[LUNI] MAC address spoofing

[Walter]

Well the dhcp client keeps a cache of the last ip address it was given
for an interface. The idea being that when the system restarts it can
ask for that same IP. dhclient, at least on my system, doesn't seem to
keep track of the interfaces MAC address, just the interface name.

Just to clarify was the old IP address supposed to work with the new
MAC? I mean I have no idea why it wouldn't normally work, or why it
didn't get a new address.

A couple of things to try though:
  1) Try getting your dhcp client to explicitly release the IP address.
  2) Make sure there isn't any running dhcp client before bringing up
your interface.
  3) I did say a couple of things so this may be contradictory, but it's
way to late, or early, you could delete the leases file.

Hmm, now that I noticed it, it seems your using ifconfig to bring down
your interface. You may want to use your distro's tool to bring it down,
at least before you try my other suggestions. Debian uses ifup and
ifdown. I think Redhat based systems do too.

If your still having problems, find out which dhcp client your using. It
might be helpful if you need to further troubleshoot.


On Sat, 2007-09-08 at 17:17 -0700, zfh wrote:
> I have been playing with IP address spoofing on
> Scientific Linux (a distribution similar to Red Hat
> Enterprise).  I can use ifconfig to bring the
> interface down and change the mac address. (I was
> using a MAC address from another system on my network,
> which I brought up to see the MAC address and then
> shut down before trying the spoofing.)  When I bring
> the interface back up, you would think it would grab a
> different IP address from the network DHCP.  Instead,
> it either keeps the old IP address (which doesn't
> work), or it doesn't get an IP address at all.  When I
> restart, the real MAC address comes back and all works
> fine.  Am I missing something?
-- 
Walter <we3 at sprynet.com>