basically, the first three bytes), and use random values for next three bytes. For more information please read Wikipedia:Organizationally unique identifier.
To change the MAC, we need to run the command:
Where any 6-byte value will suffice for XX:XX:XX:XX:XX:XX .
The final step is to bring the network interface back up. This can be accomplished by running the command:
If you want to verify that your MAC has been spoofed, simply run ip link show interface again and check the value for ‘link/ether’. If it worked, ‘link/ether’ should be whatever address you decided to change it to.
macchanger
Another method uses macchanger (a.k.a., the GNU MAC Changer). It provides a variety of features such as changing the address to match a certain vendor or completely randomizing it.
The spoofing is done on per-interface basis, specify network interface name as interface in each of the following commands.
The MAC address can be spoofed with a fully random address:
To randomize only device-specific bytes of current MAC address (that is, so that if the MAC address was checked it would still register as being from the same vendor), you would run the command:
To change the MAC address to a specific value, you would run:
Where XX:XX:XX:XX:XX:XX is the MAC you wish to change to.
Finally, to return the MAC address to its original, permanent hardware value:
Automatically
systemd-networkd
systemd-networkd supports MAC address spoofing via link files (see systemd.link(5) for details).
To set a static spoofed MAC address:
To randomize the MAC address on every boot, set MACAddressPolicy=random instead of MACAddress=spoofed MAC .
systemd-udevd
Udev allows you to perform MAC address spoofing by creating udev rules. Use address attribute to match the correct device by its original MAC address and change it using the ip command:
where XX:XX:XX:XX:XX:XX is the original MAC address and YY:YY:YY:YY:YY:YY is the new one, use lower case for MAC address.
systemd unit
Creating unit
Below you find two examples of systemd units to change a MAC address at boot, one sets a static MAC using ip and one uses macchanger to assign a random MAC address. The systemd network-pre.target is used to ensure the MAC is changed before a network manager like Netctl or NetworkManager, systemd-networkd or dhcpcd service starts.
iproute2
systemd unit setting a predefined MAC address:
macchanger
systemd unit setting a random address while preserving the original NIC vendor bytes. Ensure that macchanger is installed:
A full random address can be set using the -r option, see #macchanger.
Enabling service
Append the desired network interface to the service name (e.g. eth0 ) and enable the service (e.g. macspoof@eth0.service ).
Reboot, or stop and start the prerequisite and requisite services in the proper order. If you are in control of your network, verify that the spoofed MAC has been picked up by your router by examining the static, or DHCP address tables within the router.
netctl interfaces
You can use a netctl hook to run a command each time a netctl profile is re-/started for a specific network interface. Replace interface accordingly:
NetworkManager
wpa_supplicant
wpa_supplicant can use random MAC address for each ESS connection(AP) (see [1] for details).
Add this to your configuration:
To randomize the MAC address when iwd starts (see iwd.config(5) for details):
Specifying AddressRandomizationRange enables control over which part of the address is randomized. If set to nic , only the NIC specific octets (last three octets) are randomized. The permanent mac address of the network interface is used for the initial 3 octets. If set to full , all six octets of the address are randomized.
Troubleshooting
Connection to DHCPv4 network fails
If you cannot connect to a DHCPv4 network and you are using dhcpcd, which is the default for NetworkManager, you might need to modify the dhcpcd configuration to obtain a lease.
How to change mac address for your device in Kali Linux?
Kali Linux has a built-in tool which is called “macchanger”, using this tool we can easily change our mac address.
Step1: To start this tool, First, open a terminal and write macchanger -h
this should show tool information.
Step2: Writing macchanger -s eth0 on the terminal we can see the current and permanent mac address.
Step3: Here eth0 is the type of your network interface card, to see which type network interface card for your device then open another terminal and execute ifconfig .its will show your network interface card, for me it is eth0.
Step4: Now if we want to set a random mac address then execute macchanger -r eth0 we can see that there is added another mac address named New mac and this is our new mac address.
Step5: Now re-enter macchanger -s eth0 then we can see that our Current mac Address changed.
Step6: If we want to set a mac address for our own choice then we need to execute this command macchanger — mac=OwnChoiceMacAddress eth0
Step7: Now if we re-enter macchanger -s eth0 then we can see that our own choice mac address set for our Current mac address.
Step8: Finally if we want to clear the new mac address and make it our default mac address then execute this command macchanger -p eth0
Step9: Now enter macchanger -s eth0 we can now see our default mac address is set as our current mac address.
How To Change MAC address In Linux
You may not want to expose the real MAC address when you are connected with a public WiFi hotspot. In such situations, you can simply change it or fake it with another MAC address. Some times, the network administrator might have blocked a particular MAC address in the router or firewall. In such cases, you can use this method to change the MAC id. Changing MAC address is also called spoofing MAC address or faking MAC address. In this brief tutorial, we will see how to change MAC address in Linux.
I tested this guide on CentOS 7 and Ubuntu 18.04 LTS server editions. It worked well as described below. Let us get started.
Find MAC address in Linux
First, let us find out the MAC address or Hardware address of a Network interface card in Linux.
Sample output:
Sample output:
You can use any one of the above commands to find out the MAC id of a network interface card. These commands should work on almost all Linux distributions.
Now let us see how to change the MAC address.
Change MAC address in Linux
We can do this in two methods. Please be mindful that you should not do this on a live network card which is currently in use. If you do it, probably, your network connection will be terminated. Try this method with an additional card.
Method 1: Using Macchanger
Macchanger is simple utility to view, modify, and manipulate MAC addresses for your Network interface cards. It is available in almost all GNU/Linux operating systems.
