View and Change Linux MAC Addresses

D

DevynCJohnson

Guest
A MAC address (media access control address) is very important in the field of computer networking. A MAC address is a unique twelve-hex-digit (48 bits) fingerprint/identifier for network interface cards (NICs). MAC addresses are used by most IEEE-802-compliant networks as an address for each NIC. When using any type of operating system on a network, it helps to understand the concepts and ideas of MAC addresses. When using Linux, there are some special commands that users may benefit from learning such as viewing their MAC address or changing it.

NOTE: A MAC address may also be called a hardware address, Ethernet hardware address (EHA), burned-in address (BIA), or physical address.

Basics
MAC addresses are supposed to be unique among every NIC. However, some people may find two NICs with the same MAC address. If so, those two NICs will have conflicts and problems on the network. Duplicate/conflicting MAC addresses may be caused by manufacturer mistakes/errors or spoofing.

MAC addresses are assigned by the manufacturer and stored on the NIC's hardware. In other words, the NIC is hard-coded. However, virtualization can be used to create virtual networks among virtual systems. Since virtualization does not use real hardware (besides the host's hardware), it is possible to create two virtual machines with a specific MAC address or randomized.

People can identify the manufacturer of a NIC by its MAC address since the IEEE assigns a MAC address range to each manufacturer. People can check a MAC address by using one of these "MAC address lookup" sites -

FUN FACT: IPv6 NICs use EUI-64 (Extended Unique Identifier) instead of the 48-bit (12-hex digits) MAC address. EUI-64 is an improved type of MAC address for IPv6. The IEEE trademarked EUI-64.

View MAC Address

Debian-based Linux users can obtain their MAC address by typing "ifconfig" in a command-line. The command will list all NICs on the system and list various information for each one. To find the MAC address, look for the value labeled "HWaddr". The MAC address will be in hexadecimal form (00:00:00:00:00:00). Alternately, type "ifconfig | grep HWaddr". If the "ifconfig" command fails, then try executing the command with Root privileges.

RedHat-based Linux users can view their MAC address by executing “ip addr” and looking for the line labeled “link/ether”.

ifconfig_Linux.jpg


Change MAC Address
As mentioned previously, MAC addresses can be spoofed (imitated/forged). To temporarily change the MAC address on a Debian-based Linux system, log into the system as Root or open a terminal and type "su". Next, type "ifconfig NIC down" to turn off the specified NIC (replace "NIC" with something like "eth0", "wlan0", etc.). Once off, set the desired MAC address by executing "ifconfig NIC hw ether 00:00:00:00:00:00" (replace "NIC" and use the desired MAC address instead of zeros). Finally, run "ifconfig NIC up" to activate the NIC (turn it back on).

TIP: Here is a single-line command that can change the MAC address like the above paragraph - "sudo ifconfig NIC down hw ether 00:00:00:00:00:00 && ifconfig NIC up".

On RedHat-based systems (like Fedora, RHEL, and CentOS), the process is the same. However, the "ip" command is used instead of "ifconfig". Therefore, to turn off the NIC, change the MAC address, and re-activate the NIC, the commands would be "ip link set down dev NIC", "ip link set dev NIC address 00:00:00:00:00:00", and "ip link set up dev NIC", respectively.

To undo/reverse the MAC address change, reboot the system.

To make the change permanent on Debian-based systems, add "pre-up ifconfig NIC hw ether 00:00:00:00:00:00" to /etc/network/interfaces and then reboot. To undo this permanent change, remove that line from the file, or comment it out using "#". The permanent and temporary change does not over-write the MAC address that is hard-coded onto the NIC. This means that placing the NIC into a different system, reinstalling the OS, or booting into a different OS will reveal the original MAC address.

On RedHat-based systems, the change can be made permanent by setting "MACADDR" in /etc/sysconfig/network-scripts/ifcfg-NIC equal to the desired MAC address (MACADDR=00:00:00:00:00:00).

On Gentoo systems, add 'mac_NIC="00:00:00:00:00:00"' to /etc/conf.d/net .

NOTE: Remember to replace "NIC" with the proper interface (like "eth0", "wlan0", etc.) and use the desired MAC address instead of zeros.

Linux users could also use the GNU MAC Changer (macchanger) instead of "ifconfig" or "ip". Some commands are shown below. Remember to turn off the NIC before changing the MAC address, and turn it back on afterwards. Macchanger can usually be found in the default repositories, if not, then check http://www.gnu.org/software/macchanger/ .
Code:
macchanger -r NIC #Use random MAC address
macchanger --mac=00:00:00:00:00:00 NIC #Specify a MAC address
macchanger -p NIC #Return to normal
 

Attachments

  • slide.jpg
    slide.jpg
    57 KB · Views: 107,269


I am using RedHat Linux 6.8 Workstation. The instructions for changing the MAC address worked using the manual method (ip link set ...) but the permanent method did not.
First, in the ifcfg-NIC file there was an entry:
HWADDR="XX:XX:XX:XX:XX:XX"
I changed that to the desired MAC address but it still came up with the original MAC address on a reboot.
So then I added the line you suggested:
MACADDR="XX:XX:XX:XX:XX:XX" (with and without the quotes) and neither of these worked.
Any suggestions on how to make this work permanently or is there something wrong with what I did?
Thanks
 

Members online


Top