Modifying your system's MAC address allows you to impersonate other devices on the same network. This way, you can receive data packets that were originally meant for the other device. This process is known as MAC spoofing.
On Linux, you can find countless tools to change your device's MAC address. But finding a reliable and stable utility that does the job well is really complicated considering the number of choices available to a user.
By the end, you will have a brief understanding of MAC addresses, and how to spoof your MAC address on Linux.
What Is a MAC Address?
A MAC address, or Media Access Control address, is a unique hexadecimal identifier used to identify a device on a network. It is also known as the "physical address" of a machine since it is embedded in the Network Interface Card (NIC) of the device.
Here's how a MAC address looks like:
55:de:bc:7d:45:df
Each device is assigned a unique MAC address during its manufacture. It is because of MAC addresses that you are able to uniquely identify millions of devices connected to the internet.
In the OSI model of networking, MAC addresses are responsible for sending data to the correct device in the Data Link layer.
Change Your MAC Address on Linux
There are loads of reasons why you might want to change your device's MAC address. Maybe you want to bypass security restrictions on a network, or maybe you wish to imitate another device on the network to capture packets.
Whatever the reason be, Linux tools have got you covered. Here's how you can spoof your MAC address on Linux.
Using macchanger
Macchanger is a terminal-based Linux utility that allows a user to change the default MAC address of their device.
To install it on Debian/Ubuntu:
sudo apt install macchanger
On Fedora, CentOS, or other RHEL-based distros:
sudo dnf install macchanger
sudo yum install macchanger
To install macchanger on Arch Linux:
sudo pacman -S macchanger
You will see a prompt asking whether you want to change your system's MAC address every time you restart a network device (including ethernet and Wi-Fi). Select No and press Enter to continue.
Before getting practical, first, you need to check the network interface names on your device. To do that, type:
ip addr
Output:
In the output, the network interface name for ethernet is eth0. Similarly, for Wi-Fi, the interface name will be either wlan0 or wlp3s0.
You can easily identify the network interface names in case the labels are different for your system. Interface names starting with "w" will be associated with Wi-Fi whereas the interface names for ethernet will always begin with "e".
To check the current physical address of your machine, type:
macchanger -s interface
...where interface is the name of the network interface you want to get information about.
Output:
To assign a random MAC address to your machine using macchanger, use the -r flag:
macchanger -r interface
For example, to change the physical address for the eth0 interface:
sudo macchanger -r eth0
Macchanger will display the original address and the current (modified) address in the output.
In addition to assigning a random address, you can also set a custom MAC address for your device. Simply use the -m flag with the default command as follows:
sudo macchanger -m custom-address interface
...where custom-address is the new MAC address you want to assign and interface is the name of the network interface.
To assign a custom MAC address to the eth0 interface:
sudo macchanger -m 44:ee:bc:6c:76:ba eth0
With macchanger, you don't have to memorize the original MAC address of your device for future reference. You can effortlessly reset the changes back to default using the -p flag:
sudo macchanger -p eth0
Using ip and ifconfig Commands
Although macchanger is easy to use and well-suited for beginners, advanced Linux users who want more control over the operation might prefer using the ip command.
But first, make sure you note down the original MAC address of the interface before modifying it. Once you've changed the MAC address using the below-mentioned commands, there's no option to revert to the original address automatically. You'll have to manually change the modified address to the original MAC.
Before you can change the MAC address of your device using ip, you'll have to shut down the network interface.
sudo ip link set dev eth0 down
Then change the original MAC to a custom address as follows:
sudo ip link set dev eth0 address 44:ee:bc:6c:76:ba
Restart the network interface using ip:
sudo ip link set dev eth0 up
Check if the aforementioned command worked by typing ip addr into the terminal.
An alternate way of MAC spoofing is using the ifconfig command. Ifconfig stands for Interface Config and is a standard Linux utility used to manage network interfaces.
Like the ip command, you'll have to shut the interface down before changing the physical address of your machine using ifconfig.
sudo ifconfig eth0 down
Then assign a custom MAC address to the interface.
sudo ifconfig eth0 hw ether 44:ee:bc:6c:76:ba
Restart the network interface using ifconfig as follows:
sudo ifconfig eth0 up
To change the MAC address of a wireless interface (wlan0, for example), simply replace the occurrence of eth0 in the command with the wireless interface name.
sudo ifconfig wlan0 hw ether 44:ee:bc:6c:76:ba
Is MAC Spoofing Legal?
Like other techniques in the field of cybersecurity, there's a very thin line between what's legal and illegal when it comes to MAC spoofing. It heavily depends on the use case for which you're changing your MAC address.
For educational purposes and learning? Definitely legal (but only if you try it on your own network). For capturing data packets and bypassing security protocols on some other network? Not recommended.
Like Linux, Windows and Mac users can also view and modify their device's MAC address. The primary difference lies in the interface used to perform the task. Linux users generally prefer the command-line approach. On the contrary, most Windows and Mac users would feel at home with an easy-to-use graphical interface.