[ previous ] [ next ] [ threads ]
 From:  "Molle Bestefich" <molle dot bestefich at gmail dot com>
 To:  tnelson at fudnet dot info
 Cc:  m0n0wall at lists dot m0n0 dot ch
 Subject:  Re: Nokia Spoofed Mac Addresses
 Date:  Sun, 16 Jul 2006 11:32:52 +0200
tnelson at fudnet dot info writes:
> I used <spoofmac>01:23:45:67:89:0a</spoofmac> for an interface

Bad idea.  The principal reasons why FF:FF:FF:FF:FF:FF does not work is that
 a) The group addressing bit (01:00:00:00:00:00) is set (used for
broadcast etc.).
 b) Multiple adapters use the same MAC address.

With your new MAC address, you're still violating point a.

I'd recommend using "FE:xx:xx:...".  That both clears the group flag
(0x1) and sets the locally-administered (aka custom mac) flag (0x2).

Some people say that FE:FD:xx:... is reserved by IEEE for private use,
but I haven't been able to validate this as a fact.  Anyway, not a bad
prefix to use either.

You can also do what I did and just grab the original MAC address.

For example, use the IPSO boot manager.  Grab the first couple of
megabytes off another IPSO box, dd it to your box.  Boot it and press
any key when it's loading.  Type in 'sysinfo' and it will tell you the
original MAC address(es).

Another options is to boot a Linux kernel.  The Linux driver also
correctly sees the MAC address(es).