LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 09-12-2005, 07:21 PM   #1
BDiddy
Member
 
Registered: Aug 2005
Posts: 34

Rep: Reputation: 15
Spoofed MAC address = no internet


i have spoofed my mac address with direction from http://whoozoo.co.uk/mac-spoof-linux.htm but when i try to access the internet or even my Router (D Link 604) I can't do anything!!

What do I need to do??

SuSE 9.3 Pro


Last edited by BDiddy; 09-12-2005 at 07:23 PM.
 
Old 09-12-2005, 07:36 PM   #2
Brian1
Guru
 
Registered: Jan 2003
Location: Seymour, Indiana
Distribution: Distribution: RHEL 5 with Pieces of this and that. Kernel 2.6.23.1, KDE 3.5.8 and KDE 4.0 beta, Plu
Posts: 5,700

Rep: Reputation: 61
Only quick thought here. Do you have mac filtering active on the router?
If so you need to add the new mac address to mac filtering section.

Brian1
 
Old 09-12-2005, 07:55 PM   #3
BDiddy
Member
 
Registered: Aug 2005
Posts: 34

Original Poster
Rep: Reputation: 15
Quote:
Originally posted by Brian1
Only quick thought here. Do you have mac filtering active on the router?
If so you need to add the new mac address to mac filtering section.

Brian1
I don't know, I'm at work right now, I'll check that out when I get home, Thanks
 
Old 09-14-2005, 10:21 PM   #4
BDiddy
Member
 
Registered: Aug 2005
Posts: 34

Original Poster
Rep: Reputation: 15
Well, I went into my router settings and mac filtering was already rutned off. So, I tried to enter a mac address I was gonna spoof (01:02:03:04:05:06) into the router settings. It was set to only let this mac address thru.

I then :

ifconfig eth0 down (b/c its says device is busy if I don't)

ifconfig eth0 hw ether 01:02:03:04:05:06

ifconfig eth0 192.168.0.1 hw ether 01:02:03:04:05:06 up

Then it s says the device is busy!!

but I check the address:

ifconfig

It shows the spoofed address, but I can't access the router or the internet!! (now I have to reset my router back to the default settings to use the stupid thing)

I get fed up and totally bypass the router and plugged directly in my Cable Modem.

The same thing happens!!!

So, I suspect the ethernet card is not comming back up after I "down" it.

What is a newb to do??
 
Old 09-21-2005, 06:58 PM   #5
Brian1
Guru
 
Registered: Jan 2003
Location: Seymour, Indiana
Distribution: Distribution: RHEL 5 with Pieces of this and that. Kernel 2.6.23.1, KDE 3.5.8 and KDE 4.0 beta, Plu
Posts: 5,700

Rep: Reputation: 61
Just run this command. Don't bring down the card.
ifconfig eth0 hw ether 01:02:03:04:05:06

When you bring down the card and then change the mac and start it back up, it will not lock onto the card because it will look at its hard mac address. This is the way I was told. I know when I changed the mac like this the router disconnects me because I have mac filtering enabled. I added the spoofed mac to router and then it lets me out.

Brian1
 
Old 09-21-2005, 09:47 PM   #6
charon79m
Member
 
Registered: Oct 2003
Distribution: Just about anything... so long as it is Debain based.
Posts: 297

Rep: Reputation: 30
You might also not that the router may not be able to talk to you because it has your old MAC in its ARP table.

The ARP table is a listing your system has of all machines by their Layer 2 and Layer 3 addresses... that is the IPs and their coorosponding MACs. This table is built by ARP request being sent. You can see this simply by doing the following on your linux box as root:

arp -d {ip of default gw}
#Deletes the arp entry for your default gateway

arp
#shows your current arp table... not the entry for your DG

ping {ip of default gateway}
#generates the need to talk to DG
#this will trigger an ARP request to get the MAC
#to attach as the destination on the ethernet frame

arp
#see the MAC matcing your DG


Now, the more important question... Why in the world are you spoofing the MAC on a device inside your network? The MAC is only known withing the ethernet network and does not travers beyond a router. (Yes, I know with a VPN and such you can make your MAC go beyond your LAN, but that's not an issue here.)

Just wondering...

MrKnisely
 
Old 09-23-2005, 03:12 PM   #7
flexuser
LQ Newbie
 
Registered: Sep 2005
Posts: 1

Rep: Reputation: 0
There are two things need to be done to turn spoofed MAC on: set HWADDR line in /etc/sysconfig/network-scripts/ifcfg-<DEVICE> to that spoofed MAC; run /sbin/ifup. That's it.

HW
 
Old 09-23-2005, 08:03 PM   #8
Brian1
Guru
 
Registered: Jan 2003
Location: Seymour, Indiana
Distribution: Distribution: RHEL 5 with Pieces of this and that. Kernel 2.6.23.1, KDE 3.5.8 and KDE 4.0 beta, Plu
Posts: 5,700

Rep: Reputation: 61
Doesn't work for me. If I enter a different mac it fails to start the interface when I ifup the nic. I leave the mac info out and just type the command like above and the router sees the new mac address without ifdown and ifup. But I never tried it outside the router and directly connect my linux box to my dsl modem. So not sure how the provider will interrept that.

Brian1
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to find an IP address from the MAC address of a remote machine ? jitz Linux - General 3 01-03-2006 07:55 AM
How to find IP address of a machine if I know their MAC Address dysenteryduke Linux - Networking 13 09-12-2005 10:21 AM
Tracing Spoofed IP Address socceroos Linux - Security 9 08-08-2005 01:45 PM
how to get ip address, broadcast address, mac address of a machine sumeshstar Programming 2 03-12-2005 04:33 AM
DHCP Server MAC Address found, IP address not assigned wmburke Linux - Wireless Networking 17 11-17-2004 10:33 AM


All times are GMT -5. The time now is 01:08 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration