MAC Spoofing.

MAC spoofing programmatically overrides the burned-in MAC address of a NIC with one chosen by the attacker. On networks that rely on MAC filtering, captive-portal allowlists, or licensing tied to a hardware address, this is enough to gain unauthorized access. It is also used to evade per-device quotas on public Wi-Fi, to defeat de-authentication defenses, or to take over IP leases on poorly segmented networks. Defences include 802.1X port-based authentication, NAC posture checks, dynamic ARP inspection with DHCP snooping, and not treating MAC addresses as authentication.

Technically the change is trivial: a MAC address is never verified by peers, so ip link set dev eth0 address, macchanger, or a driver registry key rewrites the value the NIC advertises in every Ethernet or 802.11 frame. Because the first 24 bits are the IEEE-assigned OUI (Organizationally Unique Identifier), attackers often clone a real vendor prefix to blend in. The defensive picture shifted when privacy features turned MAC spoofing mainstream: iOS 14 (2020) and Android 10 began broadcasting randomized MACs per SSID to stop passive location tracking, and Windows 10 offers the same. That broke MAC-based device allowlists industry-wide and pushed enterprises toward certificate-based 802.1X/EAP-TLS and MACsec (IEEE 802.1AE) for link-layer identity. On its own, a spoofed MAC only wins where the network wrongly trusts layer 2; it does nothing against cryptographic authentication.

flowchart TD
  A[Attacker device] --> B[Read a trusted device's MAC]
  B --> C[Set NIC address: macchanger / ip link]
  C --> D[NIC advertises cloned MAC in frames]
  D --> E{Network trusts layer 2?}
  E -- MAC filter / captive portal --> F[Access granted - bypass]
  E -- 802.1X / EAP-TLS / MACsec --> G[Rejected - needs a certificate]