Arch Linux

alfredino

Member

Registered: Yesterday

Posts: 9

MAC address spoofing

Hello,
I followed your guide about how to mask MAC address and I decided to use the Network Manager solution https://wiki.archlinux.org/title/MAC_ad … orkManager
It works pretty well with both random and stable version
nethernet.cloned-mac-address=random
wifi.cloned-mac-address=stable | random
My questions is related to the possibility to have a custom option for a specific network. I need this because in some WiFi, there is not password protection and the authentication is done by the pair MAC address-password.
Thank you

V1del

Forum Moderator

Registered: 2012-10-16

Posts: 25,383

Re: MAC address spoofing

Note the second to last sentence in the section you linked

To configure MAC randomization for a specific connection (for example, if the network does not like random MAC addresses), edit the connection to set 802-11-wireless.cloned-mac-address to one of the modes (e.g. stable or random).

where "edit the connection" links to https://wiki.archlinux.org/title/Networ … connection

alfredino

Member

Registered: Yesterday

Posts: 9

Re: MAC address spoofing

Note the second to last sentence in the section you linked

To configure MAC randomization for a specific connection (for example, if the network does not like random MAC addresses), edit the connection to set 802-11-wireless.cloned-mac-address to one of the modes (e.g. stable or random).

where "edit the connection" links to https://wiki.archlinux.org/title/Networ … connection

Correct. I can change the property to stable from GUI, but I am not sure how to make it via config files. My folder is empty /etc/NetworkManager/system-connections/.

mithrial

Member

Registered: 2017-03-05

Posts: 169

Re: MAC address spoofing

You need root privileges to read and list that directory.

alfredino

Member

Registered: Yesterday

Posts: 9

Re: MAC address spoofing

You need root privileges to read and list that directory.

Right, but it is empty. Do you have any suggestion about how to solve it? Any example?
Thank you

-thc

Member

Registered: 2017-03-15

Posts: 1,196

Re: MAC address spoofing

What's displayed when you enter

nmcli c

?

alfredino

Member

Registered: Yesterday

Posts: 9

Re: MAC address spoofing

What's displayed when you enter

nmcli c

?

The list of network/WiFi (name, UUID, type). Can I customize the configuration so just 1-2 of these WiFi use stable and the rest random?

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,826

Re: MAC address spoofing

https://bbs.archlinux.org/viewtopic.php … 8#p2309768

sudo  nmcli -f NAME,DEVICE,FILENAME connection show

Edit: post the output verbatim, not "it shows things"

Last edited by seth (Yesterday 13:59:13)

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

-thc

Member

Registered: 2017-03-15

Posts: 1,196

Re: MAC address spoofing

The list of network/WiFi (name, UUID, type). Can I customize the configuration so just 1-2 of these WiFi use stable and the rest random?

That's remarkable. How can NetworkManager list all those WiFi connections and "/etc/NetworkManager/system-connections" is empty? Can somebody explain this?

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,826

Re: MAC address spoofing

Transient profiles in /var/run, command in #8 will tell…

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

-thc

Member

Registered: 2017-03-15

Posts: 1,196

Re: MAC address spoofing

Thanks  - never stumbled across transient NM profiles before.

I presume this is where "temporary" changes to NM profiles go? Yes. Just tested it.

Last edited by -thc (Yesterday 14:55:03)

alfredino

Member

Registered: Yesterday

Posts: 9

Re: MAC address spoofing

https://bbs.archlinux.org/viewtopic.php … 8#p2309768

sudo  nmcli -f NAME,DEVICE,FILENAME connection show

Edit: post the output verbatim, not "it shows things"

Sorry, I reported just a few lines:

sudo  nmcli -f NAME,DEVICE,FILENAME connection show

OLINKO-OF7590013                 --            /run/NetworkManager/system-connections/netplan-NM-0c604421-54ef-44e2-8d28-a554c2d2b263-OLINKO-OF75>
Orange-h57EXx-2G-2.4G-ext        --            /run/NetworkManager/system-connections/netplan-NM-43d2f525-5c71-4e15-b79e-a997237b225a-Orange-h57E>
Orange Wi-Fi                     --            /run/NetworkManager/system-connections/netplan-NM-bbec9122-8c23-4b48-847c-4824530a788c-Orange%20Wi>

ls /etc/NetworkManager/system-connections/

For instance, if I want to config mac randomization as stable for Orange Wi-Fi, how can I do?
Thank you

Last edited by alfredino (Yesterday 15:36:02)

V1del

Forum Moderator

Registered: 2012-10-16

Posts: 25,383

Re: MAC address spoofing

Which utility do you use to interact with networkmanager? Chances are if not enabling system profile they might store it differently, e.g. plasma-nm will store minimally secrets in kwallet, potentially even entire connection metadata (which might be where you want to look if that happens to be what you're using) and they might expose this setting within their UI and should probably be changed there

Last edited by V1del (Yesterday 16:15:42)

alfredino

Member

Registered: Yesterday

Posts: 9

Re: MAC address spoofing

I am using mate desktop with network-manager-gnome package. I followed the instructions written by arch linux (first post) and using them via a crontab.

