Introduction
A Media Access Control (MAC) address is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment. While this address is typically permanent and hard-coded into the hardware, it can be changed or "spoofed" in software.
Changing your MAC address can be useful for various reasons, such as enhancing privacy by preventing tracking, bypassing MAC address-based access control on networks, or for network testing and troubleshooting.
In this lab, you will use two common Linux command-line tools: ifconfig to manage network interfaces and macchanger to view and modify their MAC addresses. You will learn how to find your network interface, view its current MAC address, take the interface down, assign a new random MAC address, bring the interface back up, and finally, verify that the change was successful.
View the Current MAC Address of Your Interface
In this step, you will identify your network interface and view its current, original MAC address. We will use the ifconfig command, which is used to configure and display information about network interfaces.
First, open the terminal. We need to find the name of the network interface we want to modify. In this lab environment, the primary network interface is typically named eth0.
Run the ifconfig command followed by the interface name to see its details.
ifconfig eth0
You will see an output with several details about the eth0 interface. Look for the line containing ether. The value next to it is the current MAC address of your interface.
Example output:
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.17.0.2 netmask 255.255.0.0 broadcast 172.17.255.255
ether 02:42:ac:11:00:02 txqueuelen 0 (Ethernet)
RX packets 24 bytes 2480 (2.4 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 8 bytes 648 (648.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Take note of the ether address. This is the permanent, hardware-assigned MAC address that we are going to change in the following steps.
Take the Wireless Interface Down with ifconfig
In this step, you will learn how to deactivate a network interface. Before you can change the MAC address, the network interface must be taken offline or "down". You cannot modify the hardware address of an interface while it is active and communicating on the network.
We will use the ifconfig command again, but this time with the down argument. This action requires administrative privileges, so you must use sudo.
Execute the following command in your terminal:
sudo ifconfig eth0 down
This command will not produce any output if it is successful. It simply deactivates the eth0 interface, making it ready for the MAC address change in the next step.
Assign a Random MAC Address with macchanger -r
In this step, with the interface down, you can now use the macchanger tool to assign a new MAC address. macchanger has several options, but for this lab, we will use the -r (or --random) option to assign a completely random, vendor-independent MAC address.
This action also requires administrative privileges, so you must use sudo.
Run the following command to change the MAC address of eth0:
sudo macchanger -r eth0
The command will output the results of the operation, showing the original, permanent hardware MAC and the new, spoofed MAC address.
Example output:
Current MAC: 02:42:ac:11:00:02 (unknown)
Permanent MAC: 02:42:ac:11:00:02 (unknown)
New MAC: 3e:81:e3:82:b6:f1 (unknown)
As you can see, macchanger has assigned a new MAC address to the eth0 interface. However, the interface is still down.
Bring the Wireless Interface Back Up with ifconfig
In this step, you will reactivate the network interface. After successfully changing the MAC address, you need to bring the interface back "up" so that it can connect to the network and start sending and receiving data again.
We will use the ifconfig command with the up argument. This action also requires sudo privileges.
Execute the following command in your terminal:
sudo ifconfig eth0 up
Similar to taking the interface down, this command will not produce any output upon success. It reactivates the eth0 interface, which will now use the new MAC address you assigned in the previous step.
Verify the New Spoofed MAC Address
In this final step, you will verify that the MAC address has been successfully changed and the interface is operating with the new address. This is an important confirmation step to ensure the entire process worked as expected.
To do this, we will simply run the ifconfig eth0 command again, just like in the first step.
ifconfig eth0
Now, examine the output and look at the ether value. It should match the "New MAC" address from the output of the macchanger command in Step 3.
Example output:
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.17.0.2 netmask 255.255.0.0 broadcast 172.17.255.255
ether 3e:81:e3:82:b6:f1 txqueuelen 0 (Ethernet)
RX packets 24 bytes 2480 (2.4 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 8 bytes 648 (648.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
By comparing this new ether address with the one you noted in Step 1, you can confirm that your MAC address has been successfully spoofed.
Summary
Congratulations! You have successfully completed this lab on changing a MAC address using macchanger.
In this lab, you learned a fundamental networking and security skill on Linux. You practiced using the ifconfig command to manage a network interface and the macchanger tool to modify its hardware address.
The key steps you performed were:
- Viewing the initial state of a network interface with
ifconfig eth0. - Deactivating the interface with
sudo ifconfig eth0 down. - Assigning a new, random MAC address with
sudo macchanger -r eth0. - Reactivating the interface with
sudo ifconfig eth0 up. - Verifying the final state to confirm the change.
The macchanger tool has other useful options, such as setting a specific MAC address (-m XX:XX:XX:XX:XX:XX) or resetting the interface to its original, permanent MAC address (-p). Feel free to explore these commands on your own.