macchanger

Sniffing & Spoofing

Beginnerlow risk

macchanger is a utility for viewing and manipulating the MAC address of network interfaces. Useful for network anonymity and bypassing MAC filtering.

Installation

sudo apt install macchanger

Basic Syntax

macchanger [options] <interface>

Quick Facts

Full Name

macchanger

License

GPL

Category

Sniffing & Spoofing

Platform

Linux

Risk Level

Low

Tool Overview

macchanger is a utility for viewing and manipulating MAC addresses of network interfaces. It allows you to spoof, randomize, or restore hardware addresses for network anonymity, MAC filtering bypass, and security testing.

The tool supports random MAC generation, vendor-specific MAC selection, and permanent MAC restoration. Changes are temporary and revert on reboot unless configured in startup scripts.

Common Commands

macchanger --helpDisplay the summary of all available options

macchanger --versionShow the installed macchanger version

macchanger -s eth0Show the current and permanent MAC address of eth0

macchanger --show wlan0Print the current MAC of wlan0 without changing it

macchanger -r eth0Assign a fully random MAC address to eth0

macchanger --random wlan0Set a completely random MAC on wlan0

macchanger -a eth0Set a random MAC keeping the same vendor kind

macchanger -A wlan0Set a random vendor MAC of any kind

macchanger -e eth0Randomize only the last bytes, keeping the vendor prefix

macchanger --ending wlan0Change device bytes but leave the vendor bytes unchanged

macchanger -p eth0Restore the original permanent hardware MAC of eth0

macchanger --permanent wlan0Reset wlan0 back to its burned-in hardware MAC

macchanger -m 00:11:22:33:44:55 eth0Set eth0 to a specific chosen MAC address

macchanger --mac=00:11:22:33:44:55 wlan0Assign an exact MAC using the long-form option

macchanger -lList all known hardware vendors and OUI prefixes

Step-by-Step Guide

1Disable the target network interface temporarily
2Execute the tool to apply the new hardware address
3Re-enable the network interface
4Confirm the modification was successful by checking the current status

Warnings

You cannot alter the address while the interface is actively connected
Altering hardware identifiers might conflict with local network rules
Changes are temporary and revert upon system restart

Use Cases

MAC Filtering Bypass

Spoof an authorized device's MAC address to bypass MAC-based access controls.

Network Anonymity

Change your MAC address to prevent tracking on public WiFi networks.

Security Testing

Verify that MAC filtering provides meaningful security benefit.

Key Features

Random MAC Generation: Generate fully random MAC addresses or vendor-specific random addresses.
Vendor OUI Support: Maintain the original vendor prefix while randomizing the device identifier.
Permanent MAC Restore: Easily revert to the original factory MAC address with a single command.
Status Display: View current, permanent, and broadcast MAC addresses for any interface.

Related Tools

Aircrack-ng

Wireless Attacks

WiFi security testing suite for monitoring and attacking wireless networks.

Nmap

Information Gathering

Network scanner for discovering devices and their MAC addresses.

Ettercap

Sniffing & Spoofing

Network attack tool that can exploit MAC-based authentication.

Frequently Asked Questions

What is macchanger used for?

Macchanger is a utility for viewing and manipulating MAC addresses of network interfaces. It allows you to spoof, randomize, or restore hardware addresses for network anonymity, MAC filtering bypass, and security testing.

How do I spoof my MAC address?

First disable the interface: sudo ip link set eth0 down. Then run: sudo macchanger -r eth0 to set a random MAC. Finally re-enable: sudo ip link set eth0 up. The -r flag generates a fully random address.

Is MAC spoofing legal?

MAC spoofing is legal for authorized security testing and privacy protection. Using it to impersonate authorized devices, bypass access controls without permission, or commit fraud is illegal. Always obtain proper authorization.

What is the difference between -r and -a flags?

-r sets a completely random MAC address from any vendor. -a sets a random MAC but keeps the same vendor OUI prefix, making the spoofed address appear to come from the same manufacturer as the original.

Do MAC changes persist after reboot?

No, MAC changes are temporary and revert to the permanent hardware address on reboot. To make changes persistent, add macchanger commands to network interface startup scripts or use NetworkManager dispatcher scripts.

How do I bypass MAC filtering with macchanger?

First discover an authorized MAC address using airodump-ng or network scanning. Then set your interface to that MAC using macchanger -m <authorized_mac> eth0. This makes your device appear as the authorized device.

Can I change MAC on WiFi adapters?

Yes, macchanger works on WiFi adapters in managed mode. Disable the interface, change the MAC, then re-enable. Note that some WiFi drivers reset the MAC on reassociation, so you may need to change it after connecting.

How do I check my current MAC address?

Use macchanger -s eth0 to display both the current (spoofed) and permanent (factory) MAC addresses. The -s flag shows the status without making any changes.

What happens if two devices use the same MAC?

Two devices with the same MAC address on the same network will cause MAC conflicts, resulting in network instability, packet loss, and potential disconnection. Use unique MAC addresses to avoid conflicts.

How do I restore my original MAC?

Use macchanger -p eth0 to restore the permanent hardware MAC address. This reverts any spoofed address back to the factory default. The -p flag stands for 'permanent' or 'potato' (the original MAC).

Output Explanation

Displays the original factory address alongside the newly applied temporary address.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.