Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #178531 > unrolled thread

wlan0 hw address changes

Back to article view | Back to linux.debian.user

Contents

  wlan0 hw address changes Lucio Crusca <lucio@sulweb.org> - 2017-03-07 14:00 +0100
    Re: wlan0 hw address changes Dominik George <nik@naturalnet.de> - 2017-03-07 15:10 +0100
      Re: wlan0 hw address changes <tomas@tuxteam.de> - 2017-03-07 15:30 +0100
      Re: wlan0 hw address changes Lucio Crusca <lucio@sulweb.org> - 2017-03-07 18:30 +0100
        Re: wlan0 hw address changes Dominik George <nik@naturalnet.de> - 2017-03-07 23:10 +0100
          Re: wlan0 hw address changes Lucio Crusca <lucio@sulweb.org> - 2017-03-08 21:40 +0100
            Re: wlan0 hw address changes Lucio Crusca <lucio@sulweb.org> - 2017-03-09 10:00 +0100
    Re: wlan0 hw address changes Hans <hans.ullrich@loop.de> - 2017-03-07 17:20 +0100
      Re: wlan0 hw address changes Lucio Crusca <lucio@sulweb.org> - 2017-03-07 17:50 +0100
        Re: wlan0 hw address changes <tomas@tuxteam.de> - 2017-03-09 10:30 +0100
          Re: wlan0 hw address changes Lucio Crusca <lucio@sulweb.org> - 2017-03-09 13:10 +0100

#178531 — wlan0 hw address changes

I need to tell a network admin the hardware address of my wlan0 
interface, so that he gives me access to the wifi network. The problem 
is that the hw address is changing everytime I use the wlan0 hardware 
switch...

# ifconfig wlan0

wlan0: flags=4098<BROADCAST,MULTICAST>  mtu 1500
         ether b2:ad:31:c5:86:36  txqueuelen 1000  (Ethernet) ...

I bring it up using the hardware switch, then

# ifconfig wlan0

wlan0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
         inet6 fe80::c2cb:38ff:fe4c:568f  prefixlen 64  scopeid 0x20<link>
         ether c0:cb:38:4c:56:8f  txqueuelen 1000  (Ethernet) ...

I switch it off again, then

# ifconfig wlan0

wlan0: flags=4098<BROADCAST,MULTICAST>  mtu 1500
         ether aa:c3:d0:e1:43:cb  txqueuelen 1000  (Ethernet) ...

and so on... what is changing the hw address? How do I stop it?

[toc] | [next] | [standalone]

#178533

[Multipart message — attachments visible in raw view] — view raw

> I need to tell a network admin the hardware address of my wlan0
> interface, so that he gives me access to the wifi network. The problem
> is that the hw address is changing everytime I use the wlan0 hardware
> switch...

So, first of all, use this as another argument to explain to your admin
that MAC filters are not a security measure, but a PITA noone needs.

>         ether b2:ad:31:c5:86:36  txqueuelen 1000  (Ethernet) ...
>         ether c0:cb:38:4c:56:8f  txqueuelen 1000  (Ethernet) ...
>         ether aa:c3:d0:e1:43:cb  txqueuelen 1000  (Ethernet) ...

What strikes me as odd is that the whole address changes, so it's
probably not the firmware, as a vendor randomising the vendor part of
their hardware addresses on their own would probably not get their stuff
through FCC or whatever regulations apply.

So, I assume it is your system either setting a random address, or
preventing the firmware from setting the real address.

Assuming you do not have macchanger or something like that installed
(guessing you wouldn't be asking if you had taken such measures ;)), I
only know of systemd-networkd having such a feature.

-nik

-- 
PGP-Fingerprint: 3C9D 54A4 7575 C026 FB17  FD26 B79A 3C16 A0C4 F296

Dominik George · Hundeshagenstr. 26 · 53225 Bonn
Mobile: +49-1520-1981389 · https://www.dominik-george.de/

Teckids e.V. · FrOSCon e.V.
Fellowship of the FSFE · Piratenpartei Deutschland
Opencaching Deutschland e.V. · Debian Maintainer

LPIC-3 Linux Enterprise Professional (Security)

[toc] | [prev] | [next] | [standalone]

#178535

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Mar 07, 2017 at 03:07:11PM +0100, Dominik George wrote:
> > I need to tell a network admin the hardware address of my wlan0
> > interface, so that he gives me access to the wifi network. The problem
> > is that the hw address is changing everytime I use the wlan0 hardware
> > switch...
> 
> So, first of all, use this as another argument to explain to your admin
> that MAC filters are not a security measure, but a PITA noone needs.
> 
> >         ether b2:ad:31:c5:86:36  txqueuelen 1000  (Ethernet) ...
> >         ether c0:cb:38:4c:56:8f  txqueuelen 1000  (Ethernet) ...
> >         ether aa:c3:d0:e1:43:cb  txqueuelen 1000  (Ethernet) ...
> 
> What strikes me as odd is that the whole address changes, so it's
> probably not the firmware, as a vendor randomising the vendor part of
> their hardware addresses on their own would probably not get their stuff
> through FCC or whatever regulations apply.
> 
> So, I assume it is your system either setting a random address, or
> preventing the firmware from setting the real address.
> 
> Assuming you do not have macchanger or something like that installed
> (guessing you wouldn't be asking if you had taken such measures ;)), I
> only know of systemd-networkd having such a feature.

