Spoofing Leopard’s MAC address

posted in the early evening by Constantinos. Filed under Code, OS X, Terminal

This post was originally published in 2008
The tips and techniques explained may be outdated.

There are many legitimate reasons why someone would want to spoof a system’s MAC address. In my case, my University binds our network ports to a specific computer’s MAC address, and only allows you to reset that address once a week. My problems start when I want to switch my two computers for whatever reason, and connect my smaller iBook to the wall (let’s say I want to keep a web server online, but wish to take my MacBook Pro on the road).

In Tiger, it was very easy to spoof a MAC address:

sudo ifconfig en0 ether 00:00:00:00:00:00

where en0 is the network interface you wish to change the MAC address of, and 00:00:00:00:00:00 is the target MAC address. With Leopard, that line no longer works. No matter how much I searched, I couldn’t find a solid alternative. Turns out, it’s extremely simple:

sudo ifconfig en0 lladdr 00:00:00:00:00:00

That’s it!
Note: This has been tested under 10.5.1 with both en0 and en1, and at least for the wired interface it works as advertised.

64 Responses to “Spoofing Leopard’s MAC address”

  1. 1. Comment by Sam
    on 22 Jan 2008 @ 2:37 pm · Quote #2172 ·

    Hi, I was very excited by your post — I’ve been looking for something like this since Leopard came out. But I’ve had any success in applying it — it still doesn’t seem to work.

  2. 2. Comment by Constantinos
    on 22 Jan 2008 @ 3:54 pm · Quote #2173 ·

    I believe ifconfig will try to verify the mac address, and expects a somewhat reasonable one. Why don’t you try this: type ifconfig en0 | grep ether to get your current ethernet mac address, then use the above command to change the mac address by only 1 digit (the last one). So if your mac address is 00:16:cb:8e:54:d2 then try changing it to 00:16:cb:8e:54:d3 or something similar. Then check your current mac address again. If it still doesn’t work, then I’ll need to revisit the hint. Maybe you need the developers tools installed… Don’t know for sure.

    If it does work, then you need to supply it with a ‘real’ mac address, meaning it has to be possible, which is most likely defined by the first four characters (the brand id for the IC). Let me know how it works out!

  3. 3. Comment by Constantinos
    on 22 Jan 2008 @ 3:59 pm · Quote #2174 ·

    Or maybe not… This worked on an iBook G4, which is the one I needed to spoof the mac address of. Now I can’t get it to work on my MacBook Pro. Could be a hardware issue, needs re-examination.

  4. 4. Comment by pig345
    on 24 Jan 2008 @ 1:03 am · Quote #2176 ·

    Yes, I can’t get it to work on MacBookPro3,1 with 10.5.1 too!

  5. 5. Comment by Constantinos
    on 24 Jan 2008 @ 1:11 am · Quote #2177 ·

    And I just verified that en0 doesn’t spoof on MacBook Pro, or the new MacBooks (I’m guessing it won’t spoof on older MacBooks either…)

    However, en1 does spoof using this method. Intriguing. I wonder what kind of safeguards are in place.

  6. 6. Comment by nofxx
    on 27 Jan 2008 @ 12:33 pm · Quote #2187 ·

    On the same boat…. but Im trying with my usb dongles:
    Edimax / rt73 , and Alfa based on realtek 8187l .. both works great on leopard, but doesnt seems to change the mac….

  7. 7. Comment by Matt Sayler
    on 28 Jan 2008 @ 4:42 pm · Quote #2191 ·

    “However, en1 does spoof using this method. Intriguing. I wonder what kind of safeguards are in place.”

    Given that it works in some cases, I’d put my money on the hardware not supporting/being programmed not to support changing MACs. There are certainly plenty of cards that don’t let you do so; OS X seems to just pass the request along to the hardware.

  8. 8. Comment by Constantinos
    on 28 Jan 2008 @ 4:49 pm · Quote #2192 ·