3

On learning about MAC addresses i came across U/L bit in the first octet. Further on i learned that MAC address could be spoofed.

If U/L bit switches according to MAC address modification , how could someone change the MAC address to a specific valid one ?

example :

PC1 : MAC 04:11:11:11:11:11 PC2 : MAC 08:22:22:22:22:22

User tries to change PC2 MAC to 04:11:11:11:11:11 so U/L bit changes to 1 so MAC should be changing to 06:11:11:11:11:11

Is U/L bit toggled by system or user ? Is it mandatory to change U/L bit?

Improve this question
4
  • 3
    You’re assuming that the spoofer follows the rules.
    – Ron Trunk
    Commented Jan 18, 2019 at 11:41
  • could you explain the correct behavior in this scenario? does it belong to the spoofer to choose whether to toggle U/L bit ?
    – PDHide
    Commented Jan 18, 2019 at 11:43
  • There is no correct behavior. That’s the whole point of spoofing.
    – Ron Trunk
    Commented Jan 18, 2019 at 11:59
  • A thief doesn’t follow the rules either.
    – Ron Trunk
    Commented Jan 18, 2019 at 12:00

1 Answer 1

Reset to default
3

Typically the MAC address is stored in an EEPROM connected to the network controller. The driver by default reads the MAC address from the EEPROM and tells the network controller to use it. However most drivers offer a way to override this behaviour and use a user-specified MAC address.

The U/L bit is just a convention, intended to prevent conflicts if everyone is following the rules. It doesn't prevent deliberate spoofing.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.