Yeah, this sounds a bit like MAC address randomization, and is
considered these days as a privacy feature. Just throwing the
buzzword in to aid in search.

Regards
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAli+w58ACgkQBcgs9XrR2kZkVACeJRb1q4QDuDHVT7nSJ0GvNfEh
O6IAniUnTQekH1f11yq14JE5EhktiyQF
=6Pen
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#178549

Dominik George wrote:

> Assuming you do not have macchanger or something like that installed
> (guessing you wouldn't be asking if you had taken such measures ;)), I
> only know of systemd-networkd having such a feature.
>
No macchanger and nothing like that I'm aware of.

How do I check the systemd-networkd thing?

[toc] | [prev] | [next] | [standalone]

#178558

[Multipart message — attachments visible in raw view] — view raw

Hi,

> How do I check the systemd-networkd thing?

ps aux… ;)

The MAC changing would also have to be configured in
/etc/systemd/network .

-nik

-- 
PGP-Fingerprint: 3C9D 54A4 7575 C026 FB17  FD26 B79A 3C16 A0C4 F296

Dominik George · Hundeshagenstr. 26 · 53225 Bonn
Mobile: +49-1520-1981389 · https://www.dominik-george.de/

Teckids e.V. · FrOSCon e.V.
Fellowship of the FSFE · Piratenpartei Deutschland
Opencaching Deutschland e.V. · Debian Maintainer

LPIC-3 Linux Enterprise Professional (Security)

[toc] | [prev] | [next] | [standalone]

#178586

Dominik George wrote:

>> How do I check the systemd-networkd thing?
> ps aux… ;)
>
> The MAC changing would also have to be configured in
> /etc/systemd/network .
>

Unfortunately systemd wasn't to blame here, no systemd-networkd running 
and no configuration files in /etc/systemd/network.

I add that I can manually set any hardware address I want, but only when 
wlan0 is down, and then it gets changed as soon as the interface comes 
up. So manully setting the hw address is not an option in my case.

Any other suggestions?

[toc] | [prev] | [next] | [standalone]

#178598

Let's try to add some informations... my wifi interface is:

03:00.0 Network controller: Broadcom Limited BCM43224 802.11a/b/g/n (rev 01)

I've tried to use an external PCI-express wifi card:

06:00.0 Network controller: Qualcomm Atheros AR5418 Wireless Network 
Adapter [AR5008E 802.11(a)bgn] (PCI-Express) (rev 01)

seen as wls1 by the OS.

Different things, different kernel modules (b43 vs ath9k). The system 
changes the hw ethernet address of both interfaces as soon as it brings 
them up, the assigned ethernet address is never the same and changes 
completely (even in the vendor part) each time. It has to be something 
at higher level than the firmware or kernel module, because it happens 
with different firmwares and kernel modules. Just to recap, macchanger 
is not installed and systemd-networkd is not configured nor running.

Any clues?

[toc] | [prev] | [next] | [standalone]

#178542

Do you have package "macchanger" installed?

Best

Hans

[toc] | [prev] | [next] | [standalone]

#178545

Hans wrote:

> Do you have package "macchanger" installed?

Nope...

# apt-cache policy macchanger
macchanger:
   Installed: (none)
   Candidate: 1.7.0-5.3+b1

I can add my system is a Debian GNU/Linux 9 amd64 that went through tons 
of upgrades in the years (it started as a testing version of wheezy), 
maybe some old release left behind something nasty?

[toc] | [prev] | [next] | [standalone]

#178599

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Mar 07, 2017 at 05:42:36PM +0100, Lucio Crusca wrote:
> Hans wrote:
> 
> >Do you have package "macchanger" installed?
> 
> Nope...
> 
> # apt-cache policy macchanger
> macchanger:
>   Installed: (none)
>   Candidate: 1.7.0-5.3+b1
> 
> I can add my system is a Debian GNU/Linux 9 amd64 that went through
> tons of upgrades in the years (it started as a testing version of
> wheezy), maybe some old release left behind something nasty?

What I can't glean from the thread up to now (sorry if I missed
that) is... what is 'up'ing and 'down'ing your interface? Is it
NetworkManager? Is it plain ifupdown?

In the case of NM, it seems it has acquired[1] this capability
last year.

Regards

[1] https://blogs.gnome.org/thaller/2016/08/26/mac-address-spoofing-in-networkmanager-1-4-0/

- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAljBIDMACgkQBcgs9XrR2kYaPQCeIBTN/mEbwf1Yr3yHIm1RAGpT
By0AmgKXx8Amz9/yrLUI3+3mobuqB04A
=pVIQ
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#178610

tomas@tuxteam.de wrote:

> In the case of NM, it seems it has acquired[1] this capability
> last year.
>
> [1] https://blogs.gnome.org/thaller/2016/08/26/mac-address-spoofing-in-networkmanager-1-4-0/
>

Bingo! Thanks a lot.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web