Spoof / Change mac address for NIC

Sometimes you need to make your Linux box to be identified as a different identity at the switch layer (layer 2 btw). This might make your machine look like another one to the networking device, or if you don’t want the manufacturer or the other NIC details of your NIC to be known to other devices over the network.

Spoofing or Changing of MAC address for NIC on a linux machine is pretty easy.

It includes the following three steps:

Spoof / Change MAC address for NIC

Verify the current configuration for NIC loaded as eth0 (or anyother on your machine)

[[email protected] ~]# ifconfig eth0

Output:

eth0      Link encap:Ethernet  HWaddr 00:A0:81:4B:39:8D
          inet addr:xxx.xxx.xxx.xxx  Bcast:xxx.xxx.xxx.xxx  Mask:255.255.248.0
          inet6 addr: fc70::2w0:51df:ge45:296g/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1711272688 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1686766955 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:241108923046 (224.5 GiB)  TX bytes:507398519867 (472.5 GiB)
          Interrupt:24

Shut down the interface for which the MAC address is to be spoofed:

[[email protected] ~]# ifconfig eth0 down

Modify the MAC address for the interface (NIC) using the following command:

[[email protected] ~]# ifconfig eth0 hw ether 00:11:22:33:44:55

Start off the network interface

[[email protected] ~]# ifconfig eth0 up

The interface eth0 should now be up with the spoofed / changed / modified MAC address.

You can verify it using the ifconfig command:

[[email protected] ~]# ifconfig eth0

Output:

eth0      Link encap:Ethernet  HWaddr 00:11:22:33:44:55
          inet addr:xxx.xxx.xxx.xxx  Bcast:xxx.xxx.xxx.xxx  Mask:255.255.248.0
          inet6 addr: fc70::2w0:51df:ge45:296g/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1711272873 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1686765748 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:241108923046 (224.5 GiB)  TX bytes:507398519867 (472.5 GiB)
          Interrupt:24

You can also verify the MAC addresses on your machine using the arp command. The following is the actual command you can use:

[[email protected] ~]# arp -a

You can make these changes permanent by adding the above three commands (used to modify the MAC address) in /etc/rc.local file.

No Comments

Post a Comment

Time limit is exhausted. Please reload CAPTCHA.