Hi..Linux Guru.
I know that we can easily find out other computer's MAC address using arp command. But if anybody has changed his/her system's MAC address in windows/linux, then this command shows that duplicate MAC address. So is it possible to find out the original MAC address even the users on a LAN changes their system's MAC address?
This is because we running squid proxy server and given internet access for only authorized systems i.e
1) particular IP should be with particular MAC address.
2) only particular MAC with any IP address.
The clients can access the internet only in these two instance and there is no internet access if they change either IP or MAC in the first instance. But if they changes both which is already bound to some other machine then they can access the internet. In the 2nd one even restricted systems can access the internet with any IP if they change their system's MAC address with authorized MAC address of squid.conf file.
So it would be appreciated if anybody could show the possible way to find out the original MAC address(as written in BIOS) of the LAN computers.

You might be able to see it with kudzu or in /etc/sysconfig/hwconf. It would be listed as network.hwaddr.

1 members found this post helpful.

Thanks kbscores,
Sorry, I forgot to mention the O/S, I am using Ubuntu-11.10, But I couldn't find hwconf file anywhere.
#ls -l /etc/sysconfig/hwconf
ls: cannot access /etc/sysconfig/hwconf: No such file or directory

#find . / -name hwconf

#dpkg --get-selections kudzu
No packages found matching kudzu.

So how can I install this package on ubutnu. I searched the package using Ubuntu software centre and found a package called hwdata(for hardware identification/configuration data) which was already installed. If I have to go through this, then which file I have to refer.

Why use IP and Mac address as authentication method while both can easily be changed ?

2 members found this post helpful.

You can't from another host (i.e. for the purposes of access control). You'll see the MAC address that the system is presenting to its peers.

(And MAC address is not written in BIOS; it's in the firmware of each network device itself.)

-------

edit: If you want to monitor whether someone has changed a MAC address after the fact (read: you'll need to have captured the original MAC address first), you can use a utility like arpwatch.

1 members found this post helpful.

I agree that this method stinks since it all can be edited. Unless you go to that computer and use root access to diag it, you can't be sure.


Use certificate based authentication or some shared key.

1 members found this post helpful.

Thanks anomie and thank you all
I got confused with network information in BIOS, thanks for your kind clarification. And I'll check out with arpwatch.