Spoofed MAC address = no internet
 

i have spoofed my mac address with direction from http://whoozoo.co.uk/mac-spoof-linux.htm but when i try to access the internet or even my Router (D Link 604) I can't do anything!!

What do I need to do??

SuSE 9.3 Pro

Only quick thought here. Do you have mac filtering active on the router?
If so you need to add the new mac address to mac filtering section.

Brian1

I don't know, I'm at work right now, I'll check that out when I get home, Thanks

Well, I went into my router settings and mac filtering was already rutned off. So, I tried to enter a mac address I was gonna spoof (01:02:03:04:05:06) into the router settings. It was set to only let this mac address thru.

I then :

ifconfig eth0 down (b/c its says device is busy if I don't)

ifconfig eth0 hw ether 01:02:03:04:05:06

ifconfig eth0 192.168.0.1 hw ether 01:02:03:04:05:06 up

Then it s says the device is busy!!

but I check the address:

ifconfig

It shows the spoofed address, but I can't access the router or the internet!! (now I have to reset my router back to the default settings to use the stupid thing)

I get fed up and totally bypass the router and plugged directly in my Cable Modem.

The same thing happens!!!

So, I suspect the ethernet card is not comming back up after I "down" it.

What is a newb to do??

Just run this command. Don't bring down the card.
ifconfig eth0 hw ether 01:02:03:04:05:06

When you bring down the card and then change the mac and start it back up, it will not lock onto the card because it will look at its hard mac address. This is the way I was told. I know when I changed the mac like this the router disconnects me because I have mac filtering enabled. I added the spoofed mac to router and then it lets me out.

Brian1

You might also not that the router may not be able to talk to you because it has your old MAC in its ARP table.

The ARP table is a listing your system has of all machines by their Layer 2 and Layer 3 addresses... that is the IPs and their coorosponding MACs. This table is built by ARP request being sent. You can see this simply by doing the following on your linux box as root:

arp -d {ip of default gw}
#Deletes the arp entry for your default gateway

arp
#shows your current arp table... not the entry for your DG

ping {ip of default gateway}
#generates the need to talk to DG
#this will trigger an ARP request to get the MAC
#to attach as the destination on the ethernet frame

arp
#see the MAC matcing your DG


Now, the more important question... Why in the world are you spoofing the MAC on a device inside your network? The MAC is only known withing the ethernet network and does not travers beyond a router. (Yes, I know with a VPN and such you can make your MAC go beyond your LAN, but that's not an issue here.)

Just wondering...

MrKnisely

There are two things need to be done to turn spoofed MAC on: set HWADDR line in /etc/sysconfig/network-scripts/ifcfg-<DEVICE> to that spoofed MAC; run /sbin/ifup. That's it.

HW

Doesn't work for me. If I enter a different mac it fails to start the interface when I ifup the nic. I leave the mac info out and just type the command like above and the router sees the new mac address without ifdown and ifup. But I never tried it outside the router and directly connect my linux box to my dsl modem. So not sure how the provider will interrept that.

Brian1