change the MAC address

November 5, 2008 at 19:00:10
Specs: WinXP, Intel T7400 / 2G

is there anyway for a average PC user to change the MAC address? or at least, to show fake MAC address?

If there is a way, how do I identify the true MAC address?

Hello!


See More: change the MAC address

Report •


#1
November 5, 2008 at 19:57:00

What are you trying to achieve and which MAC address are you trying to change? A network card has a mac address. A router has a different mac address but it is common for a router to be able to clone/imitate the mac address of a PC connected to it. Such a function is useful when connecting to a cable internet connection where the ISP checks the MAC address of the connected computer.

In the case of the actual network card in your PC, to my knowledge the MAC address is hardwired and you could only change it by installing a different NIC.

Goin' Fishin' (Some day)


Report •

#2
November 5, 2008 at 20:08:03

You can change the MAC address of your network card realitly easily with software. In Windows XP and Vista, you can often change the MAC address in the Device Manager. If that fails, or is unavailable, there are many programs available such as http://www.codeproject.com/KB/appli...

-Ryan Adams
Free Computer Tips and more:http://RyanTAdams.com

Paid Tech Support: Black Diamond


Report •

#3
November 6, 2008 at 01:11:02

Can the change be caused by virus? I am asking this question because my company has several PCs encountering this situation for the past 2 months. I doubt the employees have this kind of knowledge, and also changing their PC MAC address will not accomplish anything because all the IPs and MAC addresses are bounded together.

Hello!


Report •

Related Solutions

#4
November 6, 2008 at 07:58:18

Can you go into a bit of detail as to what the problem is. We are addressing this backwards.

How have you identified a changed mac address?
what problems has a changed mac address caused you?

"also changing their PC MAC address will not accomplish anything because all the IPs and MAC addresses are bounded together."

Actually that is incorrect. If you are doing ip reservations which is where in the dhcp server you associate a mac to a ip if the mac is changed it will not get a ip address. Assuming you are doing all mac filtering.

Again you should explain the problem in its entirity.


Example of Oxymoron:

Person who is pro choice and anti sex education.
Education is key to prevention. Prevent conception you prevent abortion.

Abstinence training clearly isn't working.


Report •

#5
November 7, 2008 at 15:05:36

I have never heard of any malware changing a MAC address.

The normal situation, as Richard59 said, is:
" A network card has a mac address. A router has a different mac address but it is common for a router to be able to clone/imitate the mac address of a PC connected to it. Such a function is useful when connecting to a cable internet connection where the ISP checks the MAC address of the connected computer.

In the case of the actual network card in your PC, to my knowledge the MAC address is hardwired and you could only change it by installing a different NIC."

You could use some software method to change a networking adapter's MAC address, which I was not aware of before, e.g. referred to in response 2, but that's not necessary if you connect to the internet through a router.
.....

"Such a function is useful when connecting to a cable internet connection where the ISP checks the MAC address of the connected computer."

E.g.
I have an ADSL connection. My ISP allows up to two different MAC addresses to be registered for my connection. The first time I set up the ISP's software, one MAC address is registered automatically. If I want to add another MAC address, or change one, I can do that by going to a specific web site specified by the ISP, which works regardless of whether I can connect to the internet otherwise, as long as ADSL is enabled on my phone line (there has to be an ADSL device hooked up at the telephone exchange).

If I have two computers connected via a networking hub to the internet, the ISP can see both MAC addresses of the two networking adapters, and both must be registered - if I connect more than two networking adapters to the hub, only two at a time can have a registered MAC address and a working internet connection.
I believe the same applies to a networking switch box (that is not also a router).

Connecting via a router is different.

If I have a router between (a) networking adapter(s) and the internet connection, in my case via a separate ADSL modem, my ISP can only see the one MAC address the router allows it to see - that's either the router's own MAC address, or a MAC address of a networking adapter connected to the router that has already been registered can be "cloned" by accessing the router's configuration from the computer that has the networking adapter with the MAC address I want to clone, or you can often enter the already registered MAC address manually in the router's configuration.
In my case, I have fiddled with several routers, and they are all set to the same address as the networking card I originally connected to the internet with.

I can connect whatever computer's networking adapter I want to the router, as many as the number of ports allows, or I can connect more ports via hubs to the router, as long as the MAC address the ISP sees that the router gives it is one of the allowed registered ones. Similarly, if I change a networking adapter on a computer, that doesn't cause a problem despite the MAC address being different from the registered MAC address, as long as it connects to the internet through the router.

If you don't presently have a router, they are relatively cheap these days.
....

Where I am, if one uses a cable modem for the biggest ISP, it has a MAC address, but it also broadcasts a serial number - in that case you have to register the serial number. You can connect whatever networking adapter or hub or switch or router to the modem and not have to be concerned with the MAC addresses of the devices you connect at all.



Report •

#6
November 10, 2008 at 02:36:36

OK, you guys make this problem more complicate than I originally anticipated. The situation is like following:

I'm a MIS working in a company with about 100 PCs. Last year, we were infected with some kind of ARP virus. From that day, I record every PC's network card MAC address and some other PC info, like computer name and IP...etc and check every month. For the last 4 month, I found that some specific PCs' MAC address are different from previous month record.

I'm more concerned about what could be accomplished by changing the MAC address.

Like I said, I have setup a DHCP server and IPs are assigned by the MAC address. If one provide a MAC address which is not on the record, he won't get a valid IP.

Hello!


Report •

#7
November 10, 2008 at 05:22:45

Are your users' accounts in the Local Administrator Group? If so, you should remove them from that Group.

"So won’t you give this man his wings
What a shame
To have to beg you to see
We’re not all the same
What a shame" - Shinedown


Report •

#8
November 10, 2008 at 19:45:18

Is it possible there are some computers or network adapters that have been replaced, or there are routers in the network?

If some of them are recent, I've noticed some mboards these days have TWO built in wired network adapters/ports. It would be very easy for someone to plug a network cable into the other one rather than the one that has the MAC address you expect.


Report •


Ask Question