4

I need to read permanent (burned-in) MAC address of network adapter. Since MAC address can be easily spoofed, I need to read the real one which is written on EEPROM. I need to do it using C++ on Linux.

I tried using ethtool which is quite good and works fine. However on some systems it does not work as intented.

ethtool -P eth0

returns this:

Permanent address: 00:00:00:00:00:00

and

ethtool -e eth0

returns this:

Cannot get EEPROM data: Operation not supported

Network Adapter has following info:

  • driver: ucc_geth
  • version: 1.1
  • firmware-version: N/A
  • bus-info: QUICC ENGINE

Linux kernel version is: 2.6.32.13

Question is: Can i fix this issue with any update(driver, kernel etc)?

Additionally, I make the same ethtool calls with ioctl function in C++. Is there any way to fix this inside the code? Or is there any other way to get the permanent MAC address from EEPROM?

6

If you trust the local machine not to be spoofing, both ifconfig and ip addr will give you the MAC address of the hardware.

If you don't trust the local machine, neither ethtool, ifconfig, nor ip is going to provide you the information you need. Because there are very legitimate reasons for MAC spoofing (for example, hot-fail on ethercards) all the drivers report only the currently "virtual" MAC address because if you need to spoof the address it wouldn't do well for some of the tools to report the firmware address and others to report the soft address. No ioctl can or should give you the hard-address.

To get the hard-address requires reading the device registers directly and is thus completely device specific.

A quick look through the ucc_geth.c driver seems to show that MAC address reassignment is supported by the chip itself (which makes sense as it needs to be able to pluck packets sent to its soft address off the ether). This means that you need to be very deliberate to ensure you are getting the hard address for which the driver liberally says:

/* For more details see the hardware spec.  */
  • No i do not trust. When mac address is spoofed with ifconfig eth0 hw ether, ifconfig gives the spoofed one not the original one. – Kerim Oguzcan Yenidunya Sep 5 '13 at 13:21
  • @KerimOguzcanYenidunya then you do have a bit of sub-ioctl programming ahead of you; see my additions above. – msw Sep 5 '13 at 13:55
4

If you trust the system administrator, then the MAC address from ifconfig will not be spoofed, because by definition you trust the system administrator not to spoof it.

If you do not trust the system administrator, you have no way to know the MAC address of the machine. The machine could be virtual. It could have no network interface. You have no way to know. Even if you find a system call that supposedly does what you want, the sysadmin can choose to run your program in such a way that this system call returns a different result.

  • This is a bit misleading - systems may have a set of spoofed MACs for non-malicious purposes, such as link aggregation. You can check /sys/class/net/<iface>/addr_assign_type to determine if a MAC has been changed and how. – ti7 Sep 21 '16 at 18:23
  • @ti7 What do you find misleading? The question was about spoofing, i.e. deliberately setting an address to an independently-chosen value (presumably the one that the asker's application is licensed for). Deliberately setting an address to be the same as another address isn't the asker's concern. Given that the potentially hostile party is the system administrator, running any code to check the MAC address is pointless: the admin may spoof the call to check the MAC address itself, without affecting the machine's network configuration. – Gilles Sep 21 '16 at 18:37
  • No need for defense; a MAC may be spoofed regardless of one's trust in the system administrator, and they may not be aware that they are even changing the value. Further, I came here from an independent search for MAC spoofing information - comments are not necessarily answers. – ti7 Sep 21 '16 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.