Spoofing Leopard’s MAC address
posted in the early evening by Constantinos. Filed under Code, OS X, Terminal
There are many legitimate reasons why someone would want to spoof a system’s MAC address. In my case, my University binds our network ports to a specific computer’s MAC address, and only allows you to reset that address once a week. My problems start when I want to switch my two computers for whatever reason, and connect my smaller iBook to the wall (let’s say I want to keep a web server online, but wish to take my MacBook Pro on the road).
In Tiger, it was very easy to spoof a MAC address:
sudo ifconfig en0 ether 00:00:00:00:00:00
where en0 is the network interface you wish to change the MAC address of, and 00:00:00:00:00:00 is the target MAC address. With Leopard, that line no longer works. No matter how much I searched, I couldn’t find a solid alternative. Turns out, it’s extremely simple:
sudo ifconfig en0 lladdr 00:00:00:00:00:00
That’s it!
Note: This has been tested under 10.5.1 with both en0 and en1, and at least for the wired interface it works as advertised.
Tags: Ethernet, Leopard, MAC Address, OS X, Terminal, Unix
You can follow any responses to this entry through the RSS 2.0 feed.
You can skip to the end and leave a response. Pinging is currently not allowed.
| 
Print This Post
1. Comment by Sam
on 22 Jan 2008 @ 2:37 pm · Quote #2172 ·
Hi, I was very excited by your post — I’ve been looking for something like this since Leopard came out. But I’ve had any success in applying it — it still doesn’t seem to work.
2. Comment by Constantinos
on 22 Jan 2008 @ 3:54 pm · Quote #2173 ·
I believe ifconfig will try to verify the mac address, and expects a somewhat reasonable one. Why don’t you try this: type
ifconfig en0 | grep etherto get your current ethernet mac address, then use the above command to change the mac address by only 1 digit (the last one). So if your mac address is00:16:cb:8e:54:d2then try changing it to00:16:cb:8e:54:d3or something similar. Then check your current mac address again. If it still doesn’t work, then I’ll need to revisit the hint. Maybe you need the developers tools installed… Don’t know for sure.If it does work, then you need to supply it with a ‘real’ mac address, meaning it has to be possible, which is most likely defined by the first four characters (the brand id for the IC). Let me know how it works out!
3. Comment by MightyAdsense Google Ad
on 29 Aug 2008 @ 9:22 am · Quote #0 ·
4. Comment by Constantinos
on 22 Jan 2008 @ 3:59 pm · Quote #2174 ·
Or maybe not… This worked on an iBook G4, which is the one I needed to spoof the mac address of. Now I can’t get it to work on my MacBook Pro. Could be a hardware issue, needs re-examination.
5. Comment by pig345
on 24 Jan 2008 @ 1:03 am · Quote #2176 ·
Yes, I can’t get it to work on MacBookPro3,1 with 10.5.1 too!
6. Comment by Constantinos
on 24 Jan 2008 @ 1:11 am · Quote #2177 ·
And I just verified that en0 doesn’t spoof on MacBook Pro, or the new MacBooks (I’m guessing it won’t spoof on older MacBooks either…)
However, en1 does spoof using this method. Intriguing. I wonder what kind of safeguards are in place.
7. Comment by nofxx
on 27 Jan 2008 @ 12:33 pm · Quote #2187 ·
On the same boat…. but Im trying with my usb dongles:
Edimax / rt73 , and Alfa based on realtek 8187l .. both works great on leopard, but doesnt seems to change the mac….
sad…
8. Comment by Matt Sayler
on 28 Jan 2008 @ 4:42 pm · Quote #2191 ·
“However, en1 does spoof using this method. Intriguing. I wonder what kind of safeguards are in place.”
Given that it works in some cases, I’d put my money on the hardware not supporting/being programmed not to support changing MACs. There are certainly plenty of cards that don’t let you do so; OS X seems to just pass the request along to the hardware.
9. Comment by Constantinos
on 28 Jan 2008 @ 4:49 pm · Quote #2192 ·
Actually, under Tiger, the same hardware could be spoofed using the first command. So I’m fairly certain that it’s a leopard thing, hence there has to be a way around it.
10. Comment by Jim B
on 29 Jan 2008 @ 2:59 am · Quote #2194 ·
I tested this *a lot* when I first upgraded to Leopard on a MBP 2,1. It’s undoubtedly a driver issue. I was able to downgrade to Tiger 10.4.11 network drivers and it all worked except the wired connection would be really unstable and eventually stop working to the point where only a reboot would fix it. Wireless worked without issues. I haven’t tried this trick again since updating to 10.5.1.
Also: Leopard’s network drivers appear to be signed where Tiger’s weren’t. This may be a roadblock of indeterminate significance.
DTrace might reveal why the ifconfig en0 lladdr isn’t doing anything but I haven’t been motivated enough to learn enough D to dig into it.
11. Comment by GMB
on 29 Jan 2008 @ 1:04 pm · Quote #2196 ·
I have a Macbook Pro 2.4 and I can’t spoof my en0 mac address in Tiger or Leopard. The funny thing is that I can spoof the address using a Windows Vista partition in bootcamp.
Also, spoofing the mac address in en1 (wireless) works on Tiger and Leopapard.
I’ve heard that older versions of Intel Macbook and MBP can spoof the en0 mac address, so I am pretty sure that this is a driver issue.
