I want to find the real mac address of a host that is using mac randomization. Is there a tool that can help me discover its real mac address?
Things I've tried:
- Modifying my system's arp table and using arping to bruteforce search for the host (I know the manufacturer of the wireless card and thus the first three bytes of the hidden MAC address), but that didn't work when I tested it on my machine. Probably wireless cards don't respond when configured with a different mac address, or maybe the access point drops the packet. I don't know.
Any guidance would be appreciated.