Spoofing Leopard’s MAC address
posted in the early evening by Constantinos. Filed under Code, OS X, TerminalThis post was originally published in 2008
The tips and techniques explained may be outdated.
There are many legitimate reasons why someone would want to spoof a system’s MAC address. In my case, my University binds our network ports to a specific computer’s MAC address, and only allows you to reset that address once a week. My problems start when I want to switch my two computers for whatever reason, and connect my smaller iBook to the wall (let’s say I want to keep a web server online, but wish to take my MacBook Pro on the road).
In Tiger, it was very easy to spoof a MAC address:
sudo ifconfig en0 ether 00:00:00:00:00:00 |
where en0 is the network interface you wish to change the MAC address of, and 00:00:00:00:00:00 is the target MAC address. With Leopard, that line no longer works. No matter how much I searched, I couldn’t find a solid alternative. Turns out, it’s extremely simple:
sudo ifconfig en0 lladdr 00:00:00:00:00:00 |
That’s it!
Note: This has been tested under 10.5.1 with both en0 and en1, and at least for the wired interface it works as advertised.
1. Comment by Sam
on 22 Jan 2008 @ 2:37 pm
Hi, I was very excited by your post — I’ve been looking for something like this since Leopard came out. But I’ve had any success in applying it — it still doesn’t seem to work.
2. Comment by Constantinos
on 22 Jan 2008 @ 3:54 pm
I believe ifconfig will try to verify the mac address, and expects a somewhat reasonable one. Why don’t you try this: type
ifconfig en0 | grep etherto get your current ethernet mac address, then use the above command to change the mac address by only 1 digit (the last one). So if your mac address is00:16:cb:8e:54:d2then try changing it to00:16:cb:8e:54:d3or something similar. Then check your current mac address again. If it still doesn’t work, then I’ll need to revisit the hint. Maybe you need the developers tools installed… Don’t know for sure.If it does work, then you need to supply it with a ‘real’ mac address, meaning it has to be possible, which is most likely defined by the first four characters (the brand id for the IC). Let me know how it works out!
3. Comment by Constantinos
on 22 Jan 2008 @ 3:59 pm
Or maybe not… This worked on an iBook G4, which is the one I needed to spoof the mac address of. Now I can’t get it to work on my MacBook Pro. Could be a hardware issue, needs re-examination.
4. Comment by pig345
on 24 Jan 2008 @ 1:03 am
Yes, I can’t get it to work on MacBookPro3,1 with 10.5.1 too!
5. Comment by Constantinos
on 24 Jan 2008 @ 1:11 am
And I just verified that en0 doesn’t spoof on MacBook Pro, or the new MacBooks (I’m guessing it won’t spoof on older MacBooks either…)
However, en1 does spoof using this method. Intriguing. I wonder what kind of safeguards are in place.
6. Comment by nofxx
on 27 Jan 2008 @ 12:33 pm
On the same boat…. but Im trying with my usb dongles:
Edimax / rt73 , and Alfa based on realtek 8187l .. both works great on leopard, but doesnt seems to change the mac….
sad…
7. Comment by Matt Sayler
on 28 Jan 2008 @ 4:42 pm
“However, en1 does spoof using this method. Intriguing. I wonder what kind of safeguards are in place.”
Given that it works in some cases, I’d put my money on the hardware not supporting/being programmed not to support changing MACs. There are certainly plenty of cards that don’t let you do so; OS X seems to just pass the request along to the hardware.
8. Comment by Constantinos
on 28 Jan 2008 @ 4:49 pm
[quote post=”106″]Given that it works in some cases, I’d put my money on the hardware not supporting/being programmed not to support changing MACs. There are certainly plenty of cards that don’t let you do so; OS X seems to just pass the request along to the hardware.[/quote]
Actually, under Tiger, the same hardware could be spoofed using the first command. So I’m fairly certain that it’s a leopard thing, hence there has to be a way around it.
9. Comment by Jim B
on 29 Jan 2008 @ 2:59 am
I tested this *a lot* when I first upgraded to Leopard on a MBP 2,1. It’s undoubtedly a driver issue. I was able to downgrade to Tiger 10.4.11 network drivers and it all worked except the wired connection would be really unstable and eventually stop working to the point where only a reboot would fix it. Wireless worked without issues. I haven’t tried this trick again since updating to 10.5.1.
