Is it possible for other hosts in the (wired or wireless) network to detect original MAC address? After changing mac address capturing traffic shows that indeed not-original mac is sent, but I am not sure that there are other ways (may be on hardware layer) to detect original mac.

I have read information that some persons were revealed to change their mac and were prosecuted in the US (note, they were not prosecuted for spoofing per se, but for illegal activities, part of which was changing mac).

  • I'm a little confused. By original MAC, you mean the MAC on the hardware before someone spoofs it? – schroeder Jan 28 '17 at 8:16
  • Yes. Is there other meaning of "original MAC" in the context of MAC spoofing other than hardware MAC? – user137627 Jan 28 '17 at 8:38
  • It's not clear that you are actually talking about spoofing in your first paragraph. You could also mean if someone changed the NIC they used. You mean to say "hardware MAC". – schroeder Jan 28 '17 at 8:41
  • Short answer is 'no'. The networking stack (software) adds this info into packets it sends. – schroeder Jan 28 '17 at 8:43
  • no, there are no "extra copies" of the mac. if you're changing it under observation, that can be correlated, but if you show up for the first time with a spoof, the orig is not determinable. – dandavis Jan 29 '17 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy