使用 NetworkManager 随机化你的 MAC 地址
MAC Wi-Fi
![](/data/attachment/album/201809/19/081148cn996dvan14mnl46.png)


今时今日，无论在家里的沙发上，还是在外面的咖啡厅，只要打开笔记本电脑，连上 Wi-Fi，就能通过网络与外界保持联系。但现在的 Wi-Fi 热点们大都能够通过[每张网卡对应的唯一 MAC 地址](https://en.wikipedia.org/wiki/MAC_address)来追踪你的设备。下面就来看一下如何避免被追踪。


现在很多人已经开始注重个人隐私这个问题。个人隐私问题并不仅仅指防止他人能够访问到你电脑上的私有内容（这又是另一个问题了），而更多的是指<ruby> 可追踪性 <rt>  legibility </rt></ruby>，也就是是否能够被轻易地统计和追踪到。大家都应该[对此更加重视](https://www.ribbonfarm.com/2010/07/26/a-big-little-idea-called-legibility/)。同时，这方面的底线是，服务提供者在得到了用户的授权后才能对用户进行追踪，例如机场的计时 Wi-Fi 只有在用户授权后才能够使用。


因为固定的 MAC 地址能被轻易地追踪到，所以应该定时进行更换，随机的 MAC 地址是一个好的选择。由于 MAC 地址一般只在局域网内使用，因此随机的 MAC 地址也不大会产生[冲突](https://serverfault.com/questions/462178/duplicate-mac-address-on-the-same-lan-possible)。


### 配置 NetworkManager


要将随机的 MAC 地址默认地用于所有的 Wi-Fi 连接，需要创建 `/etc/NetworkManager/conf.d/00-macrandomize.conf` 这个文件：



```
[device]
wifi.scan-rand-mac-address=yes

[connection]
wifi.cloned-mac-address=stable
ethernet.cloned-mac-address=stable
connection.stable-id=${CONNECTION}/${BOOT}
```

然后重启 NetworkManager ：



```
systemctl restart NetworkManager
```

以上配置文件中，将 `cloned-mac-address` 的值设置为 `stable` 就可以在每次 NetworkManager 激活连接的时候都生成相同的 MAC 地址，但连接时使用不同的 MAC 地址。如果要在每次激活连接时也获得随机的 MAC 地址，需要将 `cloned-mac-address` 的值设置为 `random`。


设置为 `stable` 可以从 DHCP 获取相同的 IP 地址，也可以让 Wi-Fi 的<ruby> <a href="https://en.wikipedia.org/wiki/Captive_portal">  强制主页 </a> <rt>  captive portal </rt></ruby>根据 MAC 地址记住你的登录状态。如果设置为 `random` ，在每次连接的时候都需要重新认证（或者点击“我同意”），在使用机场 Wi-Fi 的时候会需要到这种 `random` 模式。可以在这篇 NetworkManager 的[博客文章](https://blogs.gnome.org/thaller/2016/08/26/mac-address-spoofing-in-networkmanager-1-4-0/)中参阅到有关使用 `nmcli` 从终端配置特定连接的详细说明。


使用 `ip link` 命令可以查看当前的 MAC 地址，MAC 地址将会显示在 `ether` 一词的后面。



```
$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp2s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN mode DEFAULT group default qlen 1000
    link/ether 52:54:00:5f:d5:4e brd ff:ff:ff:ff:ff:ff
3: wlp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DORMANT group default qlen 1000
    link/ether 52:54:00:03:23:59 brd ff:ff:ff:ff:ff:ff
```

### 什么时候不能随机化 MAC 地址


当然，在某些情况下确实需要能被追踪到。例如在家用网络中，可能需要将路由器配置为对电脑分配一致的 IP 地址以进行端口转发；再例如公司的雇主可能需要根据 MAC 地址来提供 Wi-Fi 服务，这时候就需要进行追踪。要更改特定的 Wi-Fi 连接，请使用 `nmcli` 查看 NetworkManager 连接并显示当前设置：



```
$ nmcli c | grep wifi
Amtrak_WiFi    5f4b9f75-9e41-47f8-8bac-25dae779cd87 wifi -- 
StaplesHotspot de57940c-32c2-468b-8f96-0a3b9a9b0a5e wifi -- 
MyHome         e8c79829-1848-4563-8e44-466e14a3223d wifi wlp1s0 
...
$ nmcli c show 5f4b9f75-9e41-47f8-8bac-25dae779cd87 | grep cloned
802-11-wireless.cloned-mac-address:     --
$ nmcli c show e8c79829-1848-4563-8e44-466e14a3223d | grep cloned
802-11-wireless.cloned-mac-address:     stable
```

这个例子在 Amtrak 使用完全随机 MAC 地址（使用默认配置）和 MyHome 的永久 MAC 地址（使用 `stable` 配置）。永久 MAC 地址是在硬件生产的时候分配到网络接口上的，网络管理员能够根据永久 MAC 地址来查看[设备的制造商 ID](https://www.wireshark.org/tools/oui-lookup.html)。


更改配置并重新连接活动的接口：



```
$ nmcli c modify 5f4b9f75-9e41-47f8-8bac-25dae779cd87 802-11-wireless.cloned-mac-address random
$ nmcli c modify e8c79829-1848-4563-8e44-466e14a3223d 802-11-wireless.cloned-mac-address permanent
$ nmcli c down e8c79829-1848-4563-8e44-466e14a3223d
$ nmcli c up e8c79829-1848-4563-8e44-466e14a3223d
$ ip link
...
```

你还可以安装 NetworkManager-tui ，就可以通过可视化界面菜单来编辑连接。


### 总结


当你走在路上时，你要[留意周围的环境](https://www.isba.org/committees/governmentlawyers/newsletter/2013/06/becomingmoreawareafewtipsonkeepingy)，并[警惕可能的危险](http://www.selectinternational.com/safety-blog/aware-of-surroundings-can-reduce-safety-incidents)。同样，在使用公共互联网资源时也要注意你自己的可追踪性。




---


via: <https://fedoramagazine.org/randomize-mac-address-nm/>


作者：[sheogorath](https://fedoramagazine.org/author/sheogorath/),[Stuart D Gathman](https://fedoramagazine.org/author/sdgathman/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[HankChow](https://github.com/HankChow) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
Today, users run their notebooks everywhere. To stay connected you use the local wifi to access the internet, on the couch at home or in a little cafe with your favorite coffee. But modern hotspots track you based on your MAC address, [an address that is unique per network card](https://en.wikipedia.org/wiki/MAC_address), and in this way identifies your device. Read more below about how to avoid this kind of tracking.


Why is this a problem? Many people use the word “privacy” to talk about this issue. But the concern is not about someone accessing the private contents of your laptop (that’s a separate issue). Instead, it’s about *legibility* — in simple terms, the ability to be easily counted and tracked. You can and should [read more about legibility](https://www.ribbonfarm.com/2010/07/26/a-big-little-idea-called-legibility/). But the bottom line is legibility gives the tracker power over the tracked. For instance, timed WiFi leases at the airport can only be enforced when you’re *legible*.

Since a fixed MAC address for your laptop is so legible (easily tracked), you should change it often. A random address is a good choice. Since MAC-addresses are only used within a local network, a random MAC-address is unlikely to cause a [collision.](https://serverfault.com/questions/462178/duplicate-mac-address-on-the-same-lan-possible)

## Configuring NetworkManager

To apply randomized MAC-addresses by default to all WiFi connections, create the following file */etc/NetworkManager/conf.d/00-macrandomize.conf *:

[device] wifi.scan-rand-mac-address=yes [connection] wifi.cloned-mac-address=stable ethernet.cloned-mac-address=stable connection.stable-id=${CONNECTION}/${BOOT}

Afterward, restart NetworkManager:

systemctl restart NetworkManager

Set *cloned-mac-address* to *stable* to generate the same hashed MAC every time a NetworkManager connection activates, but use a different MAC with each connection. To get a truly random MAC with every activation, use *random* instead.

The *stable* setting is useful to get the same IP address from DHCP, or a captive portal might remember your login status based on the MAC address. With *random* you may be required to re-authenticate (or click “I agree”) on every connect. You probably want “random” for that airport WiFi. See the NetworkManager [blog post](https://blogs.gnome.org/thaller/2016/08/26/mac-address-spoofing-in-networkmanager-1-4-0/) for a more detailed discussion and instructions for using *nmcli* to configure specific connections from the terminal.

To see your current MAC addresses, use *ip link.* The MAC follows the word *ether*.

$ip link1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: enp2s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN mode DEFAULT group default qlen 1000 link/ether 52:54:00:5f:d5:4e brd ff:ff:ff:ff:ff:ff 3: wlp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DORMANT group default qlen 1000 link/ether 52:54:00:03:23:59 brd ff:ff:ff:ff:ff:ff

## When not to randomize your MAC address

Naturally, there are times when you do need to be legible. For instance, on your home network, you may have configured your router to assign your notebook a consistent private IP for port forwarding. Or you might allow only certain MAC addresses to use the WiFi. Your employer probably requires legibility as well.