Also: Leopard’s network drivers appear to be signed where Tiger’s weren’t. This may be a roadblock of indeterminate significance.
DTrace might reveal why the ifconfig en0 lladdr isn’t doing anything but I haven’t been motivated enough to learn enough D to dig into it.
10. Comment by Constantinos
on 29 Jan 2008 @ 1:54 pm
[quote post=”106″]I’ve heard that older versions of Intel Macbook and MBP can spoof the en0 mac address, so I am pretty sure that this is a driver issue.[/quote]
I have a first-gen MBP, 17″ 2.16GHz, and I could spoof the en0 address just fine under Tiger. I am certain it’s a driver issue, and if the drivers are signed then I guess there’s little to be done…
11. Comment by GMB
on 29 Jan 2008 @ 1:04 pm
I have a Macbook Pro 2.4 and I can’t spoof my en0 mac address in Tiger or Leopard. The funny thing is that I can spoof the address using a Windows Vista partition in bootcamp.
Also, spoofing the mac address in en1 (wireless) works on Tiger and Leopapard.
I’ve heard that older versions of Intel Macbook and MBP can spoof the en0 mac address, so I am pretty sure that this is a driver issue.
I wonder if you could do this using the Macbook Air usb ethernet dongle. Or if samebody could change the current ethernet driver for Leopard…
12. Comment by Great Britain
on 14 Feb 2008 @ 1:44 am
This issue has yet to be resolved in 10.5.2. I hope apple eventually takes notice.
13. Comment by Nando Vieira
on 26 Feb 2008 @ 5:11 pm
Tried on a Macbook with 10.5.2, Xcode installed, without success. Used to work when I had Tiger installed.
14. Comment by nofxx
on 27 Feb 2008 @ 2:30 pm
Confirm, 10.5.2 doesnt solve this.
Having to use linux in some places to connect… fix it apple!
15. Comment by shams
on 17 Mar 2008 @ 3:25 pm
do you have some (great) news about spoofing wired mac adress on leopard?
16. Comment by Constantinos
on 17 Mar 2008 @ 3:31 pm
[quote comment=”2258″]do you have some (great) news about spoofing wired mac adress on leopard?[/quote]
Sorry, no…
17. Comment by diehortusxana
on 21 Mar 2008 @ 4:45 pm
hello You there!
I also have a brand new MacBook Pro, 15″.
And the point is, that I can spoof en1, but cannot en0.
On Tiger, everithing was cool, the leopard hmmmmm
18. Comment by shams
on 2 Apr 2008 @ 4:31 pm
[quote comment=”2261″]
I can spoof en1, but cannot en0.
On Tiger, everithing was cool, the leopard hmmmmm[/quote]like everyone else here! It’s horrible, I have to launch XP through parallels desktop to have internet…
🙁
19. Comment by Michal
on 2 May 2008 @ 10:42 am
Shams (and others), there is a workaround. You can share your XP connection (as it is possible to spoof ethernet address there) back to OSX:
http://www.macosxhints.com/article.php?story=20070412080405868
Hope it helps.
20. Comment by Toro
on 10 Jun 2008 @ 11:53 pm
I have a MacBookPro too, I want to spoof with en1 with following:
ifconfig en1 lladdr 00:00:00:00:00:00
my mac says then ifconfig: ioctl: (set lladdr): Operation not permitted
???
21. Comment by Constantinos
on 10 Jun 2008 @ 11:56 pm
[quote comment=”2299″]I have a MacBookPro too, I want to spoof with en1 with following:
ifconfig en1 lladdr 00:00:00:00:00:00
my mac says then ifconfig: ioctl: (set lladdr): Operation not permitted
???[/quote]
You need root privileges, did you use
sudo?22. Comment by Daniel
on 1 Jul 2008 @ 6:37 pm
Sorry. Didnt work with 10.5.3…
Cheers
Daniel
23. Comment by Slywood
on 10 Jul 2008 @ 5:12 am
Did anybody tried with 10.5.4?
