MAC and Identity

Your IP is just one identifier. Devices and browsers expose many others: MAC addresses, hostnames, browser fingerprints, and account logins. True anonymity means controlling all of them.

This lesson focuses on spoofing low-level identifiers, especially the MAC address, and understanding what else can give you away.

A MAC address is a 48-bit hardware identifier burned into a network interface, written as six hex pairs like a4:5e:60:1f:2c:8b.

The first three bytes are the OUI, identifying the manufacturer. MAC addresses operate at Layer 2 and are only visible on the local network segment, not across the internet.

On a local network, the MAC address can track your device even if your IP changes. It is used for:

• DHCP leases and network access control.
• Captive portal tracking (paid Wi-Fi remembering your device).
• MAC filtering allow/deny lists.

Spoofing the MAC lets you bypass simple filters and avoid local tracking.

On Linux you inspect interfaces with ip link or the older ifconfig. Note the interface name (like eth0 or wlan0) and its current MAC.

You can change the MAC in software. The interface must be brought down first, then up after the change. The tool macchanger makes this easy and can assign a random or vendor-specific address.

A random MAC with an unusual OUI can look suspicious. To blend in, use an OUI from a common vendor (Apple, Samsung, Intel) so the address resembles ordinary devices.

Your device also broadcasts a hostname and DHCP request options that can fingerprint your OS and device model. A hostname like 'Johns-MacBook-Pro' is a giveaway.

For anonymity, set a generic hostname and be aware that DHCP option ordering itself can identify your operating system.

Higher up the stack, websites build a browser fingerprint from your user agent, screen size, fonts, installed plugins, canvas rendering, and time zone. Combined, these are often unique even without cookies.

Spoofing your MAC does nothing against fingerprinting. The Tor Browser fights this by making all users look identical.

Phones and laptops now randomize their MAC when scanning or joining Wi-Fi networks to resist tracking. This is a privacy feature you can leverage and should understand when analyzing networks.

However, once associated, some devices reveal a stable per-network MAC, so randomization is not absolute.

The key lesson: anonymity requires controlling identifiers at every layer:

• Layer 2: MAC address.
• Layer 3: IP (via VPN/Tor).
• Application: hostname, user agent, fingerprint.
• Human: accounts, writing style, habits.

Fixing one layer while leaking another defeats the whole effort.

A spoofed MAC set with macchanger reverts on reboot. To keep it, configure your network manager or a startup hook to apply the change at boot.

Be consistent: if you want to look like a brand-new device each session, randomize every time; if you want to impersonate one specific allowed device, set the same address each boot. Match the MAC strategy to your goal.

Reason about how far a MAC address travels.

You learned about device identity:

• The MAC address is a Layer 2 identifier visible only locally; spoof it with macchanger.
• Use a believable vendor OUI to blend in.
• Hostnames, DHCP options, and browser fingerprints leak identity at other layers.
• Modern devices randomize MACs, but not perfectly.
• Anonymity demands controlling identifiers at every layer.

Next: the human OPSEC mistakes that unmask people.