macchanger: A tool for changing the MAC address of network interfaces

If you’ve ever needed to spoof, randomize, or restore a network interface’s MAC address on Linux, chances are you’ve run into macchanger. I’ve used it for everything from testing MAC-based access controls in a lab to just wanting a bit of privacy on public Wi-Fi where networks track devices by hardware address. In this guide I’m walking through everything I know about macchanger — what it does under the hood, how to install and use it, real command output, and where it fits into a broader security or privacy workflow.

What Is Macchanger?

Macchanger is a small, focused Linux utility that lets you view and change the MAC (Media Access Control) address of a network interface. Every network interface card ships with a factory-assigned MAC address, often called the “burned-in address” (BIA), which is technically just a setting in the driver/firmware that the OS reads on boot. Macchanger works by rewriting this address at the OS level (it doesn’t physically alter the hardware) so that the interface presents a different MAC to anything on the local segment — switches, access points, DHCP servers, or anyone running a packet sniffer.

The tool ships as a simple GNU project maintained on GitHub, and it’s packaged in the default repositories of virtually every major Linux distribution, including Debian, Ubuntu, Kali, Arch, and Fedora.

Why MAC Addresses Matter

A MAC address is a 48-bit identifier, typically written as six pairs of hex digits (e.g. 00:1A:2B:3C:4D:5E). The first three octets (the OUI, or Organizationally Unique Identifier) identify the manufacturer — Apple, Intel, Cisco, etc. — while the last three octets are (in theory) unique to that specific device.

This matters for a few reasons:

• Network access control: Many corporate and even home networks use MAC filtering to restrict which devices can connect.
• Device tracking: Because MAC addresses are static and broadcast in every frame, they’re a convenient way for network owners (or attackers) to fingerprint and track a device over time, even across sessions.
• Captive portals: Some hotel/airport Wi-Fi networks tie your “free” time allowance to your MAC address.
• Penetration testing: Assessors frequently need to test whether MAC filtering is actually enforced, or need to impersonate an already-authorized device’s MAC as part of an authorized red team engagement.

Installing Macchanger

Macchanger is in the standard Ubuntu/Debian repositories:

sudo apt update
sudo apt install macchanger

On my test system this pulled in the package cleanly:

Setting up macchanger (1.7.0-5.4) ...

For other distros:

# Fedora / RHEL
sudo dnf install macchanger

# Arch Linux
sudo pacman -S macchanger

# From source (GitHub)
git clone https://github.com/alobbs/macchanger.git
cd macchanger
autoreconf -i
./configure
make
sudo make install

Verify the install:

macchanger --version

Output:

GNU MAC changer 1.7.0
Written by Alvaro Lopez Ortega <alvaro@gnu.org>

Copyright (C) 2003,2013 Alvaro Lopez Ortega <alvaro@gnu.org>.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Basic Syntax

macchanger [options] device

Full option list, straight from macchanger --help:

  -h,  --help                   Print this help
  -V,  --version                Print version and exit
  -s,  --show                   Print the MAC address and exit
  -e,  --ending                 Don't change the vendor bytes
  -a,  --another                Set random vendor MAC of the same kind
  -A                            Set random vendor MAC of any kind
  -p,  --permanent              Reset to original, permanent hardware MAC
  -r,  --random                 Set fully random MAC
  -l,  --list[=keyword]         Print known vendors
  -b,  --bia                    Pretend to be a burned-in-address
  -m,  --mac=XX:XX:XX:XX:XX:XX
       --mac XX:XX:XX:XX:XX:XX  Set the MAC XX:XX:XX:XX:XX:XX

Checking the Current MAC Address

Before changing anything, check what’s currently assigned with -s:

macchanger -s eth0

Real output from my test system:

Current MAC:   02:fc:00:00:00:01 (unknown)
Permanent MAC: 02:fc:00:00:00:01 (unknown)

The “Permanent MAC” line is what macchanger reads as the hardware-assigned address; “Current MAC” is whatever is presently active on the interface (which may differ if it’s already been spoofed).

