Can you change a MAC Address?

[jamesbond007]

Ok, I've taken the CCNA courses and all throughout them I was told time and time again that you can't change the MAC, since it's hard-coded into the chip on your NIC and that each NIC will have a uniqe MAC and would never be re-used on another card.

Now, I have a friend who says you can do it with Linux. He says you can do it by typing this in a terminal window.

ifconfig eth1 down
ifconfig eth1 hw ether 00:00:00:00:00 up

Can anyone with Linux verify this or can anyone with experience confirm this is true?

I'd be very very shocked, but anything is possible.

Thanks in advance!

~JB007

EDIT: The 0s are changeable to anything you want it to be.

 

[ojai00]

<< Ok, I've taken the CCNA courses and all throughout them I was told time and time again that you can't change the MAC, since it's hard-coded into the chip on your NIC and that each NIC will have a uniqe MAC and would never be re-used on another card. >>



This is incorrect. Some NIC cards have the same MAC addresses. That's what I learned in my brief CCNA course. If you have 2 NIC cards with the same MAC address on the network, those two computers will not communicate. Hope this helps somewhat.

 

[jamesbond007]

ojai00, thanks for the response. What you said makes sense, but why would manufacturers do that then? I mean, let's say my friend wanted to connect to my FTP. Let's say I have the same MAC because I used a linux-based software router to change the MAC. According to what you said, he wouldn't be able to connect?

What about Unix sniffers that search for specific MACs? I know on a local university campus they have a sniffer going that has been used before to catch someone who stole a computer. His next year at school, he was caught using the computer he stole back on campus in a dorm. They detected the NIC's MAC going through the network and action was taken from there.

Couldn't this fool some cablemodem companies?

I'm assuming this Linux trick is only temporary, right?

Uggh...I've got some studying to do before I take the exam.

 

[L3Guy]

<< I was told time and time again that you can't change the MAC, >>



You generally can't change the hardware address on a NIC. On a 3server3, I had to swap mac chips to RMA them, so it sometimes can be done.

However, your friend is talking about Locally Administered Addresses. LAA is a function of the NIC driver / OS. Several Ethernet and virtually all token ring NIC's have LAA capabilities, Also, I understand that it is possible to install a shim in the stack if the capability is needed.

Take note of this if your security / accounting / intrusion detection is mac based.

Doug

 

[kylef]

Some NICs have the capability of setting the MAC address manually. This capability was added to allow private networks to establish their own MAC addressing schemes.

All NICs, however, must come by default with a globally unique MAC address.

About two years ago I remember a company in China that was manufacturing a bunch of NICs with the SAME MAC address, in complete violation of the IEEE standard.

You can see the current list of OUI numbers here.

 

[ojai00]

<< ojai00, thanks for the response. What you said makes sense, but why would manufacturers do that then? >>



Well, manufacturers only have 12 (2 characters each for 6 spaces of the MAC address. i.e. 00-00-00-00-00-00) alphanumeric characters to work with, and somewhere along the line, they're going to run out of options, considering how many cards they make...On some routers, you can set the MAC address manually, although it comes with one. You can set it to clone the MAC of your NIC or whatever. I would imagine there are some NIC cards out there that can do this. It's probably going to cost a lot though

Why go through all the trouble to changing a MAC when you can just get a new NIC for under $20? Just my 2 cents. Good lucky!

 

[Allanv]

dont know if this helps but here goes ....

i just installed a netgear FA311 fast ethernet card and according to my cable isp i have to register a new on with them so that my cable modems works so i left the old one in for now to wait till they got it sorted..

so in a bored moment i thought i know lets look at what options this new card has and i fould that when you go configure after right clicking on the connection in network connections control panel i saw i see the advanced TAb and look there what do i see a entry for mac address.... now it said "not present" and the other option was "value" mmmm i thought so i tapped in the mac address from my old card and it worked if i do ip config /all now it shows the mac address as

00-50-ba-17-XX-XX lol last ones not telling just in case "well this is the mac addy of my old card the netgear card should be using this

00-02-e3-17-XX-XX so you tell me i know its not a permanent change but it is CHANGED

forgive me if this is not the info u want as i'm a little tired

 

[jamesbond007]

Allanv, that's exactly what I needed to know. Now I can save my friend some phone calls when he changes the NICs around in his computer because he has a cablemodem and no router. (Cable has limit of 3 MAC entries allowed into their systems. You have to call them to have one removed when you change the NIC because the MAC is different.)