24. Comment by medecau
on 11 Jul 2008 @ 9:07 am
macbook with os x 10.5.4
can spoof on en1 but no luck on en0.
to spoof en0, airport must be off.
25. Comment by Lucas
on 11 Jul 2008 @ 11:17 am
I tried with 10.5.4, didn’t work 🙁
26. Comment by Slywood
on 12 Jul 2008 @ 2:09 am
Are you saying that if I turn off the airport it would work!
27. Comment by seoci
on 18 Jul 2008 @ 2:23 pm
I just tried turning off airport before changing the mac for en1. It works if airport is down >.<
28. Comment by Stallon
on 28 Jul 2008 @ 5:32 pm
no it does not work on 10.5.4 even if airport (en1) is down…
i read somewhere about using the ifconfig binary from FreeBSD and putting in the appropriate folder, though i havent tried it personally…
29. Comment by Jesterpaul
on 31 Jul 2008 @ 6:52 pm
I run a macbook with 10.5.4. I’ve tried with airport on and off, and I can get neither en0 or en1 to change.
I get the error “network down” in the response in Terminal.
I hope someone can solve this one.
30. Comment by eric
on 6 Aug 2008 @ 4:05 am
try:
su –
and then issue the command without sudo
31. Comment by ac
on 15 Aug 2008 @ 12:15 pm
I found a way to change a MAC on Airport (en1) on latest MacBook (MB403 model), Leopard 10.5.4.
1. Turn off airport. Use airport icon on menu bar (top of your screen). DO NOT use ifconfig en1 down, it wouldn’t work!!!
2. Fireup Console and type “sudo -s” (without qoutes).
3. Type “ifconfig en1 lladdr 00:11:22:33:44:55” (without quotes) and hit return.
4. Turnon airport using airport icon.
That’s all.
If you’ll have any questions email me at aLcLiLdLsLaLs@mail.ru (remove all capital “L”).
32. Comment by gregzone
on 19 Aug 2008 @ 3:32 pm
Just tried the approach left by ac…
Worked for me…
MacBook 10.5.4
Thanks
33. Comment by bax
on 21 Aug 2008 @ 8:47 pm
i tried on leopard on a macbook. works for en1, does NOT work for en0
so airport yes, ethernet NO
34. Comment by ticller
on 1 Sep 2008 @ 10:48 pm
yeah it works… is there a way to make the spoof permanent working… when shut down my notebook i have to run the terminal script again at the next startup
35. Comment by AB-UK
on 24 Sep 2008 @ 12:45 pm
Tried this on a MB Air with the wired interface being en1 running 10.5.5 … no joy. Has anyone had any success?
36. Comment by Wouldntuliketoknow
on 25 Sep 2008 @ 4:49 pm
I’ve been trying this for a while i just updated to 10.5.5 on my brand new macbook and nothing…… it stays the same everytime some help please…. All of these forums are the same there scetchy! thanks for help in advance
37. Comment by loco
on 30 Sep 2008 @ 4:19 am
Thanks for the tip, ac (comment #32). This worked great for me. I am using an iMac Intel Core 2 Duo with Mac OS X Leopard 10.5.5 and it worked great for my Airport Extreme card. The tip in the article did not worked for me. Thanks a lot!
38. Comment by Antonio Carlos Silveira
on 16 Oct 2008 @ 1:39 am
Hi Guys,
any news on how to spoof the Ethernet mac address on MBP (leopard)?
Thanks in advance.
39. Comment by slipttees
on 26 Oct 2008 @ 1:05 am
sudo -s
ifconfig en0 down
then type command from change mac
ifconfig en1 lladdr your_new_mac
ifconfig en0 up
😉
40. Comment by PiotrS
on 27 Oct 2008 @ 11:03 pm
sudo -s
ifconfig en0 down
then type command from change mac
ifconfig en1 lladdr your_new_mac <— is this a trick (en1) or mistake?
ifconfig en0 up
if this is not a trick (i doubt), then it DOES NOT work, man. Next time, please, check before you post, as many will lost time checking
useless tips. No offence, I’m just getting bored seeing such unverified posts :/
Somebody might check whether it is possible to spoof mac address
on USB LAN ethernet adapters, and give a brand if worked.