Changing to a Fully Random MAC

The most common use case — generate a completely random MAC address:

sudo ip link set eth0 down
sudo macchanger -r eth0
sudo ip link set eth0 up

The interface has to be brought down first; the kernel won’t let you rewrite the hardware address of a live, up interface. Example output:

Current MAC:   02:fc:00:00:00:01 (unknown)
Permanent MAC: 02:fc:00:00:00:01 (unknown)
New MAC:       6a:91:3e:0c:77:2f (unknown)

Spoofing a Specific Vendor (Same Device Type)

If you want randomness but still want to look like the same category of device (e.g., still appear to be a laptop Wi-Fi card rather than something obviously different), use -a:

sudo macchanger -a eth0

This picks a random MAC whose OUI belongs to a manufacturer of the same device class as your card’s real vendor — useful when you want the change to be less conspicuous to a casual network admin glancing at a DHCP lease table.

-A does the same thing but ignores device class entirely and picks any known vendor OUI at random.

Setting a Specific MAC Address

To set an exact MAC of your choosing:

sudo ip link set eth0 down
sudo macchanger -m 00:11:22:33:44:55 eth0
sudo ip link set eth0 up

Output:

Current MAC:   6a:91:3e:0c:77:2f (unknown)
Permanent MAC: 02:fc:00:00:00:01 (unknown)
New MAC:       00:11:22:33:44:55 (unknown)

This is the mode used most often in authorized testing, when you need to impersonate a specific, known-good MAC address that’s already been whitelisted on a switch port or wireless controller.

Restoring the Original MAC

To undo all changes and go back to the hardware-burned address:

sudo ip link set eth0 down
sudo macchanger -p eth0
sudo ip link set eth0 up

Looking Up Vendor OUIs

Macchanger ships with a local database of vendor OUIs, which you can query directly:

macchanger --list=xerox

Misc MACs:
Num    MAC        Vendor
---    ---        ------

Wireless MACs:
...

Running macchanger -l with no argument dumps the entire known-vendor table — handy for scripting a lookup of which manufacturer owns a given OUI prefix without needing internet access.

How Macchanger Works Internally

Under the hood, macchanger is a thin, well-behaved wrapper around standard Linux networking syscalls. When you run it:

1. It opens a PF_PACKET (or ioctl-based, depending on build) socket to the kernel.
2. It issues an SIOCGIFHWADDR ioctl call to read the interface’s current hardware address.
3. To change the MAC, it issues SIOCSIFHWADDR, which most network drivers support as long as the interface is administratively down.
4. For -r/-a/-A modes, it generates the new address using its internal RNG and vendor OUI table (compiled from the IEEE OUI registry, bundled at /usr/share/macchanger/).

Because it relies on the driver honoring SIOCSIFHWADDR, macchanger doesn’t work on every adapter — some USB Wi-Fi chipsets and virtual interfaces reject hardware MAC changes at the driver level, in which case you’ll see an ioctl error rather than a successful change.

Real-World Use Cases (Authorized Testing Only)

All of the following assume you’re working in a lab you own or have explicit written authorization to test.

1. Testing MAC filtering enforcement Set up a router/AP with MAC allow-listing enabled, then use macchanger to spoof an allowed MAC from a different physical machine and confirm whether the AP actually blocks or admits the new device. This tells you whether MAC filtering is providing real security or just a false sense of it (spoiler: it’s almost always trivially bypassable, which is the whole point of demonstrating it to a client).

2. Wireless assessment workflows During an authorized wireless penetration test, you might need to rotate MAC addresses between deauth/probe cycles to avoid a single MAC being blacklisted by a WIDS/WIPS, or to test how a captive portal’s device-tracking behaves.

3. Privacy hardening on your own devices Randomizing your MAC each time you connect to public Wi-Fi (many modern OSes now do this automatically, but macchanger gives you manual, scriptable control on Linux) reduces long-term tracking by network operators.

4. Lab segmentation testing Simulating multiple “different” hosts from one physical NIC when testing DHCP scope exhaustion or NAC (Network Access Control) systems.

