This site is now 100% read-only, and retired.

Working with MAC addresses

Posted by Steve on Thu 22 Feb 2007 at 16:47

MAC addresses are often taken for granted, things that nobody thinks about. However there are times when you do need to worry about them. Here we'll demonstrate how to view and change the MAC address of your Debian system.

Recently I had to deal with a machine which was having a strange networking problem:

  • One booted the machine couldn't be contacted remotely.
  • However the machine became contactable once it made a single outgoing network connection.

It took a while to figure out what was going wrong, but eventually we discovered that the machine was acquiring a different MAC address each time it booted. This explained the symptoms:

  • On booting the machine would get a new MAC address - but the routers ahead of it would have the old one cached so no traffic would reach it.
  • Once the machine made a single outgoing connection the router(s) would see the new MAC address and update themselves - so incoming connections worked.

The following messages in the system logs show the problem explicitly, once we knew to look there:

0000:00:07.0: Invalid Mac address detected: b1:8e:66:ea:0f:00
Please complain to your hardware vendor. Switching to a random MAC.
eth0: forcedeth.c: subsystem: 01458:e000 bound to 0000:00:07.0

Thankfully the solution to this problem was very simple - just allocate a static MAC address to the machine, so when it reboots it doesn't generate a random one of its own.

Find your MAC address

To view the MAC address of your machine you can use the ifconfig command. To see all interfaces run:

skx@mine:~$ ifconfig
eth0      Link encap:Ethernet  HWaddr 00:17:31:56:BC:2D
          inet addr:192.168.1.20  Bcast:192.168.1.255  Mask:255.255.255.0
..
..

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0

..
..

Here the MAC address is displayed after HWaddr, so the MAC address of this system is "00:17:31:56:BC:2D".

If you just want the MAC address of an interface you could run something similar to this:

skx@mine:~$ ifconfig eth0 | grep HWaddr | awk '{print $5}'
00:17:31:56:BC:2D
Set your MAC address

If you wish to explicitly set your MAC address upon a Debian system you can do so by adding an entry to your /etc/network/interfaces file.

Beneath each interface you wish to setup add "hwaddress ether xx:xxx..". For example:

auto eth0 static
iface eth0 inet static
  address 1.2.3.4
  gateway ...
  broadcast ...
  hwaddress ether 02:01:02:03:04:08

 

 


Re: Working with MAC addresses
Posted by dpdt1 (62.1.xx.xx) on Thu 22 Feb 2007 at 18:01
debian has a package for everything so..,
you can also try macchanger :)

http://packages.debian.org/testing/net/macchanger

it's very easy to use and website(http://www.alobbs.com/macchanger), has some pretty nice examples for beginners like myself.

[ Parent ]

Re: Working with MAC addresses
Posted by Steve (62.30.xx.xx) on Fri 23 Feb 2007 at 08:37
[ View Weblogs ]

That's very cool, thanks for the pointer.

Steve

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (67.88.xx.xx) on Thu 22 Feb 2007 at 18:09
Wow that is much easier than I thought. Also good to use if your DSL / Modem company requires a certain mac address. Thanks for the good article.

[ Parent ]

Re: Working with MAC addresses
Posted by dkg (216.254.xx.xx) on Fri 23 Feb 2007 at 16:49
[ View Weblogs ]
If you have the awesome moreutils package installed, you can also use ifdata to extract the MAC address cleanly, without needing to parse the output:
[0 dkg@howler ~]$ ifdata -ph eth0
00:20:1B:B5:99:83
[0 dkg@howler ~]$ 

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (86.49.xx.xx) on Sat 24 Feb 2007 at 16:35
We usually call our system UNIX-like; which means this util is not needed at all. UNIX benefits mainly from the great thoughts of McIllroy. ;)

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (81.248.xx.xx) on Sat 24 Feb 2007 at 04:17
Thanks for the article!
Does this method also work for wifi interfaces? Sometimes you get mac filtered...

For the matter you explain, usually the local router should also have a timeout for the IP-MAC address resolution table. That should make you wait 5 minutes or so after booting the machine, and after that, voila! The router refreshes (deletes) the old mac and when you connect it makes a resolution query (arp), finding the new IP-MAC adress resolution. But I think that _noone_ should be accessing the machine for the router delete the old mac from it's table. You can see this table with arp -an.

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (86.49.xx.xx) on Sat 24 Feb 2007 at 16:32
Please, can you avoid using the years and years obsoleted ifconfig in articles? If only somebody clever kicked it out of debian...

[ Parent ]

Re: Working with MAC addresses
Posted by Steve (62.30.xx.xx) on Sat 24 Feb 2007 at 16:34
[ View Weblogs ]

Each to their own. I will try to remember, but when I install a package I use apt-get and when I do networking things I use ifconfig.

They are hard habits to break...

