2

Recently I noticed that when I connect through wireless, my NIC change MAC address...

Here's my ip addr BEFORE the connection:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp0s31f6: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether c8:5b:76:xx:xx:xx brd ff:ff:ff:ff:ff:ff
3: wlp4s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether fe:96:23:xx:xx:xx brd ff:ff:ff:ff:ff:ff

Here's my ip addr AFTER the connection:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp0s31f6: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether c8:5b:76:xx:xx:xx brd ff:ff:ff:ff:ff:ff
3: wlp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether f4:8c:50:yy:yy:yy brd ff:ff:ff:ff:ff:ff
    inet 192.168.9.100/24 brd 192.168.9.255 scope global dynamic wlp4s0
       valid_lft 86391sec preferred_lft 86391sec
    inet6 fe80::f68c:50ff:feyy:yyyy/64 scope link 
       valid_lft forever preferred_lft forever

Note that the wireless card change all of its MAC address, not just the last 3 bytes...

I installed macchanger, but when prompted I refused to change MAC address for each connection, so I'm sure it is not him! Also, the MAC address I get when I connect is always the same and the first 3 bytes suggest it is an Intel's NIC which is right.

Is that possible? And how?

Am I missing something?

  • fe:96:23 is not a known OUI. – Ignacio Vazquez-Abrams Dec 10 '17 at 9:36
  • I just made a copy+paste – ingroxd Dec 10 '17 at 12:25
  • @IgnacioVazquez-Abrams It doesn't need a known OUI in order to be valid. The first byte fe even has the "locally administered" bit set to indicate that it's randomly generated. – grawity Dec 10 '17 at 12:28
4

For privacy reasons, various operating systems have started assigning random MAC addresses to avoid client tracking between networks. Depending on the OS, you might get a random MAC when connected (usually stable for a given network), or a random MAC when scanning for networks (to disguise the probe requests), or both.

I'm guessing you use NetworkManager. Address randomization when scanning can be disabled via /etc/NetworkManager/NetworkManager.conf:

[device]
wifi.scan-rand-mac-address=no

Address randomization for connections can be disabled using:

[connection]
ethernet.cloned-mac-address=permanent
wifi.cloned-mac-address=permanent

To adjust existing connections:

$ nmcli connection modify "My Wi-Fi" wifi.cloned-mac-address permanent

It's further described in a developer's blog post.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.