Automating with a Script

A simple boot-time or on-connect randomization script:

#!/bin/bash
IFACE="eth0"
ip link set "$IFACE" down
macchanger -r "$IFACE"
ip link set "$IFACE" up
echo "MAC randomized for $IFACE"

Save as /usr/local/bin/randomize-mac.sh, chmod +x it, and hook it into a systemd unit or NetworkManager dispatcher script if you want it to run automatically on every connection.

Integration with Other Tools

Macchanger is often the first step in a broader workflow rather than a standalone action:

• Paired with airmon-ng/aircrack-ng during authorized wireless assessments, changing the monitor-mode interface’s MAC before injection tests.
• Combined with nmap MAC-based OS/vendor fingerprinting tests, to see whether spoofing the OUI changes what nmap reports.
• Used alongside Responder or ettercap in a segmented lab to test how NAC and MAC-filtering respond when a rogue host on the LAN mimics the MAC of a trusted device.

Troubleshooting and Common Mistakes

• “Cannot change MAC: interface up” — you forgot to bring the interface down first with ip link set <iface> down.
• Change appears to succeed but reverts after reboot — this is expected; macchanger’s changes aren’t persistent across reboots unless you script it into startup (NetworkManager dispatcher, systemd-networkd, or a cron @reboot entry).
• “Error: Cannot set new MAC: Operation not permitted” — you’re not running as root; macchanger needs sudo/root privileges since it’s touching low-level interface configuration.
• NetworkManager silently resets your MAC — modern NetworkManager has its own wifi.cloned-mac-address / ethernet.cloned-mac-address settings that can override or fight with macchanger. Check nmcli connection show <name> and either disable NM management of the interface or configure MAC randomization through NM itself instead of macchanger.
• Some Wi-Fi chipsets simply refuse driver-level MAC changes — this is a hardware/driver limitation, not a macchanger bug; there’s no workaround short of a different adapter.

Best Practices

• Always confirm the change took effect with macchanger -s <iface> after any modification.
• Script the down/change/up sequence together to avoid leaving an interface administratively down.
• Document original MACs before testing so you can cleanly restore lab equipment to its baseline state afterward.
• Never spoof a MAC on a network you don’t own or have explicit authorization to test — in many jurisdictions, impersonating another device’s MAC to bypass access controls without permission can have legal consequences.

FAQ

Does changing my MAC address make me anonymous online? No. MAC addresses are only visible on the local network segment (they don’t traverse routers/the public internet), so macchanger has zero effect on your identifiability to remote websites. It only affects local-network-level tracking.

Is using macchanger illegal? Changing a MAC address itself isn’t illegal in most places — it’s a completely legitimate driver-level configuration change. What can be illegal is using a spoofed MAC to gain unauthorized access to a network or bypass access controls you’re not permitted to bypass.

Will macchanger survive a reboot? No, by default the OS re-reads the hardware MAC on every boot/interface reset. You need to script it if you want persistence.

Does macchanger work on Wi-Fi adapters the same way as Ethernet? Mostly yes, but success depends on the wireless driver supporting SIOCSIFHWADDR. Some chipsets (especially certain Realtek and Broadcom drivers) don’t support it reliably.

Can macchanger change a MAC while the interface is in monitor mode? Generally you should set the MAC before switching to monitor mode, or bring the interface down, change the MAC, then re-enable monitor mode — order matters and varies slightly by driver.

Summary

Macchanger is a small tool that does one job well: giving you direct, scriptable control over your Linux network interface’s MAC address. Whether you’re testing the real-world effectiveness of MAC filtering during an authorized assessment, rotating identifiers to reduce local tracking, or just need to temporarily impersonate a known-good MAC on a lab network, it’s a reliable, well-maintained utility that’s been a staple of the Linux networking toolkit for two decades.

References

• Official GitHub repository: https://github.com/alobbs/macchanger
• Man page: man macchanger (or https://linux.die.net/man/1/macchanger)
• IEEE OUI registry (source of vendor data): https://standards-oui.ieee.org/