Thanks, Drew. That's what I was afraid of. I was hoping I was overlooking something, for example, some parameter in the module for the NIC. Pulling the info from the boot messages may be the optimal solution for now, as that's the least likely to have adulterated info.
Regards, - Robert On Thu, Jul 5, 2012 at 10:35 AM, Andrew Freiberger <[email protected]> wrote: > If you are using udev, you can check /etc/udev/rules.d/*net* for lines > containing eth0 and see if it was ever configured via MAC address in the > udev files. That line would have the module probe time MAC address for the > interface, but that's hardly definitive. Unfortunately, the way it gets > spoofed, all of the places in the OS where you can live-query mac addresses > (including /sys/class/net/eth0/address) get changed when you spoof the MAC. > > Also, you can try grepping "MAC" out of dmesg or /var/log/boot.msg or > wherever your boot messages are stored. > > ruse-linuxws0:/var/log # dmesg|grep MAC > [ 6.317267] eth0: Tigon3 [partno(BCM95754) rev 5784100] (PCI Express) MAC > address 2c:41:38:a7:dc:c9 > > ruse-linuxws0:/var/log # grep eth_s0 /etc/udev/rules.d/*net* > /etc/udev/rules.d/70-persistent-net.rules:SUBSYSTEM=="net", ACTION=="add", > DRIVERS=="?*", ATTR{address}=="2c:41:38:a7:dc:c9", ATTR{type}=="1", > KERNEL=="eth*", NAME="eth_s0_0" > > ruse-linuxws0:/var/log # grep MAC /var/log/boot.msg > <6>[ 6.317267] eth0: Tigon3 [partno(BCM95754) rev 5784100] (PCI Express) > MAC address 2c:41:38:a7:dc:c9 > > > -Drew > > ... > > On Thu, Jul 5, 2012 at 6:48 AM, Robert Citek <[email protected]> wrote: >> >> Greetings, all. >> >> After I have spoofed the MAC address on a NIC, how can I query to >> determine what the original MAC value is? >> >> For example, here is a transcript of a recent MAC address change and a >> revert: >> >> # # PART 1 >> # # the original MAC >> # ifconfig eth0 | grep HWaddr >> eth0 Link encap:Ethernet HWaddr 90:e6:ba:4e:26:96 >> >> # # PART 2 >> # # spoofing the MAC >> # ifconfig eth0 down >> # ifconfig eth0 hw ether 00:01:02:03:04:05 >> # ifconfig eth0 up >> # ifconfig eth0 | grep HWaddr >> eth0 Link encap:Ethernet HWaddr 00:01:02:03:04:05 >> >> # # PART 3 >> # # revert to original MAC >> # rmmod r8169 ; modprobe r8169 >> # ifconfig eth0 | grep HWaddr >> eth0 Link encap:Ethernet HWaddr 90:e6:ba:4e:26:96 >> >> In this case, I was able to revert to the original MAC by reloading >> the kernel module for the NIC. I could have also done this by >> re-running Part 2 using the original MAC from Part 1. >> >> However, let's imagine I did not run Part 1. How can I query the >> system to determine what the NIC's original MAC is without resorting >> to unloading/loading the NIC's kernel module? >> >> Regards, >> - Robert >> _______________________________________________ >> Discuss mailing list >> [email protected] >> http://www.sluug.org/mailman/listinfo/discuss > > > > _______________________________________________ > Discuss mailing list > [email protected] > http://www.sluug.org/mailman/listinfo/discuss > -- Central West End Linux Users Group (via Google Groups) Main page: http://www.cwelug.org To post: [email protected] To subscribe: [email protected] To unsubscribe: [email protected] More options: http://groups.google.com/group/cwelug
