MAC Spoofing
MAC Spoofing (or cloning) is the process of changing your device’s (manufacture given) Media Access Control (MAC) address to appear as if it were a different device (Ginsberg, 2025). This can be a helpful tool for network administrators (when properly used) or a sneaky entry point into an unsuspecting victims’ network (when used by threat actors). There are multiple ways to spoof a MAC address, but this paper will be focusing on two different ways to perform MAC Spoofing on Windows 11 devices. To understand MAC Spoofing, it is vital to have a basic understanding of what a MAC address is and how it is used.
The MAC address is a 48-bit (or 6-byte) “physical” address used for most IEEE 802 technologies, consisting of a 12-digit (base-16) hexadecimal number applied to the NIC, or network interface controller, and operates at Layer 2 (Data Link Layer) of the OSI model (Portnox, 2026) (PhoenixNAP, 2025) (Team Nuggets, 2024) (Sarah L. Harris, 2022). The manufacture of the devices assigns the MAC address as a “globally unique identifier,” so the device can be identified on any network (Sarah L. Harris, 2022). There are 5 different types of MAC addresses that are grouped by categories and demined by their network communication functionality and their specific purpose (PhoenixNAP, 2025).
A Broadcast MAC Address, or FF:FF:FF:FF:FF:FF, allows for one device to communicate with all the devices within the local network by sending out a broadcast packet using ARP, DHCP, UPnP, and other protocols saying, “Hello, network. Who is 192.168.1.11?” (Arista Community Central, 2023) (Team Nuggets, 2024).
A Locally Administered MAC Address (LAA) is commonly used in virtual environments and is configured by a network administrator to override the manufacture assigned MAC address for network configuration and to enhance end-user privacy on virtual machines (VM) (PhoenixNAP, 2025).
A Multicast MAC Address is used for devices that require data to be sent to multiple destinations at once and is most seen in video conferencing and streaming devices like Roku, Apple TV, Chromecast, etc. (PhoenixNAP, 2025).
A Unicast MAC Address is seen in most “everyday” network devices and sends data, or frames, on a specific network to one network device at a time to safeguard direct communications between devices (PhoenixNAP, 2025).
A Universally Administered MAC Address (UAA) is the default MAC address assigned by the manufacture; this address is globally “unique” to ensure that no two devices within the world share the same MAC address (PhoenixNAP, 2025). Nonetheless, this does not guarantee that two devices will not share an identical MAC address, as MAC Spoofing can replicate another device’s MAC address (PhoenixNAP, 2025).
On Windows 11, the MAC address can be changed through the network adapter settings via manually entering a new (different/spoofed) MAC address into the devices. This can be achieved by going to Control Panel > Device Manager > Network Adapters > Right-click on your Ethernet adapter > Properties > Advanced > Locally Administered Address, and then enter the new MAC address (Winder S, 2025).
If this option is not available, you can also achieve a spoofed MAC address by going to Control Panel > Device Manager > Network Adapters > Right-click on your Ethernet adapter > Properties > Advanced > Select Network Addresses > input new MAC address under “Value” (Winder S, 2025). When spoofing your MAC address, it is crucial to leave out all colons (:) and/or dashes (-), if you include them, the spoof will not work (Winder S, 2025).
Next, you need to go to Control Panel > Network and Sharing > Ethernet > Disable (to disable the Ethernet adapter) and then Control Panel > Network and Sharing > Change Adapter Settings > Ethernet, re-enable the NIC by right-clicking on Ethernet for changes to apply (Winder S, 2025). Once this has been done, go back to Control Panel > Network and Sharing > Ethernet > Details, as well Settings > Network & Internet > Ethernet to see the spoofed MAC address is in effect.
Learning how to spoof a MAC address can be valuable knowledge to obtain, especially for the Cybersecurity professional, as it can help with penetration testing, bypassing network restrictions, avoiding tracking, and with network continuity when replacing an old router during business hours (Ginsberg, 2025). By utilizing the MAC address of the old router, it is possible to bypass a service lock to the original network device; the ISP sees the unique identifier of the router being replaced as the identification for the new device and will allow network connectivity to continue seamlessly without downtime (Ginsberg, 2025). When using public WiFi, MAC spoofing can grant you access to networks with device specific restrictions, it can also mitigate being tracked by ad agencies, retail stores, airports, and other businesses while using the Internet (Ginsberg, 2025). For pentesters and ethical hackers, MAC spoofing can also allow for the bypass of network restrictions to help unearth vulnerabilities prior to being exploited by a malicious threat actor (Ginsberg, 2025).
Get Beth Cochran’s stories in your inbox
Join Medium for free to get updates from this writer.
MAC addresses have an important role within networking, offering device identification. Although MAC Spoofing is not considered to be a core function of an operating system, it is a necessary functionality, especially for those within the Cybersecurity industry. MAC Spoofing is easily accomplished and offers its users anonymity while helping to protect against identity theft. When spoofing a MAC address, it is always best to keep in mind:
“Generally, it is legal to change your MAC address for personal devices that you own. However, … it could violate the terms of service.” (LabEx, 2025).
References
Arista Community Central. (2023, April 20). Broadcast and Multicast Optimization. Retrieved from Arista Community Central: https://arista.my.site.com/AristaCommunity/s/article/Broadcast-and-Multicast-Optimization#:~:text=Broadcast%20packets%20are%20commonly%20used,each%20recipient%20on%20the%20network.
Geeks for Geeks. (2024, September 30). What is MAC Address? Retrieved from Geeks for Geeks: https://www.geeksforgeeks.org/computer-networks/mac-address-in-computer-network/
Ginsberg, M. (2025, September 04). MAC Address Spoofing (Cloning) Explained: How It Works, Real-World Uses, and Step-by-Step Setup on Peplink, Teltonika, and Sierra Wireless Routers. Retrieved from 5G Store: https://5gstore.com/blog/2025/09/04/mac-address-cloning-or-spoofing/
LabEx. (2025, August 07). Is it legal to change MAC? Retrieved from LabEx: https://labex.io/questions/is-it-legal-to-change-mac-367301
PhoenixNAP. (2025, October 13). What Is a MAC Address? Retrieved from PheonixNAP: https://phoenixnap.com/glossary/mac-address#:~:text=However%2C%20it%20(%20media%20access%20control%20address,unless%20configured%20to%20retain%20the%20spoofed%20value.
Portnox. (2026). The Ins & Outs of Spoofing a MAC Address. Retrieved from Portnox: https://www.portnox.com/cybersecurity-101/cyber-threats/spoofing-mac-address/
Sarah L. Harris, D. H. (2022). Hexadecimal Number. Retrieved from ScienceDirect: https://www.sciencedirect.com/topics/computer-science/hexadecimal-number#:~:text=1.4.&text=Writing%20long%20binary%20numbers%20becomes,4096)%2C%20and%20so%20on.&text=Hexadecimal%2C%20a%20term%20coined%20by,but%20sexadecimal%20sounded%20too%20risqu%C3%A9.&
Team Nuggets. (2024, January 10). Networking Basics: How IP and MAC Addresses Work. Retrieved from CBT Nuggets: https://www.cbtnuggets.com/blog/technology/networking/networking-basics-how-ip-and-mac-addresses-work
Winder S. (2025, December 18). What is MAC Spoofing? How It Works & How to Use It. Retrieved from Windscribe: https://windscribe.com/knowledge-base/articles/what-is-mac-spoofing-and-how-to-use-it/
