[LUNI] MAC address spoofing

[zfh]

--- Walter <we3 at sprynet.com> wrote:

> Well the dhcp client keeps a cache of the last ip
> address it was given
> for an interface. The idea being that when the
> system restarts it can
> ask for that same IP. dhclient, at least on my
> system, doesn't seem to
> keep track of the interfaces MAC address, just the
> interface name.
> 
> Just to clarify was the old IP address supposed to
> work with the new
> MAC? I mean I have no idea why it wouldn't normally
> work, or why it
> didn't get a new address.
> 
> A couple of things to try though:
>   1) Try getting your dhcp client to explicitly
> release the IP address.
>   2) Make sure there isn't any running dhcp client
> before bringing up
> your interface.
>   3) I did say a couple of things so this may be
> contradictory, but it's
> way to late, or early, you could delete the leases
> file.
> 
> Hmm, now that I noticed it, it seems your using
> ifconfig to bring down
> your interface. You may want to use your distro's
> tool to bring it down,
> at least before you try my other suggestions. Debian
> uses ifup and
> ifdown. I think Redhat based systems do too.
> 
> If your still having problems, find out which dhcp
> client your using. It
> might be helpful if you need to further
> troubleshoot.
> 
When I use the GUI to shut down and bring back up the
interface, I get a message like "mac address is to as
expected - Ignoring".  I think the reason it isn't
working is because the interface is not coming back up
for this reason.  I also tried the same thing on
Debian Sarge with the same result.
> 
> On Sat, 2007-09-08 at 17:17 -0700, zfh wrote:
> > I have been playing with IP address spoofing on
> > Scientific Linux (a distribution similar to Red
> Hat
> > Enterprise).  I can use ifconfig to bring the
> > interface down and change the mac address. (I was
> > using a MAC address from another system on my
> network,
> > which I brought up to see the MAC address and then
> > shut down before trying the spoofing.)  When I
> bring
> > the interface back up, you would think it would
> grab a
> > different IP address from the network DHCP. 
> Instead,
> > it either keeps the old IP address (which doesn't
> > work), or it doesn't get an IP address at all. 
> When I
> > restart, the real MAC address comes back and all
> works
> > fine.  Am I missing something?
> -- 
> Walter <we3 at sprynet.com>
> 
> -- 
> Linux Users Of Northern Illinois - Technical
> Discussion 
> http://luni.org/mailman/listinfo/luni
>