I wonder if you could do this using the Macbook Air usb ethernet dongle. Or if samebody could change the current ethernet driver for Leopard…
12. Comment by Constantinos
on 29 Jan 2008 @ 1:54 pm · Quote #2197 ·
I have a first-gen MBP, 17″ 2.16GHz, and I could spoof the en0 address just fine under Tiger. I am certain it’s a driver issue, and if the drivers are signed then I guess there’s little to be done…
13. Comment by Great Britain
on 14 Feb 2008 @ 1:44 am · Quote #2223 ·
This issue has yet to be resolved in 10.5.2. I hope apple eventually takes notice.
14. Comment by Nando Vieira
on 26 Feb 2008 @ 5:11 pm · Quote #2238 ·
Tried on a Macbook with 10.5.2, Xcode installed, without success. Used to work when I had Tiger installed.
15. Comment by nofxx
on 27 Feb 2008 @ 2:30 pm · Quote #2240 ·
Confirm, 10.5.2 doesnt solve this.
Having to use linux in some places to connect… fix it apple!
16. Comment by shams
on 17 Mar 2008 @ 3:25 pm · Quote #2258 ·
do you have some (great) news about spoofing wired mac adress on leopard?
17. Comment by Constantinos
on 17 Mar 2008 @ 3:31 pm · Quote #2259 ·
Sorry, no…
18. Comment by diehortusxana
on 21 Mar 2008 @ 4:45 pm · Quote #2261 ·
hello You there!
I also have a brand new MacBook Pro, 15″.
And the point is, that I can spoof en1, but cannot en0.
On Tiger, everithing was cool, the leopard hmmmmm
19. Comment by shams
on 2 Apr 2008 @ 4:31 pm · Quote #2266 ·
like everyone else here! It’s horrible, I have to launch XP through parallels desktop to have internet…
20. Comment by Michal
on 2 May 2008 @ 10:42 am · Quote #2277 ·
Shams (and others), there is a workaround. You can share your XP connection (as it is possible to spoof ethernet address there) back to OSX:
http://www.macosxhints.com/article.php?story=20070412080405868
Hope it helps.
21. Comment by Toro
on 10 Jun 2008 @ 11:53 pm · Quote #2299 ·
I have a MacBookPro too, I want to spoof with en1 with following:
ifconfig en1 lladdr 00:00:00:00:00:00
my mac says then ifconfig: ioctl: (set lladdr): Operation not permitted
???
22. Comment by Constantinos
on 10 Jun 2008 @ 11:56 pm · Quote #2300 ·
You need root privileges, did you use
sudo?23. Comment by Daniel
on 1 Jul 2008 @ 6:37 pm · Quote #2345 ·
Sorry. Didnt work with 10.5.3…
Cheers
Daniel
24. Comment by Slywood
on 10 Jul 2008 @ 5:12 am · Quote #2369 ·
Did anybody tried with 10.5.4?
25. Comment by medecau
on 11 Jul 2008 @ 9:07 am · Quote #2374 ·
macbook with os x 10.5.4
can spoof on en1 but no luck on en0.
to spoof en0, airport must be off.
26. Comment by Lucas
on 11 Jul 2008 @ 11:17 am · Quote #2375 ·
I tried with 10.5.4, didn’t work
27. Comment by Slywood
on 12 Jul 2008 @ 2:09 am · Quote #2379 ·
Are you saying that if I turn off the airport it would work!
28. Comment by seoci
on 18 Jul 2008 @ 2:23 pm · Quote #2400 ·
I just tried turning off airport before changing the mac for en1. It works if airport is down >.<
29. Comment by Stallon
on 28 Jul 2008 @ 5:32 pm · Quote #2435 ·
no it does not work on 10.5.4 even if airport (en1) is down…
i read somewhere about using the ifconfig binary from FreeBSD and putting in the appropriate folder, though i havent tried it personally…
30. Comment by Jesterpaul
on 31 Jul 2008 @ 6:52 pm · Quote #2448 ·
I run a macbook with 10.5.4. I’ve tried with airport on and off, and I can get neither en0 or en1 to change.
I get the error “network down” in the response in Terminal.
I hope someone can solve this one.
31. Comment by eric
on 6 Aug 2008 @ 4:05 am · Quote #2469 ·
try:
su -
and then issue the command without sudo
32. Comment by ac
on 15 Aug 2008 @ 12:15 pm · Quote #2506 ·
I found a way to change a MAC on Airport (en1) on latest MacBook (MB403 model), Leopard 10.5.4.
1. Turn off airport. Use airport icon on menu bar (top of your screen). DO NOT use ifconfig en1 down, it wouldn’t work!!!
2. Fireup Console and type “sudo -s” (without qoutes).
3. Type “ifconfig en1 lladdr 00:11:22:33:44:55″ (without quotes) and hit return.
4. Turnon airport using airport icon.
That’s all.
If you’ll have any questions email me at aLcLiLdLsLaLs@mail.ru (remove all capital “L”).
33. Comment by gregzone
on 19 Aug 2008 @ 3:32 pm · Quote #2521 ·
Just tried the approach left by ac…
Worked for me…
MacBook 10.5.4
Thanks
34. Comment by bax
on 21 Aug 2008 @ 10:37 pm · Quote #2526 ·
i tried on leopard on a macbook. works for en1, does NOT work for en0
so airport yes, ethernet NO