0

I want to find the real mac address of a host that is using mac randomization. Is there a tool that can help me discover its real mac address?

Things I've tried:

  • Modifying my system's arp table and using arping to bruteforce search for the host (I know the manufacturer of the wireless card and thus the first three bytes of the hidden MAC address), but that didn't work when I tested it on my machine. Probably wireless cards don't respond when configured with a different mac address, or maybe the access point drops the packet. I don't know.

Any guidance would be appreciated.

1 Answer 1

3

Probably not.

Even if randomized or manually changed, the MAC address that a system is currently using becomes its "real" address for the duration. That is, the new address isn't "emulated", but fully replaces the original MAC address in both the OS and the wireless adapter's firmware (in RAM) – the WLAN firmware no longer uses the original address for any purpose and the OS network stack no longer recognizes the original address as belonging to the local system.

(The only difference between is that the randomization procedure doesn't reprogram the wireless interface's EEPROM, so the new address stays temporary and would be reset after a power cycle, while the "real" address is re-read from EEPROM every time.)

3
  • 1
    and, I mean, that's kind of the whole point of MAC address randomization, isn't it? Dec 28, 2022 at 8:17
  • Additional consideration is that wireless station authenticates to the access point using its current MAC, and the AP will not let any packets from client if the source MAC is not the MAC that has been authenticated. There is simply no place for additional "client" MACs in 802.11 protocols. Dec 28, 2022 at 8:44
  • So I take it the permaddr entry in the output of ip addr is just there for informative purposes and is not used once the randomized mac address is set? Dec 28, 2022 at 9:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .