MAC addresses-changing

Printable View

June 23rd, 2002, 03:26 AM
khakisrule

MAC addresses-changing for WIN2k and LINUX

A MAC (Media Control Access) address is a unqiue 12 digit 48 byte long number, unqiue to every network adapter ever made. The first 3 sets of numbers, or the first 6 numbers are the ID of the network adapter manufacturer, and the last 3 sets, or the last 6 numbers are the ID that the manufacturer gave to that specific adapter. MAC addresses were made to be fixed, unchangable. Also, many ISPs designate an IP to a MAC address so if say a router is added, then the MAC address would change and the ISP might shut down the account. To find out your MAC address, that is if you have a network adapter, then you can use winipcfg or ipconfig if you have windows, or you can use ifconfig -a in linux or unix systems. I have heard that it is possible to change MAC addresses from the My Network Places interface in Windows 2000, though this is not possible for all MACs and I have not been able to confirm this yet. Also I have heard that the same can be done using the ifconfig utility in linux and unix boxes. And one more thing, is that, at least with the ifconfig utility that the MAC changing is not permanent, and only lasts for the duration of the uptime, so when you have to reboot, it would have to be done all over again, though perhaps somebody will automate it sometime.

In using any of the ways described below you absolve me of any responsibility or wrongdoing for any harm done to your computer.

To change the address in linux on ethernet card eth0, try using something like this,
#ifconfig eth0 hw ether XX:XX:XX:XX:XX:XX

In Windows2k try going to your "control panel", then double clicking your "network and dial up connections", right click the connection that uses the NIC (network adapter) and click properties. Then press "configure" and then "advanced" and then "locally administered address". Then enter the new MAC address.
This can also be done in the registry, using Regedt32, go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<Your NIC>
And enter your new MAC address. You must reboot for the registry changes to take effect, after you have done so, try typing "net config rdr" in the command prompt to see if the changes have taken effect or not.
June 23rd, 2002, 06:48 AM
khakisrule

And one more thing. If you have any suggestions for an originial tutorial, post them, I'll research them and write one best I can.
June 23rd, 2002, 10:31 PM
khakisrule

Oh yeah, and I suppose you could probably also check if you MAC changed in Win2k by using ipconfig, but I just don't know, seeing as how I don't have it.
June 23rd, 2002, 11:27 PM
rogue_scholarX

When doing this you actually wouldn't be changing the MAC address, only changing what the things connecting to your comp. Think it is. Which would be why your MAC address wouldn't change permanently because it is stored on the NIC itself. Im pretty sure on a ROM chip(because it makes sense.) To improve the tutorial you may want to start out by explaining what a MAC address is so people would know why they wanted to change it, it's use in security, stuff along that lines.
June 23rd, 2002, 11:31 PM
khakisrule

Perhaps I'll explain MACs in my next tutorial. And the MAC, I have heard is stored and changable with an EEPROM. Yeah, I know that it is impossible to actually change the address because the address is ingrained in the firmware. You would have to change it to actually change the MAC address, but it is doubtful anybody will go to the trouble to change the MAC address on the firmware, so here are some easy low cost solutions. And thanks for the input. :)
June 24th, 2002, 04:37 AM
waytallgel

Quote:

A MAC (Media Control Access) address is a unqiue 12 digit 48 byte long number

Just wanted to point out that I'm pretty sure it's a 48 bit long number. Everything else looks pretty good though.... :D
June 24th, 2002, 04:44 AM
khakisrule

Oops. Mistake there, obvious one. I'll fix that up right away and thanks for the input, bye and thanks again.
June 24th, 2002, 04:44 AM
ammo

waytallgel is right, 48 bits, 6 bytes (in hex, 1 byte = 2 digits, hence 12 digit number)

Ammo
June 24th, 2002, 04:45 AM
khakisrule

Um, I tried to edit it, but you can only edit until 1440 minutes after you post the message, and it has been longer than that for me, guess I can't fix it. Thanks for finding it though. And please don't delete your post, as people can read the correction from there.
July 14th, 2002, 08:43 PM
pps111

Hi,

What if i want to change my MAC address permanently ?

I have 2 PCs each with LAN cards and one out of them is on a broadband internet connection.

Our ISP has installed a firewall with MAC address check - so i cannot login though other PC !!

Can I change MAC address on a Win 98 box by hook or crook ? :D

Bye.
July 14th, 2002, 09:05 PM
yanksfan

Is there a way to use MAC addresses to verify a remote user/computer on the internet?

