How to spoof a MAC address on OS X Lion 10.7 (and probably Leopard)

It used to be a little easier to do before Leopard (10.5), but you can still spoof a MAC address rather easily in OS X Lion. If you don’t know why you’d want to spoof a MAC address then you probably don’t want to be doing it, but there are plenty valid reasons why you’d want to do so. Here are some steps on how to fake your address to the example MAC address of fa:ca:dd:fa:ca:dd, and there’s a more detailed description of each step below if you’re interested. Stuff marked like this should by typed into Terminal.

1. Decide which network interface you want to spoof, this is probably en0 or en1, remember which one you pick. I’ll assume you are using en1 for the remaining steps.
2. ifconfig Take a note of your current MAC address for your interface (en0 or en1) in case you want to revert later (but don’t worry if you forget, a reboot will always revert it to the real MAC address anyway).
3 (Wi-Fi only). sudo /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport -z
4 (Wi-Fi only). Wait about 10 seconds
5. sudo ifconfig en1 ether fa:ca:dd:fa:ca:dd

* Note if you want to know the MAC addresses of other devices already on the network you can view the arp table by doing…

arp -a

More detail on the steps for those who like to know what’s going on…

(1) Firstly, identify which network interface you want to change, the wired connection or the Wi-Fi. If you have both then they are most likely en0 for wired and en1 for Wi-Fi. If you only have one, such as the MacBook Air that only has Wi-Fi, then it’s probably en0. You can see a list of your network interfaces by typing ifconfig into Terminal. Alternatively, launch the Network Utility app in the Application/Utilities and you’ll see them in the drop-down list there.

(2) Regardless of whether you use ifconfig or Network Utility you’ll see the MAC address listed so take a note of it so that you can revert back later. By the way, if you forget it your machine will always revert to the true MAC address when you reboot anyway so don’t worry.

(3) The next step is to use the airport command to disassociate completely. This is necessary because if you try to set it to fake a MAC address and you are already connected to a network then the change probably won’t take affect. The command you use to do this is /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport. If you are going to be doing this a lot though then you may want to create a symbolic link to the command so you don’t have to keep typing the full path. To do that type in…

sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport /usr/sbin/airport

After that you you can just type ‘airport’ from then on instead of typing the full path. So now to disassociate you just type…

sudo airport -z

(4) Even if your Wi-Fi icon goes grey immediately you should still wait 5-10 seconds to make sure it is fully disconnected before proceeding.

(5) This command is the one that tells OS X to pretend that the interface has a different MAC address.  At this point you probably want to check that the change has actually worked.  The easiest way to do this is to type the following and check that one of the results is the fake MAC you just set…

ifconfig | grep ether

  • matt

    Is it possible to permanently change the MAC address? I don’t want to apply the change after every startup.

    • marek

      You could try creating a startup script with the commands inside (take a look at http://hintsforums.macworld.com/archive/index.php/t-6303.html for how to do this). However, I’m not 100% sure this would work if you are doing it for Wi-Fi because the commands would have to run before Wi-Fi connected and I’m not sure this would happen… that is, I think the script would end up executing after Wi-Fi had already connected. It would probably work, but you’d have to tap the Wi-Fi icon in the menu bar and reconnect it to the Wi-Fi yourself.

  • I tried to put this into a Cocoa GUI: https://github.com/funkensturm/LinkLiar

    Maybe it helps? PS: In my experience I can change the MAC address even while I’m conntected to a WLAN. man ifconfig says:

    If the interface is already up when this option is used, it will be briefly brought down and then brought back up again

    • marek

      Fantastic! Great idea. However, a couple of small bugs. The project wouldn’t build because both ARC and garbage collection were on together and the compiler states that isn’t valid (was fine after I changed the setting). And also when my wifi is on the change doesn’t seem that reliable; sometimes it works and sometimes it doesn’t.

      • I hear this “sometimes it works and sometimes it doesn’t” a lot 🙂 Maybe we can go bughunting and find a pattern… This might be a starting point: https://github.com/funkensturm/LinkLiar/issues/3

        PS: It’s the weirdest thing, I know that ARC doesn’t work on 64-bit Preference Panes, but my X-Code happily compiles it… There is a pre-compiled version in the download section on github which seems to work fine.