1

I'd like to ask a question about spoofing MAC addresses. I'm trying it out in my own wifi network just to see how it's done. I'm running ubuntu 16.04 LTS.

Let's say my original MAC address is 00:22:ac:55:0b:02. Using ifconfig I do:

sudo ifconfig wlan0 down
sudo ifconfig wlan0 hw ether 00:22:ac:55:0b:01
sudo ifconfig wlan0 up

As you can see, I've only changed the last digit of my MAC address. If I now try to load a web page (in Firefox), I get a "server not found" error. After calling

sudo dhclient wlan0

I am able to load web pages but only very slowly. About half the time I still get the same "server not found error" as well, but by hitting f5 repeatedly it sometimes works.

If I go back to my original MAC address, the first three commands are enough to get me connected, and I don't always even need to call dhclient. Needless to say, the internet is nice and fast with my original configuration.

I'm curious about why, after spoofing my MAC address, I get a trickle of slow internet connection. I would have thought I would either have the same connection as before, or not be connected at all. Could someone wiser than me explain?

Cheers

1

It's hard to say exactly what could be happening, without additional information, but it sounds like possibly you could be experiencing an ARP conflict or a broadcast storm. You might try a wired connection to see if that makes a difference.

Address Resolution Protocol, which relies on tying a MAC address to an IP address in a table on your router. Depending on the MAC address you're spoofing is, if it's even valid, it could be conflicting with another portion of the network. Especially when you are over WiFi, the network will send the packets addressed to your MAC address, and if it's not able to spoof it properly for whatever reason (let's say it sends out that as the return address, but the network "sees" the real MAC address, so the packets aren't coming back correctly, so it'd be slower), that could cause the issues above. You might try doing some packet capturing to determine what's going on, especially to see if there are lots of ARP requests.

I highly recommend checking out the Wiki page for ARP, which is one use of MAC addresses, but not in the least the only. The MAC Address Wiki Page is also really helpful, too.

Secondly, do you know if the MAC address you're spoofing is valid? If it's not, there could be detection of that by your router and it could be causing issues.

Thirdly, do you know if your router is set up to prevent spoofing? According to the MAC Spoofing Wiki page, this is possible, though I don't know.

Try generating a valid MAC address, using a tool such as this one, to see if that makes a difference. If your router saw the MAC address, and it wasn't valid, it might never go into the ARP cache, and thus every time it tried to associate IP -> MAC it would fail. How it would work, I don't know, but it could work for a few seconds, realize it is invalid, and then trash the entries. That would make it very slow.

This answer over on the security stackexchange is very insightful, explaining the difference between IP address conflict and MAC Spoofing, and when MAC spoofing can cause IP conflict.

  • Thank you for the answer! I'll go through the resources you mentioned, and do some package capturing to get more insight. – Kirjain Apr 16 at 6:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.