How To Spoof Your MAC Address

Spoofing Your MAC Address

Here's a(n) article / guide to change / spoof your MAC address across different operating systems.

Linux (Primary Hacking Platform)

Macchanger (Quick & Easy)

bash

# Install
sudo apt install macchanger -y

# View current MAC
macchanger -s eth0

# Random MAC (any vendor)
sudo ip link set eth0 down
sudo macchanger -r eth0
sudo ip link set eth0 up

# Random MAC from same vendor (less suspicious)
sudo macchanger -a eth0

# Specific MAC
sudo macchanger -m 00:11:22:33:44:55 eth0

# Fully random (all bits, may break some NICs)
sudo macchanger -A eth0

Permanent MAC Randomization (Survives Reboots)

NetworkManager method:

bash

# Edit the connection
sudo nmcli connection modify "Wired connection 1" 802-3-ethernet.cloned-mac-address random

# Or for WiFi
sudo nmcli connection modify "YourWiFi" 802-11-wireless.cloned-mac-address random

# Apply
sudo nmcli connection down "Wired connection 1"
sudo nmcli connection up "Wired connection 1"

systemd-networkd method:

bash

# /etc/systemd/network/00-default.link
[Match]
MACAddress=XX:XX:XX:XX:XX:XX

[Link]
MACAddressPolicy=random

Manual MAC Change (No Extra Tools)

bash

sudo ip link set eth0 down
sudo ip link set dev eth0 address 00:11:22:33:44:55
sudo ip link set eth0 up

WiFi MAC Spoofing

WiFi MAC changes require extra steps due to driver restrictions.

bash

# Stop NetworkManager from interfering
sudo systemctl stop NetworkManager

# Kill wpa_supplicant
sudo killall wpa_supplicant

# Put interface down
sudo ip link set wlan0 down

# Change MAC
sudo macchanger -r wlan0

# Restart NetworkManager
sudo systemctl start NetworkManager

If macchanger fails on WiFi (some drivers block it), use:

bash

sudo iw dev wlan0 set 4addr on
sudo ip link set wlan0 down
sudo ip link set dev wlan0 address 00:11:22:33:44:55
sudo ip link set wlan0 up
sudo iw dev wlan0 set 4addr off

Windows

Method 1: Device Manager (GUI)

1. Device Manager → Network adapters → Right-click your adapter → Properties

2. Advanced tab → Locally Administered Address (or "Network Address")

3. Enter 12 hex characters (no colons): 001122334455

4. Disable/enable adapter or reboot

Method 2: PowerShell

powershell

# Get adapter name
Get-NetAdapter

# Set MAC (replace Ethernet0 with your adapter)
Set-NetAdapter -Name "Ethernet0" -MacAddress "00-11-22-33-44-55"

# Verify
Get-NetAdapter -Name "Ethernet0"

Method 3: Registry

powershell

# Find the adapter's registry key in:
# HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}

# Under your adapter's key (0000, 0001, etc.), create/modify:
# String value: "NetworkAddress" = "001122334455"

# Disable/enable adapter to apply

MacOS

bash

# View current MAC
ifconfig en0 | grep ether

# Change MAC (temporary, resets on reboot)
sudo ifconfig en0 ether 00:11:22:33:44:55

# For WiFi (en1 typically, check with ifconfig)
sudo /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport -z
sudo ifconfig en1 ether 00:11:22:33:44:55
networksetup -setairportpower en1 off
networksetup -setairportpower en1 on

Persistent across reboots (macOS):

bash

# Create a launch daemon script
sudo nano /Library/LaunchDaemons/com.macspoof.plist

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.macspoof</string>
    <key>ProgramArguments</key>
    <array>
        <string>/sbin/ifconfig</string>
        <string>en0</string>
        <string>ether</string>
        <string>00:11:22:33:44:55</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

bash

sudo launchctl load /Library/LaunchDaemons/com.macspoof.plist

Verification

After changing, always verify:

bash

# Linux
ip link show eth0 | grep ether

# Windows
Get-NetAdapter -Name "Ethernet0" | Format-List MacAddress

# macOS
ifconfig en0 | grep ether

# Also check what the network sees
sudo tcpdump -i eth0 -c 5  # Watch MAC in captured frames

OPSEC Notes

• Change MAC before connecting to any network. Once you've associated with a DHCP lease or WiFi AP with a MAC, changing it mid-connection often breaks the connection and leaves a log trail.

• Some enterprise networks use 802.1X with MAC authentication — a random MAC will fail. Test in a lab first.

• MAC randomization on modern OSes (Android 10+, iOS 14+, Windows 10+) happens automatically for WiFi scanning — but the connection MAC might still be hardware for enterprise networks.

• If you're MAC-spoofing for a pentest, run macchanger -r at boot before any network activity:

bash

# Add to /etc/rc.local or a systemd service
sudo ip link set eth0 down
sudo macchanger -r eth0
sudo ip link set eth0 up