Working with MAC addresses
Posted by Steve on Thu 22 Feb 2007 at 16:47
MAC addresses are often taken for granted, things that nobody thinks about. However there are times when you do need to worry about them. Here we'll demonstrate how to view and change the MAC address of your Debian system.
Recently I had to deal with a machine which was having a strange networking problem:
- One booted the machine couldn't be contacted remotely.
- However the machine became contactable once it made a single outgoing network connection.
It took a while to figure out what was going wrong, but eventually we discovered that the machine was acquiring a different MAC address each time it booted. This explained the symptoms:
- On booting the machine would get a new MAC address - but the routers ahead of it would have the old one cached so no traffic would reach it.
- Once the machine made a single outgoing connection the router(s) would see the new MAC address and update themselves - so incoming connections worked.
The following messages in the system logs show the problem explicitly, once we knew to look there:
0000:00:07.0: Invalid Mac address detected: b1:8e:66:ea:0f:00 Please complain to your hardware vendor. Switching to a random MAC. eth0: forcedeth.c: subsystem: 01458:e000 bound to 0000:00:07.0
Thankfully the solution to this problem was very simple - just allocate a static MAC address to the machine, so when it reboots it doesn't generate a random one of its own.
Find your MAC addressSet your MAC addressTo view the MAC address of your machine you can use the ifconfig command. To see all interfaces run:
skx@mine:~$ ifconfig eth0 Link encap:Ethernet HWaddr 00:17:31:56:BC:2D inet addr:192.168.1.20 Bcast:192.168.1.255 Mask:255.255.255.0 .. .. lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 .. ..Here the MAC address is displayed after HWaddr, so the MAC address of this system is "00:17:31:56:BC:2D".
If you just want the MAC address of an interface you could run something similar to this:
skx@mine:~$ ifconfig eth0 | grep HWaddr | awk '{print $5}' 00:17:31:56:BC:2D
If you wish to explicitly set your MAC address upon a Debian system you can do so by adding an entry to your /etc/network/interfaces file.
Beneath each interface you wish to setup add "hwaddress ether xx:xxx..". For example:
auto eth0 static iface eth0 inet static address 1.2.3.4 gateway ... broadcast ... hwaddress ether 02:01:02:03:04:08
you can also try macchanger :)
http://packages.debian.org/testing/net/macchanger
it's very easy to use and website(http://www.alobbs.com/macchanger), has some pretty nice examples for beginners like myself.
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
That's very cool, thanks for the pointer.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Send Message | View dkg's Scratchpad | View Weblogs ]
[0 dkg@howler ~]$ ifdata -ph eth0 00:20:1B:B5:99:83 [0 dkg@howler ~]$
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
Does this method also work for wifi interfaces? Sometimes you get mac filtered...
For the matter you explain, usually the local router should also have a timeout for the IP-MAC address resolution table. That should make you wait 5 minutes or so after booting the machine, and after that, voila! The router refreshes (deletes) the old mac and when you connect it makes a resolution query (arp), finding the new IP-MAC adress resolution. But I think that _noone_ should be accessing the machine for the router delete the old mac from it's table. You can see this table with arp -an.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
Each to their own. I will try to remember, but when I install a package I use apt-get and when I do networking things I use ifconfig.
They are hard habits to break...
[ Parent | Reply to this comment ]
ifconfig(8) because of *BSD systems. But these tools on GNU OS differs a bit and are totally obsoleted by the ip(8) utility. All init scripts that still use the obsoleted networking tools should be rewritten and the ifconfig and route(8) programs should be only optional. The main purpose is that not even ifconfig is obsoleted for a long time but it even does not really work with recent kernels because the whole kernel API has changed! So, please, do not teach novices to use obsoleted tools. :)
[ Parent | Reply to this comment ]
That Alex Kuznetsov fellow (the developer behind iproute2) is jolly clever - one of those crazy Russian techies who absolutely shimmer with talent - but it means us lesser beings have to struggle to get what he has made available. So we fall back on easier-to-understand trusty old ifconfig.
I think you're right - the debian networking scripts system really needs to be overhauled so iproute2 is the default used, and so that iproute2 is a base network package. Once people see it in use, they'll start using it and getting used to it, and it will become more popular, like it deserves to be. Because it is elegantly powerful.
PJ
[ Parent | Reply to this comment ]
And here is how to do it with ip(8).
Let's check what we have:# ip l sh eth017: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000link/ether 00:c0:9f:55:6e:e5 brd ff:ff:ff:ff:ff:ff
You can not change MAC of interface if it is UP, so let's shutdown the interface:#ip l s eth0 down
and change it:#ip l s eth0 a 00:11:22:33:44:55
have a look at what we have done:# ip l sh eth017: eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast qlen 1000link/ether 00:11:22:33:44:55 brd ff:ff:ff:ff:ff:ff
Voilla!! It works! :) Now let's bring interface up:#ip l s eth0 up
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
apt-get too, which is most correct on Debian-based systems. :)
[ Parent | Reply to this comment ]
--
k2
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
/proc/net/arp
This holds an ASCII readable dump of the kernel ARP table used
for address resolutions. It will show both dynamically learned
and pre-programmed ARP entries. The format is:
IP address HW type Flags HW address Mask Device
192.168.0.50 0x1 0x2 00:50:BF:25:68:F3 * eth0
192.168.0.250 0x1 0xc 00:00:00:00:00:00 * eth0
Here 'IP address' is the IPv4 address of the machine and the 'HW
type' is the hardware type of the address from RFC 826. The
flags are the internal flags of the ARP structure (as defined in
/usr/include/linux/if_arp.h) and the 'HW address' is the data
link layer mapping for that IP address if it is known.
-Tom
%s/Your Reality/My Own/g
[ Parent | Reply to this comment ]
Fixed my problem with debian (ct VDR project) on Gigabyte M61P-S3 with onboard LAN adapter.
Thanks!
[ Parent | Reply to this comment ]