(Because IP addres don't do a good job of that, since they can be spoofed and stuff, plus most are dynamic)
July 14th, 2002, 09:11 PM
khakisrule

Only if they have netbios enabled, because netbios gives away the MAC address. But most people don't have netbios open so you wouldn't have much luck. And BTW I don't think you understand spoofing. Spoofing is sending packets that have forged headers so that people don't actually know the IP it came from. You can just spoof your IP address permanently, and sit on the internet. Doesn't work that way. Spoofing is mostly used to send anonymous packets, thats all. And as for dynamic IPs you can't do a thing about 'em but laugh because those poor bastards have dial-up.
July 14th, 2002, 09:21 PM
yanksfan

Ok, correct me if I'm wrong, then if the packets are spoofed, the information that they requested (if any), wouldn't be able to find its way back to their machine...?
July 14th, 2002, 09:23 PM
(V)/\><

eh, aren't mac addresses burned into the network card. to change it you have to change the card.
July 14th, 2002, 09:43 PM
ammo

There is a default mac address "burned" into each NIC, but they can be overridden at run time by many os/driver...

Ammo
July 14th, 2002, 09:58 PM
khakisrule

Quote:

eh, aren't mac addresses burned into the network card. to change it you have to change the card

True. Very true, but still a MAC address can be changed. But if you want to permanently change the address you have to change the adapter. Its the only way, unless you can burn your own eeprom or something.

Quote:

Ok, correct me if I'm wrong, then if the packets are spoofed, the information that they requested (if any), wouldn't be able to find its way back to their machine...?

Which is why most spoofed IPs are used to do things that don't need any return data, such as pinging, get my drift? I have also heard of packet intercepting though I do not understand how that works. However you might find some more thorough information at the spoofing and hijacking tutorial, search for it.
July 14th, 2002, 10:37 PM
yanksfan

thanks, khakisrule
July 14th, 2002, 10:47 PM
Sudo

Quote:

Originally posted here by khakisrule
Which is why most spoofed IPs are used to do things that don't need any return data, such as pinging

How can you ping a host if you can't receive a reply? If the source IP was spoofed, the host replying to the ICMP echo would not be able to reply to the request. I don't believe this can be done, however, please correct me if I'm mistaken.
July 14th, 2002, 10:49 PM
lukea

Good info

I never realised it was that simple to change a MAC. Nice to know, thanks for posting it.
July 15th, 2002, 12:06 AM
waytallgel

pps111: instead of changing your mac on one of your machines, you could also try internet connection sharing with windows 98 if that's the one that can get out the broadband connection. Can't really say that I like internet connection sharing all that much, but I think it should work ok that way.
July 15th, 2002, 06:41 AM
HstarUfishB

Sudo, what you just said could be used as a form of DOS . If I understand what you are saying that is. Some kidy kould forge you IP as the sorce IP, then ping away! In a tight spot like that you'd need to set up your firewall to ignore the pings.

Now I would like to ask the question :confused: : Why would I want to change my Mac id khakisrule? Besides trying to get around an ISP like pps111 is asking about that is? :D What benifit to me kould I get out of it. Or are you just telling us a nifty little short cut?

Just WANdoring.
July 15th, 2002, 06:56 AM
khakisrule

Nifty shortcut mostly, plus its cool to do. And its useful if you have netbios enabled. Mostly just fun though.

Quote:

How can you ping a host if you can't receive a reply? If the source IP was spoofed, the host replying to the ICMP echo would not be able to reply to the request. I don't believe this can be done, however, please correct me if I'm mistaken.

Its a one way ping just designed to make system resources go to waste. Don't you know about DDos or smurf attacks? And there are SYN floods with spoofed IPs as well.
July 15th, 2002, 08:05 AM
Sudo

Quote:

Originally posted here by khakisrule
Its a one way ping just designed to make system resources go to waste. Don't you know about DDos or smurf attacks? And there are SYN floods with spoofed IPs as well.

Ok, well I was thinking from the stand-point of an attacker scanning subnets for active hosts, while trying to avoid detection through the use of a spoofed IP.
July 15th, 2002, 08:12 AM
khakisrule

Quote:

Ok, well I was thinking from the stand-point of an attacker scanning subnets for active hosts, while trying to avoid detection through the use of a spoofed IP

I have heard of people who spoof their IP addresses intercepting packets to accomplish simple tasks that require 2 way communication but I have no idea how it is done. But that spoofing/hijacking tutorial wil probably explain this in greater detail. I know it is possible to assume the IP of a person on a network, such as a cable internet hub, though I have no idea how that is done either.
July 16th, 2002, 07:54 AM
(V)/\><

[quotes]
ammo>>There is a default mac address "burned" into each NIC, but they can be overridden at run time by many os/driver...
khakisrule>>...but still a MAC address can be changed.
[/quotes]

thanks for that lads, you would think you could trust your lecturer.