If a MAC filter prevents you from connecting to a network, how can you break it or include your device's MAC in that filter?
As other pointed, you first need to snoop existing mac addresses (using wireshark) and spoof them. Except that :
- You probably will not get significant packets if you plug your device behind a switch (due to the way switches function).
- You probably will not get any packets at all if the MAC filtering function is provided by a switch that filters by MAC and by port. Which means the MAC addresses are expected behind a specific switch port.
Some university admins are using this technique to prevent an uncontrolled jungle in the students network. You first need to register you MAC and your room number, otherwise your RJ45 plug is pretty useless.
A quote the manual HP switch Port Security feature :
Prevent Eavesdropping -- Block outbound traffic with unknown destination addresses from exiting through the port. This prevents an unauthorized device on the port from eavesdropping on the flooded unicast traffic intended for other devices
Authorized Addresses -- Specify up to eight devices (MAC addresses) that are allowed to send inbound traffic through the port. This feature: Closes the port to inbound traffic from any unauthorized devices that are connected to the port. Automatically sends notice of an attempted security violation to the switch’s Intrusion Log and to the Alert Log.
You can use Wireshark to eavesdrop authorized MAC addresses of the devices allowed to connect to that network. The MAC addresses of your device can be easily changed (An option in Network Settings). Note that lot of Linux distributions allow you to chance the MAC address and sometimes manufacturers do mistakes by assigning the same MAC address to two or more devices. The presence of 2 MAC addresses in the same network won't cause any problem/warning that will prevent you from connecting.
It should also be noted that MAC addresses are not truly unique anyways. If you have a large enough network with the same NIC manufacturer there's a possibility you will get a natural collision.
That obviously gives 16 777 215 possible unique MAC addresses per manufacturer. That's quite alot, so the manufacturer shouldn't re-use one. Some are lazy though, and don't check if they have already allocated a MAC address.
It is quite often possible to change the MAC address using software, so if you do get a duplicate you can map around it.