Change or spoof a MAC address in Windows

Posted on September 11, 2008 at 5:43 am

Every network interface card (NIC) has a unique MAC Address (Media Access Control address). This applies to all types of network cards, including Ethernet cards and WiFi cards. The MAC Address is a six-byte number or 12-digit hexadecimal number number that is used to uniquely identify a host on an Ethernet network.

An example of a MAC address is 1F-2E-3D-4C-5B-6A and it falls into the Layer 2 networking protocol of the OSI model. In today’s networks, a MAC address is converted to a Layer 3 protocol address, such as an IP address, by ARP, or Address Resolution Protocol. Read my post on how to find your MAC address if you don’t know it.

All MAC Addresses are hard-coded into a network card and can never be changed. However, you can change or spoof the MAC address in the operating system itself using a few simple tricks.

So why would you want to change your MAC address? Well there are many reasons for this, mostly related to bypassing some kind of MAC Address filter set on a router or firewall. Changing the MAC Address can help to get you past some type of network restriction by emulating an unrestricted MAC Address or to get access by spoofing a MAC address that is already authorized.

For example, a WiFi network may allow only authorized computers to connect to the network and filters based on MAC address. If you can sniff out a legitimate MAC Address, you can then spoof your MAC address and gain access to the WiFi network.

Another example is if you have an ISP that allows only a certain number of computers to connect to the Internet from your home. If you have more computers that need to connect, you can spoof the MAC address of an authorized computer and connect from a different computer.

You can change the MAC Address on your network card pretty easily following the steps below:

Step 1: Click on Start, then Control Panel, then Network Connections, and right-click on the network connection you want to change the MAC address for and select Properties. It will normally either be Local Area Connection or Wireless Network Connection.

If you are using Windows Vista, you have to go to Control Panel, then Network and Internet, then Network and Sharing Center, and then Manage Network Connections.

Step 2: On the General tab, click the Configure button

Step 3: Now click on the Advanced tab and click on the “Locally Administered Address” property or the “Network Address” property.

By default, the “Not Present” value is selected. Go ahead and click on the Value radio button and enter in a new MAC address. The MAC address is a combination of 6 pairs of numbers and characters, i.e. 40-A2-D9-82-9F-F2. You should enter the MAC address without the dashes.

You can check that the MAC address has been changed by going to the command prompt and typing in IPCONFIG /ALL. Go ahead and restart the computer in order for the changes to take effect.

This is the simplest way to change your MAC address in Windows. You can also do so via the registry, but it’s much more technical and probably not required by most people.

Enjoyed this post? Subscribe to Online Tech Tips via RSS Feed or via Email and receive free daily productivity tips.

» Filed Under Computer Tips

Save this page	Stir it up on Mixx
Add to Reddit	Stumble this page

22 Responses to “Change or spoof a MAC address in Windows”

Dave said on : September 11th, 2008 at 8:34 am

In WinXP Home, I don’t see the “Locally Administered Address”.

Does this technique only work on certain versions of windows?

akishore said on : September 11th, 2008 at 8:46 am

Dave, you should be able to change the MAC address on any version of Windows. If you don’t see Locally Administered Address, do you see an option called Network Address?

Andy said on : September 11th, 2008 at 9:12 am

ok…So can I change it back to its original after this change?
Thanks

Dave said on : September 11th, 2008 at 9:13 am

I see 3 choices in that dialog:

802.1p QOS
Flow Control
Speed & Duplex
Wake Up Capabilities

That’s all

akishore said on : September 11th, 2008 at 9:17 am

Andy, yes you can change it back to the original MAC address by simply selecting the “Not Present” option.

Dave, do you have the most up to date driver for your network card? Try to download the latest driver and then let me know if the option is still missing.

Dave said on : September 11th, 2008 at 9:22 am

I’m not sure if I have the most current driver, but changing something that works is not an idea I like.

I’ve had bad things happen when I’ve upgraded stuff that worked.

I think I can live without the spoof.

But thanks for trying.

Angelo R. said on : September 11th, 2008 at 10:43 am

Actually, not all network cards offer this service. Some do, but for most, you’ll have to work with the registry to change it. Since most people are uncomfortable working with the registry, there are a few free tools available.

Also, just changing your MAC address to a random string most likely won’t work. The best thing to do, is to scan a network for valid ip’s and then steal one of their MAC’s.

I posted a quick way to do this a couple days ago:
http://xangelo.nookish.com/200.....-bad-idea/

Dave said on : September 11th, 2008 at 10:59 am

Thanks for the instructions.

Angelo R. said on : September 11th, 2008 at 11:07 am

The program macshift should work for you regardless if your card supports changing it’s MAC address through a windows dialog.

Joel Haasnoot said on : September 11th, 2008 at 11:57 am

This is indeed driver specific. Some drivers do, others don’t support this.

Nicolai X said on : September 11th, 2008 at 12:31 pm

This is actually quite easy, simple, and difficult to screw up.

I use SMAC 2.0 when I need access to a critical network or database, but as this method is much simpler and requires no external hardware, I give it top rating.

A note - entering random digits might not be the best way to generate a key - I’d suggest learning hexadecimal code/representation before randomly typing keys, as sometimes this can deny you access.

Keith Dsouza said on : September 11th, 2008 at 12:35 pm

This is a good trick, back home in India my ISP restricted access to only certain Mac Addresses so when I had to use another one I would simply change the MAC address of the PC to the one where Internet worked.

And it used to allow me to login and access Internet from multiple computers.

Eric Blue said on : September 11th, 2008 at 12:40 pm

I’ve been using a program called SMAC (http://www.klcconsulting.net/smac/) for at least 3-4 years now. The technique you described works. But, the beauty of SMAC is that it doesn’t require a reboot.

Transcontinental said on : September 11th, 2008 at 12:55 pm

Is it possible that a MAC address be inconsistent otherwise than not being a combination of 6 pairs of numbers and characters ? I mean, just for the story, must those 6 pairs correspond to a criteria, could I for instance choose them random ?

Angelo R. said on : September 11th, 2008 at 2:08 pm

@Transcontinental: No it can’t. MAC Addresses are hardware creator specific. So random characters will not result in a proper worked MAC Address.

@Eric Blue: Changing your MAC Address normally require you to reboot your system. At most, you might be required to disable/enable your network card for it to run again.

Madhur Kapoor said on : September 11th, 2008 at 10:53 pm

Great Tutorial. Will come in handy later

Nat said on : September 12th, 2008 at 12:16 am

Worked

Bob said on : September 12th, 2008 at 9:27 am

It looks to me like it’s dependent on the adapter.

Angelo R. said on : September 12th, 2008 at 10:55 am

@Bob - The method outlined in the post IS nic specific. Not all cards support changing your MAC through XP.

JAB_au said on : September 15th, 2008 at 9:32 pm

This is dependant on the NIC Drivers, not all drivers will have the same set of advanced options and the naming can be different.

There is another method that is NIC independent, Method 2 at the link bellow
http://www.nthelp.com/NT6/change_mac_w2k.htm

Jeff said on : September 17th, 2008 at 8:27 pm

1. Whether or not you have “Locally Administered Address” in the property panel of your NIC is dependent on a registry entry. It is possible to add this for any NIC. I had this issue with one WiFi card, and exported the registry entries from a different card, and hand edited it in for the card that was lacking them in the registry. All NICs can have their address changed; most had DOS utils back in the day for doing this.

2. Any valid Hex number (00-FF) will work in each slot, but it’s possible that the AP or DHCP server could refuse to connect.

3. “F0C0FFF0C0FF” will work, unless the AP/DHCP server is somehow set as described above.

4. I used this method all the time when parking my semi at truck stops that offered (pay) WiFi. Works in airports and any place using only mac addresses for authorization.

Jeff