You guys definitely cleared this up. I appreciate every response I got as it helped me bit by bit, literally. Ok, enough of that.

Anyone know how I can make my outside IP appear as 0.0.0.0, have a MAC of 00.00.00.00.00.00, and to hide my DNS with a Linksys BEFSR41. This might be a premature question, but I'm getting that router soon because I'm going cable here in a few weeks, but I don't have the router yet. It's in the mail, though.

Thanks!

 

[Allanv]

Glad i could help, and sorry for the grammer and spelling mistakes I was in a hurry.

my cable company allows 5 mac addresses to be added all at the same time but they say use a web based form to fill out and then the mac address will be added ASAP. But as my old one was a little intermitant at times i thought lets play and it worked still using it today 4 weeks after changing it..

I did miss a bit though, you know i said i still had my old card in well what i did was disable it so the thing didnt show up in the ipconfig/all screen .... just to see if it worked and as soon as it did i removed the old card.... BTW my old card didnt have this option and i dont know if its just an option on the netgear cards but i would expect you will experiment...

my old card was a dlink

as for your last question posted i am sorry i have never used a router at this time and i hope you find your answer..


Regards

Allanv

 

[GigaCluster]

<< Anyone know how I can make my outside IP appear as 0.0.0.0, have a MAC of 00.00.00.00.00.00, and to hide my DNS with a Linksys BEFSR41. >>


1) you cannot make your IP 0.0.0.0, because then you wouldn't have Internet access. First, I don't think your ISP's routers will permit a packet with a source IP of 0.0.0.0. Even if they did, the remote host wouldn't be able to reply to your request packets.
2) Even though you can set your MAC to whatever you want technically (from what I'm reading in this thread), I don't think the ISP's routers would like that.
3) there's no need to hide DNS because no one on the Internet can see it anyway. Only nodes through which the DNS UDP packets travel can see it.

Hope that was helpful.

 

[EricHagen]

For someone taking a CCNA exam, you don't know a whole lot about networking. I don't mean that in an insulting way, just pointing out the fact.


any address ending in a 0 is a subnet address and not a legal IP.

any address ending in 255 (or the upper boundary of a subnet) is a broadcast address and it goes against convention to use it (although some subnets will allow it).



MAC addresses are local to the ETHERNET frame. The Ethernet frame is stripped off and replaced at ever LOGICAL HOP (logical, not physical). That means the first time you hit a router, it will strip the ETH frame and replace the DEST mac address with it's own and forward it on to the next network segment.

Therefore, MAC addresses do NOT need to be GLOBALLY unique. They merely need to be unique on YOUR SUBNET. Packets can flow on and off MAC based networks as they traverse the Internet. FDDI and Token-ring use a similar MAC address, but other protocols like SONET do not.

Therefore, in order to best fool your calbe company, you should simply buy a home gateway/router and assign it's EXTERNAL interface to one of the MAC addresses you've given to the cable company. You can then use NAT to put as many computers behind the router as you wish. If you want to, you can even leave one in front of the router using one of the OTHER MAC addresses that you supplied the cable company as an all-purpose "DMZ" server.

I have been thinking of taking some CISCO tests. How hard is it to get CCNA status? I'm eyeing the CCIE actually. Someday.....

Eric Hagen

 

[jamesbond007]

For someone taking a CCNA exam, you don't know a whole lot about networking. I don't mean that in an insulting way, just pointing out the fact.

Never judge a book by its cover. There are certain areas I need to learn more. The instructor was complete junk and it was her first year. :| Still, if you wanted me to write an ACL or setup a VLAN, lemme at it.

When I had BlackICE Defender going, I'd get attacks all the time that were reported as 0.0.0.0 and no DNS was available.

That's why I was assuming it was possible, but wasn't sure. Working the web with complete anonimitity would be quite nice...and sneaky.

Thanks for the info.

 

[Quad]

Friend of mine (hi zee) is able to freely change the mac address of his router. He can change his ip in a matter of seconds. He also modded his mac address such that his hostmask is a phrase, using numbers as letters. so this can be done

 

[IaPuP]

MAC doesn't necessarily have anything to do with IP (though it can).

Hostmask has nothing to do with MAC (that's more of an IP/DNS thing).

But.. a phrase in your MAC would be cool (I think that's what you meant).

Of course, the MAC doesn't even make it out from under my desk (where it encounters the first router) so that doesn't really do me much good unless I"m just in it to admire my own MAC

Eric