[device-mac-randomization]
wifi.scan-rand-mac-address=yes
 
[connection-mac-randomization]
ethernet.cloned-mac-address=random
wifi.cloned-mac-address=random

@reboot systemctl status NetworkManager

Beemo

Member

Registered: 2024-12-20

Posts: 137

Re: MAC address spoofing

Looking at the filenames, are you using netplan? Since the NM profile is runtime-generated, modifying the file directly probably won't stick.
netplan does have a macaddress setting: https://netplan.readthedocs.io/en/lates … vice-types
The config is in /etc/netplan/

Last edited by Beemo (Today 14:02:46)

alfredino

Member

Registered: Yesterday

Posts: 9

Re: MAC address spoofing

Not sure, but I do not think so. Otherwise, why does network manager configuration work well as I described in my first post? I do not know how to customize it for a specific network.

ls /etc/netplan/
01-network-manager-all.yaml                      90-NM-5b8970c6-75d5-468a-b2a4-fa86c16513e1.yaml  90-NM-b17f33b3-f9e3-4ede-86ad-c5e26d6d3841.yaml
50-cloud-init.yaml                               90-NM-5c76370f-e830-4e21-ac06-2220203563d6.yaml  90-NM-bb7562ba-75f5-409b-ae3e-6272e02e641a.yaml
90-NM-0901b545-d58c-418f-a994-18468a893c57.yaml 

cat /etc/netplan/01-network-manager-all.yaml 
# Let NetworkManager manage all devices on this system
network:
  version: 2
  renderer: NetworkManager

Last edited by alfredino (Yesterday 18:00:52)

Beemo

Member

Registered: 2024-12-20

Posts: 137

Re: MAC address spoofing

netplan can use NM as the backend / "renderer".
I just checked on Ubuntu MATE (where netplan is the top level), it seems at first the connection profile is purely transient*, but you can trigger netplan to create a file in /etc/netplan/ by changing the NM profile in any way. E.g.

$ nmcli con mod "Orange Wi-Fi" wifi.cloned-mac-address permanent

(Or you could always write the netplan config yourself)

* Since I tested it in a VM, I couldn't test Wi-Fi. I'd thought having username & password would warrant an on-disk netplan config, but maybe not.

Last edited by Beemo (Yesterday 19:28:01)

V1del

Forum Moderator

Registered: 2012-10-16

Posts: 25,383

Re: MAC address spoofing

Why do you need access to the actual file? If you use nmcli to manipulate the property, does that not stick across reboots? Is this even an Arch install?

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,826

Re: MAC address spoofing

If the profile is runtime created by something™ you'll have to rely on the config options of something™ to impact that ahead.
You could probably turn them into static profiles using https://wiki.archlinux.org/title/Networ … et_on_boot (nb. the impact on password security, notably when not using https://wiki.archlinux.org/title/Data-a … encryption )

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Beemo

Member

Registered: 2024-12-20

Posts: 137

Re: MAC address spoofing

Because the OP asked

I can change the property to stable from GUI, but I am not sure how to make it via config files

The 2nd point is fair, I'll modify my answer.
The 3rd one is for OP, but my guess is no... (seeing 50-cloud-init.yaml which is something Ubuntu has) Though Arch does have the netplan package so maybe it's still a useful answer.

-thc

Member

Registered: 2017-03-15

Posts: 1,196

Re: MAC address spoofing

I revisited this thread and noticed the OP saying explicitly

I followed your guide about how to mask MAC address and I decided[...]

Since the TO doesn't know which network management is used

Not sure, but I do not think so.

I've come to the conclusion that the TO uses some Ubuntu variant (which uses netplan) and asked that question because of the information found in the Arch Wiki.

Last edited by -thc (Today 06:41:04)

alfredino

Member

Registered: Yesterday

Posts: 9

Re: MAC address spoofing

I revisited this thread and noticed the OP saying explicitly

I followed your guide about how to mask MAC address and I decided[...]

Since the TO doesn't know which network management is used

Not sure, but I do not think so.

I've come to the conclusion that the TO uses some Ubuntu variant (which uses netplan) and asked that question because of the information found in the Arch Wiki.

Exactly, I use several OS, in particular ubuntu mate, debian with mate and arch linux with mate (I am old style). After reading the arch linux documentation, I chose that way to have a MAC randomization. Do you have other suggestions? It works well for all networks, except for those that require a fixed MAC. So I asked how to have a custom stable MAC address only for them. I received many replies, but not really useful. Maybe I chose the wrong forum.
Thank you

Last edited by alfredino (Today 11:16:59)

-thc

Member

Registered: 2017-03-15

Posts: 1,196

Re: MAC address spoofing

It has been answered - see #17.

If you use Ubuntu or Debian this is the wrong forum.

alfredino

Member

Registered: Yesterday

Posts: 9

Re: MAC address spoofing

It has been answered - see #17.

If you use Ubuntu or Debian this is the wrong forum.

Ok

cryptearth

Member

Registered: 2024-02-03

Posts: 2,334

Re: MAC address spoofing

counter-question: why have you come to the conclusion to use randomized mac?
a mac is already something used only at very low levels to enable communication in the first place because a network is usually more tgan one single point-to-point connection hence there need to be something to uniquily identify sender and recipient within a network
and with just 48 bits and how mac addresses are usually organized even with randomization that space is limited
in fact: randomization can cause issues: it can cause unknown vendor identifiers or collisions - with using the physical nic one can be sure it's both valid and won't cause collisions

if you think about privacy: nah, forget it - your device and you as its user get fingerprinted all over they layers - in fact: using randomization can make you an even more interesting target: imagine a starbucks with a bad actor - he sees the same people every day - and the same devices - but everytime you show up it looks like you have a new phone - yet it's clearly the same you used for tge past year - why?
THAT's the way an attacker thinks: WHY? do you use randomization? and why is all your traffic only with one single IP (vpn)? what you hiding?
that's when you get on thier list and how you become a target - because you may hide something worth the effort of attack