On learning about MAC addresses i came across U/L bit in the first octet. Further on i learned that MAC address could be spoofed.

If U/L bit switches according to MAC address modification , how could someone change the MAC address to a specific valid one ?

example :

PC1 : MAC 04:11:11:11:11:11 PC2 : MAC 08:22:22:22:22:22

User tries to change PC2 MAC to 04:11:11:11:11:11 so U/L bit changes to 1 so MAC should be changing to 06:11:11:11:11:11

Is U/L bit toggled by system or user ? Is it mandatory to change U/L bit?

  • 3
    You’re assuming that the spoofer follows the rules.
    – Ron Trunk
    Jan 18 '19 at 11:41
  • could you explain the correct behavior in this scenario? does it belong to the spoofer to choose whether to toggle U/L bit ?
    – PDHide
    Jan 18 '19 at 11:43
  • There is no correct behavior. That’s the whole point of spoofing.
    – Ron Trunk
    Jan 18 '19 at 11:59
  • A thief doesn’t follow the rules either.
    – Ron Trunk
    Jan 18 '19 at 12:00

Typically the MAC address is stored in an EEPROM connected to the network controller. The driver by default reads the MAC address from the EEPROM and tells the network controller to use it. However most drivers offer a way to override this behaviour and use a user-specified MAC address.

The U/L bit is just a convention, intended to prevent conflicts if everyone is following the rules. It doesn't prevent deliberate spoofing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.