Comments on: Spoofing your MAC-address in Snow Leopard

By: Megan

Megan — Thu, 06 Oct 2011 19:39:36 +0000

Time for new OS, like window xp or Linuxes

By: boomer

boomer — Thu, 11 Aug 2011 07:25:01 +0000

looks like we’re stuck with our old mac address…

By: boomer

boomer — Wed, 05 Jan 2011 08:19:28 +0000

1. at home, connected to a wireless router, connected to internet. no authentication website, no mac filters.
I’m using the same equip (router, modem) that worked with leopard 10.5. Now with snow leopard, no joy.
2. yep! 5min or less usually…. will look into fireshark and more thorough testing

By: captain

captain — Mon, 22 Nov 2010 11:13:37 +0000

It struck me last night, that actually it is not *your* ARP cache that needs to be cleared, it is the ARP cache of the WLAN you’re connected to. That can only be done by timeout.

May I ask some simple questions?
1. Where are you? At home, or in e.g. a library that uses some sort of authentication web site? Authentication is often based on the MAC address.
2. You say “when mac is changed back to original, everything works again”. Does all of this testing happen within 5 minutes?

What you also could do, is download Wireshark and have a look at the traffic on interface en1 (or whatever your airport is). You should be able to get a pretty clear picture of which MAC address is used to send the packages and whether there are any error messages. I say “should be able to”, because it is some work to interpret all these bunches of packets floating through your interface

By: boomer

boomer — Wed, 10 Nov 2010 12:29:29 +0000

thanks captain but no joy… still can’t connect

By: captain

captain — Sat, 06 Nov 2010 11:04:36 +0000

Well, try something really dummy-save like:

1. Disconnect all cables / WLANs
2. Clear the ARP cache with: sudo arp -d -a
3. Change your MAC address
4. Maybe clear the ARP cache again
5. Reconnect

By: Todd

Todd — Thu, 04 Nov 2010 12:18:50 +0000

Same for me, im on a 27″ Imac with a Atheros Airport Extreme. I can change the address, but then the connetion just keeps on timing out. Has anybody figured this out yet? Any help would be appreciated

By: boomer

boomer — Sun, 31 Oct 2010 09:57:27 +0000

no joy…your app had no problem changing the mac once an acceptable vendor was found, but then (same problem) I’m unable to connect to anything.

when mac is changed back to original, everything works again.

How would I test your outdated ARP cache theory?

By: captain

captain — Mon, 11 Oct 2010 11:34:42 +0000

Well, after I changed my AirPort MAC address via ifconfig, it is true that I can still see the original AirPort ID in my Network Preferences. But when I wireshark my connection, I can see that the actual MAC address used is the one which I defined manually via ifconfig.

Thus, my conclusion is that the AirPort advanced preferences show the hardware MAC address – regardless of which address is actually being used right now.

What I do not understand, however, is that you cannot have Internet or a connection to your router after you guys changed it. I believe that it is a network-level problem. Such as an outdated ARP cache and that’s why you don’t receive any packets. Could that be the case?

Anyway, I also made yet another Cocoa application that conveniently runs the ifconfig command for you and you can also choose a vendor prefix from a nice search list. Here: http://blog.funkensturm.de/2010/01/22/airportclown-simple-mac-address-spoof-for-snow-leopard and here is the source code: http://github.com/funkensturm/AirPortClown

PS: MacSpoofer can change the en1 MAC address *while* I’m connected to a WLAN. That’s quite impressive – even though I naturally loose my connection to any server But MacSpoofer is not open-source as I understand it.

By: boomer

boomer — Mon, 27 Sep 2010 10:54:44 +0000

no…didnt work.
I think its just with my macbook pro hardware:
airport extreme card, firmware Atheros 5416