如何改变或欺骗机器位址在Windows XP、景色、服务器2003/2008， Mac OS x， Unix和Linux

机器位址(媒体存取控制地址)是一个类似独特的标识符包括附有多数网络适配器卡片或网络接口卡的六个字节数字(NIC)。 同样地，所有网卡，它是否是以太网NIC、吉比特以太网NIC或者无线802.11a/b/g/n WiFi或HiperLAN适配器，应该有不同的MAC地址，亦称以太网硬件地址(EHA)或适配器地址。

在操作系统，机器位址在12数字十六进制数经常代表。 例如， 1A-2B-3C-4D-5E-6F。 在实用用法，分层堆积机器位址从层数3协议地址被转换例如互联网协议的2 (IP地址)被ARP (地址转换协议)，在广播网然后允许每个为具体主人将标记的主人独特识别和框架，例如以太网。 在翻译以后(或，当一个主人在LAN送它的机器位址到在网络做配置的n ot不接受未要求的ARP回复为先发制人贮藏)的另一个机器时，机器位址在来源个人计算机ARP桌被贮藏为最新使用。 ARP桌内容在每台计算机可以通过键入观看 arp - a 在窗口或 arp 在Linux。 机器位址因而形成的大多数的依据更高的开放系统互连层协议被建立导致复杂层数2网络，作用的网络。

有许多原因或可能性用户也许想要更换机器位址或网络适配器，亦称MAC欺骗。 例如，绕过过滤在防火墙或路由器的机器位址。 把戏可以通过看齐新的无限制的机器位址用于得到通行证网络存取制约，或者能够存取连接在嗅合法的机器位址以后欺骗授权机器位址在空气外面在过滤WiFi网络的MAC。

在旁边，黑客或热心者也欺骗另一个主人的机器位址作为他们自己为了收到为他们没意味的交通小包，虽然通常使用毒害技术的ARP。 然而，改变的机器位址可能仍然保留真正的信息从被查出和由各种各样的服务采伐例如IDS、防火墙、DHCP服务器、无线访问接入点和等，并且是根本的保护用户的保密性。 MAC spoofing also potentially trigger a Denial of Service (DoS) attack by causing routing problem with duplicating MAC address exists in the network, especially those similar with gateway and AP router’s BSSID (Basic Service Set Identifier.)

Whatever the reason, it’s pretty easy to change the MAC address or perform MAC spoofing on most of today’s hardware, listed below. Actually, the original MAC address is burnt and imprinted to the network card, and cannot be changed. However, operating system can spoof as if there is different MAC address for the network interface card using tricks below.

Change the MAC address in Windows

1. Go to Start -> Control Panel. Double click on Network Connections (inside Network and Internet Connections category in Windows XP). The, right click on the active network connection with network adapter that you want to change the MAC address (normally Local Area Network or Wireless Network Connection) and click on Properties.

   Above steps work in Windows XP, Windows 2000 and Windows Server 2003. For Windows Vista, access to NIC’s properties is from Control Panel -> Network and Internet -> Network and Sharing Center -> Manage Network Connections.

   Alternatively, if you already know which network adapter that’s responsible for your network or Internet connection, go to Device Manager and open the properties dialog by double click on the NIC itself.

2. In the General tab, click on the Configure button.
3. Click on Advanced tab.
4. In the Property section, select and highlight Network Address or Locally Administered Address.
5. To the right, “Not Present” radio button is by default selected as value. Change the value by clicking on radio button for Value:, and then type in a new MAC address to assign to the NIC.

   

   The MAC address consists of 6 pairs of numbers (0 - 9) and characters (A - F) combination. For example, 88-17-E8-90-E2-0A. When entering the new MAC value, omit the dash (-), for example 8817E890E20A.

6. Click OK when done.
7. To verify the change of MAC address, go to command prompt, then type in one of the following commands:

   ipconfig /all
   net config rdr

8. Reboot the computer if successful to make the change effective.

Note: To restore or reset back to original default MAC address, simply set back the option to “Not Present”.

Change the MAC Address of NIC in Windows via Registry

1. Open a command prompt.
2. Type the following command and hit Enter.

   ipconfig /all

3. Record down the Description and the Physical Address (is MAC address) of the active network connection (discard those with Media Disconnected state).

