MAC ADDRESS AND MAC SPOOFING

MAC Address
A Media Access Control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment
MAC addresses are most often assigned by the manufacturer of a network interface card (NIC) and are stored in its hardware, the card's read-only memory, or some other firmware mechanism. If assigned by the manufacturer, a MAC address usually encodes the manufacturer's registered identification number and may be referred to as the burned-in address. It may also be known as an Ethernet hardware address (EHA), hardware address or physical address
MAC addresses are 12-digit hexadecimal numbers (48 bits in length). By convention, MAC addresses are usually written in one of the following two formats:
MM:MM:MM:SS:SS:SS
MM-MM-MM-SS-SS-SS
The first half of a MAC address contains the ID number of the adapter manufacturer. These IDs are regulated by an Internet standards body (see sidebar). The second half of a MAC address represents the serial number assigned to the adapter by the manufacturer. In the example,

00:A0:C9:14:C8:29
The prefix
00A0C9
indicates the manufacturer is Intel Corporation.
HOW TO FIND MAC ADDRESS
1. Windows 95 and newer: winipcfg(in command prompt)
2.Windows NT and newer: ipconfig /all (in command prompt)
3.Linux and some Unix: ifconfig -a Macintosh with Open Transport: TCP/IP Control Panel - Info or User Mode/Advanced
4.Macintosh with MacTCP: TCP/IP Control Panel - Ethernet icon
MAC SPOOFING
There are many reasons or possibilities that an user may want to change the MAC address or a network adapter, which also known as MAC spoofing. For example, to bypass the MAC address filtering on firewall or router. The trick can be used to get pass the network access restriction by emulating a new unrestricted MAC address, or to gain access connection by spoof an authorized MAC address after sniffing the legitimate MAC address out of the air in MAC filtering Wi-Fi network
Beside, hackers or enthusiasts also spoofing another host’s MAC address as their own in order to receive traffic packets not meant for them, although ARP poisoning technique is more commonly used. However, changing MAC address can still keep the real information from been detected and logged by various services such as IDS, firewall, DHCP server, wireless access points and etc, and is essential protect user’s privacy. MAC spoofing also potentially trigger a Denial of Service (DoS) attack by causing routing problem with duplicating MAC address exists in the network, especially those similar with gateway and AP router’s BSSID (Basic Service Set Identifier.)
SPOOFING PROCESS
Change the MAC address in Windows

1. Go to Start -> Control Panel. Double click on Network Connections (inside Network and Internet Connections category in Windows XP). The, right click on the active network connection with network adapter that you want to change the MAC address (normally Local Area Network or Wireless Network Connection) and click on Properties.

Above steps work in Windows XP, Windows 2000 and Windows Server 2003. For Windows Vista, access to NIC’s properties is from Control Panel -> Network and Internet -> Network and Sharing Center -> Manage Network Connections.
Alternatively, if you already know which network adapter that’s responsible for your network or Internet connection, go to Device Manager and open the properties dialog by double click on the NIC itself.

2. In the General tab, click on the Configure button.
3. Click on Advanced tab.
4. In the Property section, select and highlight Network Address or Locally Administered Address.
5. To the right, “Not Present” radio button is by default selected as value. Change the value by clicking on radio button for Value:, and then type in a new MAC address to assign to the NIC

The MAC address consists of 6 pairs of numbers (0 – 9) and characters (A – F) combination. For example, 88-17-E8-90-E2-0A. When entering the new MAC value, omit the dash (-), for example 8817E890E20A.

1. Click OK when done.
2. To verify the change of MAC address, go to command prompt, then type in one of the following commands:

ipconfig /all
net config rdr

3. Reboot the computer if successful to make the change effective.

Note: To restore or reset back to original default MAC address, simply set back the option to “Not Present”.