Steve

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (86.49.xx.xx) on Sat 24 Feb 2007 at 16:47
It is worth to know ifconfig(8) because of *BSD systems. But these tools on GNU OS differs a bit and are totally obsoleted by the ip(8) utility. All init scripts that still use the obsoleted networking tools should be rewritten and the ifconfig and route(8) programs should be only optional. The main purpose is that not even ifconfig is obsoleted for a long time but it even does not really work with recent kernels because the whole kernel API has changed! So, please, do not teach novices to use obsoleted tools. :)

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (59.176.xx.xx) on Sun 25 Feb 2007 at 18:03
I think the problem is that ip(8) is so much more powerful that it is harder to understand. The documentation at ip-cref.ps.gz is actually well-organised (somewhat man page like), but ip(8) remains hard to really get familiar with without deep grok and a lot of trying it out. At least for me.

That Alex Kuznetsov fellow (the developer behind iproute2) is jolly clever - one of those crazy Russian techies who absolutely shimmer with talent - but it means us lesser beings have to struggle to get what he has made available. So we fall back on easier-to-understand trusty old ifconfig.

I think you're right - the debian networking scripts system really needs to be overhauled so iproute2 is the default used, and so that iproute2 is a base network package. Once people see it in use, they'll start using it and getting used to it, and it will become more popular, like it deserves to be. Because it is elegantly powerful.

PJ

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (88.108.xx.xx) on Sat 24 Mar 2007 at 22:52

And here is how to do it with ip(8).

Let's check what we have:
# ip l sh eth0
17: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:c0:9f:55:6e:e5 brd ff:ff:ff:ff:ff:ff

You can not change MAC of interface if it is UP, so let's shutdown the interface:
#ip l s eth0 down

and change it:
#ip l s eth0 a 00:11:22:33:44:55

have a look at what we have done:
# ip l sh eth0
17: eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:11:22:33:44:55 brd ff:ff:ff:ff:ff:ff

Voilla!! It works! :) Now let's bring interface up:
#ip l s eth0 up

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (141.35.xx.xx) on Thu 1 Nov 2007 at 16:06
great post. thx!

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (119.4.xx.xx) on Wed 22 Apr 2009 at 07:48
why i cann't get my dhcp addr in this way

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (2600:0xx:0xx:0xxx:0xxx:0xxx:xx) on Fri 10 Feb 2017 at 22:26
These changes revert at reboot. How do you make a MAC address change permanent?

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (86.49.xx.xx) on Sat 24 Feb 2007 at 16:48
PS: I use apt-get too, which is most correct on Debian-based systems. :)

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (74.59.xx.xx) on Sat 22 Aug 2015 at 19:36
whats wrong with using ifconfig ? i look at the post below doing it with ip command and it looks like klingon (or random characters from the alphabet separated by spaces )

[ Parent ]

OT: Mac MAC addresses
Posted by suspended user k2 (69.157.xx.xx) on Wed 28 Feb 2007 at 18:42
[ View Weblogs ]
Does anyone know how Mac disabled changing of Mac addresses? I happen to have a Macbook Pro and wasn't able to play MAC changing with it :(

--
k2

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (213.106.xx.xx) on Fri 9 Mar 2007 at 02:23
I use dnsmasq for my dhcp server. A neat feature is the ability to set all named mac addresses in /etc/ethers to their matching names in /etc/hosts's ip address, so a listed host always gets the same ip. I use this for NAT portfowarding as I don't seem to be able to put rule destinations down as hostnames in my firewall.

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (61.91.xx.xx) on Wed 21 Mar 2007 at 03:37
It's an excellent reference. So helpful to a busy person like me. Thanks for the creator of this.

[ Parent ]

Re: Working with MAC addresses
Posted by busfault (69.205.xx.xx) on Wed 21 Mar 2007 at 22:17
[ View Weblogs ]
Also, you can find the HW address (MAC) from viewing /proc/net/arp: (From proc(5) )
/proc/net/arp
              This  holds  an ASCII readable dump of the kernel ARP table used
              for address resolutions. It will show both  dynamically  learned
              and pre-programmed ARP entries.  The format is:

        IP address     HW type   Flags     HW address          Mask   Device
        192.168.0.50   0x1       0x2       00:50:BF:25:68:F3   *      eth0
        192.168.0.250  0x1       0xc       00:00:00:00:00:00   *      eth0

              Here 'IP address' is the IPv4 address of the machine and the 'HW
              type' is the hardware type of the  address  from  RFC  826.  The
              flags are the internal flags of the ARP structure (as defined in
              /usr/include/linux/if_arp.h) and the 'HW address'  is  the  data
              link layer mapping for that IP address if it is known.

-Tom
%s/Your Reality/My Own/g

[ Parent ]

Re: Working with MAC addresses
Posted by Anonymous (87.184.xx.xx) on Mon 14 May 2007 at 22:12
Very helpfull!

Fixed my problem with debian (ct VDR project) on Gigabyte M61P-S3 with onboard LAN adapter.

Thanks!

[ Parent ]