To change the MAC address of an Ethernet interface

It is rarely necessary to change the MAC address of an Ethernet interface because for most purposes any unique address will suffice. (Unlike IP addresses, there is no requirement for the addressing scheme to reflect the topology of the network.) However there are circumstances which require the use of a specific address, or alternatively, a randomly-chosen address. These include:

• use of a service that has been locked to a particular MAC address;
• participation in a failover or load balancing scheme that requires use of the same MAC address on multiple interfaces;
• anonymous use of a network where MAC addresses are logged.

The ability to change the MAC address of an interface is dependent on support being provided by the relevant device driver. Most drivers do this, but there are some which do not.

If the MAC address of an interface is capable of being changed then this can be done using the ifconfig command:

ifconfig eth0 hw ether 02:5d:6c:e8:8d:b2

or try:

ifconfig en0 lladdr aa:bb:cc:11:22:33

The new address will not persist beyond a reboot.

If you are inventing a new MAC address for an interface (as opposed to mimicing an existing one) then be aware that two of the bits in the address have special meanings:

• The least significant bit of the first byte is set to zero for unicast addresses or one for multicast addresses.
• The second least significant bit is set to zero for globally unique addresses (which would typically be assigned by hardware manufacturers) or one for locally administered addresses.

For a locally administered unicast address these bits should be set to zero and one respectively. It follows that the first byte of the address should end with 2, 6, A or E when expressed in hexadecimal.

You can verify that the interface has been configured with the intended MAC address using the ifconfig command:

ifconfig eth0

The MAC address is labelled HWaddr in the output from this command:

eth0      Link encap:Ethernet  HWaddr 02:5d:6c:e8:8d:b2
          inet addr:192.168.0.2  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:9659 errors:0 dropped:0 overruns:0 frame:0
          TX packets:309 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2783810 (2.6 MiB)  TX bytes:25318 (24.7 KiB)

You can verify that the interface is using the intended MAC address by generating some inbound and outbound network traffic then inspecting the resulting Ethernet headers. The traffic can be inspected using tcpdump:

tcpdump -i eth0 -e -n "icmp and host 192.168.0.2"

The options used here are:

• -i to specify the interface name,
• -e to enable the display of link-layer headers, and
• -n to display IP addresses numerically.

The filter restricts the output to ICMP traffic addressed to or from the local machine.

While tcpdump is running, generate some ICMP traffic using the ping command. Assuming that there is a machine that responds to ping at 192.168.0.1:

ping 192.168.0.1

The output from tcpdump should show the new MAC address as the link layer source address for echo requests, and as the destination address for echo replies:

16:28:08.574438 02:5d:6c:e8:8d:b2 > 02:a2:e3:40:d7:29, ethertype IPv4 (0x0800), length 98:
 192.168.0.2 > 192.168.0.1: ICMP echo request, id 2919, seq 1, length 64
16:28:08.574591 02:a2:e3:40:d7:29 > 02:5d:6c:e8:8d:b2, ethertype IPv4 (0x0800), length 98:
 192.168.0.1 > 192.168.0.2: ICMP echo reply, id 2919, seq 1, length 64

The error:

SIOCSIFHWADDR: Operation not supported

indicates that the hardware address for the specified interface cannot be changed. This could be because the interface does not have a hardware address, or because the ability to change the address has not been implemented by the relevant device driver.

The error:

SIOCSIFHWADDR: Cannot assign requested address

probably indicates that the requested MAC address is not a unicast address. (To qualify as a unicast address the first byte must be even.)

The error:

SIOCSIFHWADDR: Device or resource busy - you may need to down the interface

probably indicates that the relevant device driver does not allow the MAC address to be changed while the interface is up.