   

   For example, in figure above, Description is Intel(R) Wireless WiFi Link 4965AGN and MAC address is in the format of 00-XX-XX-XX-XX-XX.

4. In the command prompt also, type the following command and hit Enter.

   net config rdr

5. Record down the GUID for the MAC address for the active connection’s NIC which MAC address to be changed. The GUID is contained within the { and } brackets right in front of the MAC address as shown in figure below.

   

6. Type regedt32 or regedit in Start -> Run box or in Start Search for Windows Vista. Note: for Windows NT 4.0 and Windows 2000, regedt32 must be used.
7. Navigate to the following registry key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}

8. Expand the {4D36E972-E325-11CE-BFC1-08002BE10318} tree, and there will be more sub-keys in the form of 0000, 0001, 0002 and so on.
9. Go through each sub-key starting from 0000, look for subkey that has DriverDesc value data that matches NIC description copied from step above, that want its MAC address to be changed. In most cases, it will be similar to the network adapter card name.

   To verify that the subkey found is indeed a correct one, check the value of the NetCfgInstanceId, which should have the same value with the NIC’s GUID taken from step above.

10. Once a sub-key is matched to the network interface card that MAC address want to be spoofed, select and highlight the subkey. Right click on the sub-key (for example, 0000), then select New -> String Value. Name the new value name as NetworkAddress.

    Note: If NetworkAddress REG_SZ registry key is already existed in the right pane, skip this step.

11. The double click on NetworkAddress and enter a new MAC address as its value data.

    

    Note that the 12-digit MAC address in hexadecimal format, and should be entered without any dash (-). For example, 1A2B3C4D5E6F.

12. Reboot the system to make the new MAC address effective. Alternatively, if you don’t want to restart the system, try to disable and then re-enable the network adapter in Device Manager.
13. To verify the change of MAC address, go to command prompt, then type in one of the following commands:

    ipconfig /all
    net config rdr

Note: To restore or reset back to true original hardware burned-in MAC address, remove the NetworkAddress registry key that is been added.

Alternative: Third party tools and utilities to change the MAC address in Windows operating system are plenty, for example: SMAC (direct download link to smac20_setup.ex, supports Windows Vista, XP, 2003, 2000), Macshift (direct download link to macshift.zip, for Windows XP), BMAC (almost identical SMAC MAC changer clone by moorer-software.com), Mac MakeUp (direct download link to macmakeup.zip, for Windows 2000/XP/2003/Vista), MadMACs (MAC Address Spoofing And Host Name Randomizing App For Windows, directly download MadMACs.zip), EtherChange (direct download link to etherchange.exe), and Technitium MAC Address Changer (for Windows 2000 / XP / Server 2003 / Vista / Server 2008).

How to Change MAC Address (MAC Spoofing) in Linux and *nix

To change your MAC address in Linux and most Unix-like (*nix) system, run the following script commands:

ifconfig <interface> down

ifconfig <interface> hw <class> <MAC address>

ifconfig <interface> up

For example, the command looks lik “ifconfig eth0 down hw ether 1A:2B:3C:4D:5E:6F”. First command brings down the network interface, second command change its MAC address while third command bring up the interface again. Note that in some cases, to bring down and bring up the network interface, the following commands have to be used:

/etc/init.d/networking stop or /etc/init.d/network stop (in the case of Fedora Core 5)

/etc/init.d/networking start or /etc/init.d/network stop (in the case of Fedora Core 5)

Alternatively, for Fedora Code 5 Linux with Iproute2 tools installed, the following commands also can change the MAC address to spoofed version:

/etc/init.d/network stop

ip link set <interface> address 1A:2B:3C:4D:5E:6F

/etc/init.d/network start

For example, “ip link set eth0 address 1A:2B:3C:4D:5E:6F”. To check whether the MAC address has been spoofed, use ip link ls eth0 or ip addr ls eth0 instead of using ifconfig eth0.

How to Make the Spoofed MAC Address Permanently Even After Reboot in Linux

Edit the ifcfg-eth0 file (or other similar file if you’re changing different interface), add the following variable line to the file:

MACADDR=12:34:56:78:90:ab

Then run service network restart to make the change effective immediately.