On Arch Linux:
To install Macchanger in Arch Linux and its derivatives, run:
On Fedora, CentOS, RHEL:
On Debian / Ubuntu:
To macchanger in Debian, Ubuntu and its derivatives, run:
Specify whether macchanger should be set up to run automatically every time a network device is brought up or down. This gives a new MAC address whenever you attach an ethernet cable or reenable wifi.
I recommend you not to run it automatically, unless you really need to change the MAC id every time. So, choose No and hit ENTER key to continue.
Macchanger has been installed.
Macchanger usage
To assign any random MAC address, run:
To find out the network interface name, run:
Sample output:
As you see in the above screenshot, enp0s3 is my network interface card’s name.
To change the MAC address of enp0s3 network card, run:
After changing the MAC id, verify it using command:
Sample output:
You will now see that MAC has been spoofed.
To change the MAC address to a specific value, specify any custom MAC address using command:
Where XX:XX:XX:XX:XX:XX is the new MAC id that you wish to change to.
Finally, to return the MAC address to its original, permanent hardware value, run the following command:
However, you don’t have to do this. Once you reboot the system, the changes will be automatically lost, and the actual MAC address will be restored again.
For more details, check the man pages:
Method 2: Using iproute2
First, turn off the Network card using command:
Next, set the new MAC is using command:
Finally, turn it on back with command:
Now, verify new MAC id using command:
Sample output:
Alternatively, you can do this using ‘ifconfig’ command as described below.
Suggested read:
As you can see, both methods are pretty easy. Choose any one that works for you. To revert back to the original MAC address, simply reboot your system.
Hope this helps. If you know any other method to change the MAC address, share them in the comment below.
Senthilkumar Palani (aka SK) is the Founder and Editor in chief of OSTechNix. He is a Linux/Unix enthusiast and FOSS supporter. He lives in Tamilnadu, India.
How to Change Your MAC Address on Linux
Unlike other complex network-related tasks, changing your device’s MAC address is rather easy on Linux.
Modifying your system's MAC address allows you to impersonate other devices on the same network. This way, you can receive data packets that were originally meant for the other device. This process is known as MAC spoofing.
On Linux, you can find countless tools to change your device's MAC address. But finding a reliable and stable utility that does the job well is really complicated considering the number of choices available to a user.
By the end, you will have a brief understanding of MAC addresses, and how to spoof your MAC address on Linux.
What Is a MAC Address?
A MAC address, or Media Access Control address, is a unique hexadecimal identifier used to identify a device on a network. It is also known as the "physical address" of a machine since it is embedded in the Network Interface Card (NIC) of the device.
Here's how a MAC address looks like:
Each device is assigned a unique MAC address during its manufacture. It is because of MAC addresses that you are able to uniquely identify millions of devices connected to the internet.
In the OSI model of networking, MAC addresses are responsible for sending data to the correct device in the Data Link layer.
Change Your MAC Address on Linux
There are loads of reasons why you might want to change your device's MAC address. Maybe you want to bypass security restrictions on a network, or maybe you wish to imitate another device on the network to capture packets.
Whatever the reason be, Linux tools have got you covered. Here's how you can spoof your MAC address on Linux.
Using macchanger
Macchanger is a terminal-based Linux utility that allows a user to change the default MAC address of their device.
To install it on Debian/Ubuntu:
On Fedora, CentOS, or other RHEL-based distros:
To install macchanger on Arch Linux:
You will see a prompt asking whether you want to change your system's MAC address every time you restart a network device (including ethernet and Wi-Fi). Select No and press Enter to continue.
Before getting practical, first, you need to check the network interface names on your device. To do that, type:
In the output, the network interface name for ethernet is eth0. Similarly, for Wi-Fi, the interface name will be either wlan0 or wlp3s0.
You can easily identify the network interface names in case the labels are different for your system. Interface names starting with "w" will be associated with Wi-Fi whereas the interface names for ethernet will always begin with "e".
To check the current physical address of your machine, type:
. where interface is the name of the network interface you want to get information about.
To assign a random MAC address to your machine using macchanger, use the -r flag:
For example, to change the physical address for the eth0 interface:
Macchanger will display the original address and the current (modified) address in the output.
In addition to assigning a random address, you can also set a custom MAC address for your device. Simply use the -m flag with the default command as follows:
. where custom-address is the new MAC address you want to assign and interface is the name of the network interface.
To assign a custom MAC address to the eth0 interface:
With macchanger, you don't have to memorize the original MAC address of your device for future reference. You can effortlessly reset the changes back to default using the -p flag:
Using ip and ifconfig Commands
Although macchanger is easy to use and well-suited for beginners, advanced Linux users who want more control over the operation might prefer using the ip command.
But first, make sure you note down the original MAC address of the interface before modifying it. Once you've changed the MAC address using the below-mentioned commands, there's no option to revert to the original address automatically. You'll have to manually change the modified address to the original MAC.
Before you can change the MAC address of your device using ip, you'll have to shut down the network interface.
Then change the original MAC to a custom address as follows:
Restart the network interface using ip:
Check if the aforementioned command worked by typing ip addr into the terminal.
An alternate way of MAC spoofing is using the ifconfig command. Ifconfig stands for Interface Config and is a standard Linux utility used to manage network interfaces.
Like the ip command, you'll have to shut the interface down before changing the physical address of your machine using ifconfig.
Then assign a custom MAC address to the interface.
Restart the network interface using ifconfig as follows:
To change the MAC address of a wireless interface (wlan0, for example), simply replace the occurrence of eth0 in the command with the wireless interface name.
Is MAC Spoofing Legal?
Like other techniques in the field of cybersecurity, there's a very thin line between what's legal and illegal when it comes to MAC spoofing. It heavily depends on the use case for which you're changing your MAC address.