It used to be a little easier to do before Leopard (10.5), but you can still spoof a MAC address rather easily in OS X Lion. If you don’t know why you’d want to spoof a MAC address then you probably don’t want to be doing it, but there are plenty valid reasons why you’d want to do so. Here are some steps on how to fake your address to the example MAC address of fa:ca:dd:fa:ca:dd, and there’s a more detailed description of each step below if you’re interested. Stuff marked
like this should by typed into Terminal.
1. Decide which network interface you want to spoof, this is probably en0 or en1, remember which one you pick. I’ll assume you are using en1 for the remaining steps.
ifconfig Take a note of your current MAC address for your interface (en0 or en1) in case you want to revert later (but don’t worry if you forget, a reboot will always revert it to the real MAC address anyway).
3 (Wi-Fi only).
sudo /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport -z
4 (Wi-Fi only). Wait about 10 seconds
sudo ifconfig en1 ether fa:ca:dd:fa:ca:dd
* Note if you want to know the MAC addresses of other devices already on the network you can view the arp table by doing…
More detail on the steps for those who like to know what’s going on…
(1) Firstly, identify which network interface you want to change, the wired connection or the Wi-Fi. If you have both then they are most likely en0 for wired and en1 for Wi-Fi. If you only have one, such as the MacBook Air that only has Wi-Fi, then it’s probably en0. You can see a list of your network interfaces by typing
ifconfig into Terminal. Alternatively, launch the Network Utility app in the Application/Utilities and you’ll see them in the drop-down list there.
(2) Regardless of whether you use ifconfig or Network Utility you’ll see the MAC address listed so take a note of it so that you can revert back later. By the way, if you forget it your machine will always revert to the true MAC address when you reboot anyway so don’t worry.
(3) The next step is to use the airport command to disassociate completely. This is necessary because if you try to set it to fake a MAC address and you are already connected to a network then the change probably won’t take affect. The command you use to do this is /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport. If you are going to be doing this a lot though then you may want to create a symbolic link to the command so you don’t have to keep typing the full path. To do that type in…
sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport /usr/sbin/airport
After that you you can just type ‘airport’ from then on instead of typing the full path. So now to disassociate you just type…
sudo airport -z
(4) Even if your Wi-Fi icon goes grey immediately you should still wait 5-10 seconds to make sure it is fully disconnected before proceeding.
(5) This command is the one that tells OS X to pretend that the interface has a different MAC address. At this point you probably want to check that the change has actually worked. The easiest way to do this is to type the following and check that one of the results is the fake MAC you just set…
ifconfig | grep ether