How to Make the Spoofed MAC Address Permanently on Restart in Debian

Edit the /etc/network/interfaces file and add in the following variable line to the appropriate section so that the MAC address is set when the network device is started.

hwaddress <interface> 02:01:02:03:04:08

For example, “hwaddress ether 02:01:02:03:04:08″.

Alternative: GNU Mac Changer (for Debian, Slackware, ArchLinux, Mandrake, Crux and other RPM-based distributions such as Fedora, Red Hat, CentOS, ASPLinux, SUSE Linux, OpenSUSE and etc.

How to Change MAC Address (MAC Spoofing) in BSD or FreeBSD

Issue the following commands in shell:

ifconfig <interface> down

ifconfig <interface> <class> <MAC address>

ifconfig <interface> up

First command brings down the network interface (optional), second command change its MAC address while third command bring up the interface again (optional). For example, the command looks lik “ifconfig xl0 link 1A:2B:3C:4D:5E:6F” or “ifconfig fxp0 ether 1A:2B:3C:4D:5E:6F”

How to Change MAC address in Solaris

The shell command to change the MAC address in Sun Solaris is as below:

ifconfig <interface> <class> <address>

For example, the command looks like “ifconfig hme0 ether 1A:2B:3C:4D:5E:6F”. Note that the change is temporary that does not persist after a reboot. To make this change permanent, the command can be placed in a runtime control script (/sbin/sh).

How to Spoof MAC Address in HP-UX

It’s possible to change MAC address using HP-UX SAM. Select Networking and Communications, then selecting the interface, then click on Action -> Modify -> Advanced Options. Finally, change the value of station address, which is MAC address name in HP-UX.

How to Spoof and Change MAC Address in OpenBSD

Use the following command to change MAC Address to spoofed MAC in OpenBSD (after version 3.8):

ifconfig <interface> lladdr <MAC address>

For example, “ifconfig bge3 lladdr 1A:2B:3C:4D:5E:6F”.

How to Change to Spoofed MAC Address Permanently in OpenBSD

To make the MAC address changed at boot before network connection is established, and even before parsing of hostname.* file, edit the /etc/netstart file to add in the following lines before the line of “# Now parse the hostname.* file”:

if [ "$if" = "INTERFACE" ]; then
ifconfig <interface> lladdr <MAC address in format of 00:00:00:00:00:00>
fi

# Now parse the hostname.* file
....

How to Change MAC Address in Mac OS X

Since Mac OS X 10.4.x (Darwin 8.x) onwards, the MAC address of wired Ethernet interface can be altered in Apple Mac OS X in a fashion similar to the Linux and FreeBSD methods. To do so, type the following command in Terminal.app:

sudo ifconfig en0 ether aa:bb:cc:dd:ee:ff

or

sudo ifconfig en0 lladdr aa:bb:cc:dd:ee:ff (for Mac OS X 10.5 Leopard)

where en0 is the network interface (numbered from en0, en1, en2 …) and aa:bb:cc:dd:ee:ff is the desired MAC address in hex notation.

Alternative: MacDaddy (download MacDaddyX.dmg, support Airport wireless adapter)

IMPORTANT: This is a machine translated page which is provided "as is" without warranty. Machine translation may be difficult to understand. Please refer to original English article whenever possible.

Share and contribute or get technical support and help at My Digital Life Forums.

Related Articles

• Fix Hotspot Shield Bandwidth Exceeded, TCP Connect Wait, Auth Failure or Daemon Start Error
• Running Windows with WMWARE Fusion in Your MAC
• Running Google Earth on Suse Linux with VMware
• Zip and Compress Files and Folders with Create Archive in Mac OS X v10.4 Tiger
• Apple Boot Camp for Intel-based Mac Installation Guide
• Change Group Ownership of Symbolic Links in Unix or Linux
• Mac Pilot Reviews
• How to Get Linux Server Sends Email Alert on Root Login
• Download Google Toolbar 3.1.20080605W for Firefox 3.0 Support
• Headdress for Mac OS X Reviews

This entry was posted on Monday, June 30th, 2008 at 3:35 am and is filed under Tips & Tricks. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.