Windows: Easy MAC address spoofing

While testing out the different NAC solutions, I wanted to see how they would handle a connection where the MAC address that was previously associated with a printer was suddenly associated with a PC. The NIC in my laptop allows me to manually change the MAC address in the NIC properties. That works but I wanted an easier way to make the changes. The solution ended up being a freeware program called Technitium MAC Address Changer.

Some of the features of Technitium MAC Address Changer include:

Easy to use GUI interface.
Huge list of manufacturers MAC addresses to choose from.
Full NIC hardware and configuration information.
IP configuration shortcuts.

I’m using it tomorrow to test a Cisco NAC we have on loan. The MAC address I’m going to try is currently associated with a Cisco IP phone. According to the Cisco reps, the NAC should detect that the MAC address is being used by a different system and drop me into the quarantine role. That’s just one of a few features they said works but weren’t able to demo during the initial setup.

Men will always be mad, and those who think they can cure them are the maddest of all. – Voltaire

25.Sep.07 Networking, Software, Windows

You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.

4 Responses to “Windows: Easy MAC address spoofing”

Rollie | September 26th, 2007 at 4:49 am
This should be an interesting experiment. While it’s possible to spoof MAC addresses, I’m not aware of any way of ignoring the *real* one.
Bryan Price | September 26th, 2007 at 11:27 am
I’m reminded of the old times when you pulled the socketed PAL to change your MAC. Good thing, since 3Com 3+ licensing was linked using the MAC.

Rollie: You either have the assigned MAC or one you put in. If you change it via NIC properties, it’s changed. The old one has disappeared. The real one is whatever you put in that field.
Rollie | September 26th, 2007 at 10:34 pm
Maybe I’m confused but weren’t we talking about spoofing? If yeah change the MAC address yeah it’s gone but if you are spoofing won’t both still work?
wyckedone | September 28th, 2007 at 10:20 am
As far as I can tell, the hard coded MAC address is not used if you change the registry entry in Windows. Windows uses the registry entry and ignores the MAC on the NIC. I haven’t been able to test it on the Cisco NAC yet because the phone I was going to use won’t be available until Monday.