41. Comment by loco
on 28 Oct 2008 @ 2:11 pm
Since the latest software update for the wlan released from Apple, this trick is not working anymore for me. What a shame. Before the update it worked great.
42. Comment by James
on 1 Nov 2008 @ 9:11 pm
I found it didn’t work on my iMac running Leopard. But I got it to work in the end.
I disabled airport in the System Preferences and then changed it. When I enabled the airport card the mac address changed. I checked this on my router and it spoofed it.
43. Comment by MBA
on 27 Nov 2008 @ 2:50 pm
Hi.
Doesn’t work with the MacBookAir second generation. 10.5.5
en0 is relevant and the MAC address won’t change.
Any solution would be highly appreciated. 🙂
Cheers
44. Comment by me
on 29 Nov 2008 @ 7:33 am
Model Name: MacBook
Model Identifier: MacBook3,1
Processor Name: Intel Core 2 Duo
I have tried every option on this blog. To no avail. If anyone figures this out let me know.
Im running leopard 10.5 Build 9F33
This is driving me nuts. I have tried many methods turn off airport and try sudo…and get this ifconfig: ioctl (set lladdr): Device power is off
ive tried the sudo -s it goes to bash do the ifconfig and nothing. Is it a hardware issue?
45. Comment by Me-again
on 21 Jan 2009 @ 6:37 am
I’ve found a way to change the MAC address of a machine, albeit in a very convoluted way.
I have VMWare Fusion installed, with it, I created a VM image of Coyote Linux (google for it) having a host-only network and a bridged interface. The MAC address of the bridged interface can be changed at will. Now I just start this VM (very limited space, less than 120 MB, and only uses 40 MB of RAM), change my default route (in this case “route change default 172.16.140.2”, the address of my VM on the host-only network) and that’s it. I had to do it because of an hotel (unjustified to me) ban.
46. Comment by müzso
on 1 Feb 2009 @ 3:53 am
I’ve come to the same idea as Jim B. suggested in comment#10. However I’ve done it with 10.5.6 (Jim used 10.5.0) and replacing drivers from 10.4.11 (same as for Jim). I’ve not tested it for days, but in a couple of hours I’ve not experienced any problem with the network connection. I’ve used ipfw and Little Snitch to filter incoming and outgoing connections, torrent downloads to test a higher number of connections, SSH connections and file transfer over SFTP. None of these triggered any error. I’ve documented the driver replacement process on the link supplied as “website” for this post.
47. Comment by Sunny
on 8 Mar 2009 @ 4:04 pm
Nothing would work for me… I have a macbook pro 2nd generation running leopard 10.5.6 Nothing worked for me until a friend gave me this command.
1) Make sure your airport is on, but not connected to any networks.
2) In terminal type command sudo ifconfig en1 lladdr (mac address here)
Personal not when typing command do not put mac address in parentheses
then to make sure it worked, enter:
ifconfig en1 | grep ether
And it should show the new MAC address. Enjoy
48. Comment by bkb3000
on 8 Mar 2009 @ 8:11 pm
Sunny’s step #1 is critical — nothing worked for me until I disconnected airport my network but left it on (10.5.6).
49. Comment by stop wasting our time
on 16 Mar 2009 @ 4:36 pm
If you’re not smart enough to enable the wireless interface before trying to change the wireless mac address, then you need serious help.
The issue here occurs when trying to change your ethernet (NOTE: NOT WIRELESS) mac address under Leopard on a 2nd gen Macbook Pro. It sounds like nothing outside of installing older Tiger ethernet drivers works, and I can’t verify that fix because I don’t have Tiger handy.
So unless you have a Macbook Pro with Leopard installed, and have a way change the ethernet mac address (en0), stop wasting our time by suggesting fixes that don’t work. There never was an issue changing the mac address of the wireless interface, unless ofcourse you think enabling the interface is an issue that needs discussion.
50. Comment by lemonteh
on 19 Mar 2009 @ 11:11 am
Following Sunny’s method, ifconfig en1 | grep ether shows the updated address but in Network Preferences, click on AirPort and advanced, the MAC address shown is still the original one.
My router still recognized my wireless as the original MAC address.