To change a specific WiFi connection, use *nmcli* to see your NetworkManager connections and show the current settings:

$ nmcli c | grep wifiAmtrak_WiFi 5f4b9f75-9e41-47f8-8bac-25dae779cd87 wifi -- StaplesHotspot de57940c-32c2-468b-8f96-0a3b9a9b0a5e wifi -- MyHome e8c79829-1848-4563-8e44-466e14a3223d wifi wlp1s0 ... $nmcli c show 5f4b9f75-9e41-47f8-8bac-25dae779cd87 | grep cloned802-11-wireless.cloned-mac-address: -- $nmcli c show e8c79829-1848-4563-8e44-466e14a3223d | grep cloned802-11-wireless.cloned-mac-address: stable

This example uses a fully random MAC for Amtrak (which is currently using the default), and the permanent MAC for MyHome (currently set to stable). The permanent MAC was assigned to your network interface when it was manufactured. Network admins like to use the permanent MAC to see [manufacturer IDs on the wire](https://www.wireshark.org/tools/oui-lookup.html).

Now, make the changes and reconnect the active interface:

$nmcli c modify 5f4b9f75-9e41-47f8-8bac-25dae779cd87 802-11-wireless.cloned-mac-address random$nmcli c modify e8c79829-1848-4563-8e44-466e14a3223d 802-11-wireless.cloned-mac-address permanent$nmcli c down e8c79829-1848-4563-8e44-466e14a3223d$nmcli c up e8c79829-1848-4563-8e44-466e14a3223d$ip link...

You can also install *NetworkManager-tui* to get the *nmtui* command for nice menus when editing connections.

## Conclusion

When you walk down the street, you should [stay aware of your surroundings](https://www.isba.org/committees/governmentlawyers/newsletter/2013/06/becomingmoreawareafewtipsonkeepingy), and on the [alert for danger](http://www.selectinternational.com/safety-blog/aware-of-surroundings-can-reduce-safety-incidents). In the same way, learn to be aware of your legibility when using public internet resources.

## Akarshan Biswas

Excellent article. It would much easier if gnome network applet offers that.(Just for non tech savvy users). 🙂

## Stuart D Gathman

The NetworkManager applet in Cinnamon can set the cloned-mac policy. It is under Network Connections. I don’t use Gnome3, but I strongly suspect there is a way to do it hidden somewhere in the GUI – and hopefully a Gnome expert can let us know where it is.

## Flo

How it works in Gnome 3:

Under Settings go to ‘Wi-Fi’, then click on the cogwheel (connection-specific settings). Under Identity, the second tab, you can set both MAC address and Cloned Address. Cloned address can be ‘stable’, ‘random’, ‘permanent’ (and maybe something else?).

You can do the same for wired connections.

## Stuart D Gathman

Thank you, Flo!

## Akarshan Biswas

Cloned address in the network tab cannot be stable’, ‘random’ or ‘permanent’. It can only be a MAC address

## Peter

I haven’t found it either. Maybe somebody could give us an hint.

## Flo

Did the method described not work? https://fedoramag.wpengine.com/randomize-mac-address-nm/#comment-478136

## Stuart D Gathman

I installed Gnome3 in a VM, and I can set cloned MAC policy via nmcli for virtual “wired” device ens3. However, the GUI will only accept a MAC. When I set “random” via nmcli and then display in GUI, it shows “random” in red – flagging it as a user entry error.

While there is no virtual wireless for the VM, I suspect the behavior is the same for WiFi.

nmtui, on the other hand, works perfectly well – and is the way to go for those who need menus and data entry fields.

## Flo

Sorry for the misinformation. I had thought that’s where you set in Gnome 3.

I changed the wifi.cloned-mac-address=random using CLI and the string would show up in NetworkManager in a red frame. I think that’s a bug in NetworkManager. It should either show the cloned MAC address or not show anything at all, but not the value of wifi.cloned-mac-address.

Worth reporting?

@Paul: Of course, CLI commands as described in the article or nmtui will do the job. The question here was if the same can be achieved using gnome’s NetworkManager. The answer seems to be No.

It’s time for yet another Gnome extension…

## Peter

At least I don’t see it…. I get the following dialog: http://de.tinypic.com/r/f9f37q/9

I dont’s see any option random or permanent…

## Paul W. Frields

The NetworkManager command line or nmtui will work to do what you want; see the article for info.

## Peter

I belief you. Never the less, with the goal to be as user-friendly as possible I’d find it better if the solution as described by Flo would work also for me and any other Gnome user 🙂

## Paul W. Frields

It’s a common misconception that an undocumented option is somehow better than no option. There are better ways to be user-friendly, though. To do this properly would need a more rigorous user-centric design.

## svsv sarma

… so much for a novice like me! I better leave it at that and continue. I feel sometimes ignorance is bliss.

## Hans Meiser

Great article! Many thanks!

## Frederik

If you’re having problems on a Microsoft Surface 3 (and possible other models) where the wifi is horribly unstable, disabling randomized MAC will help a lot. Particularly with 4.17+ kernels, where the wifi simply doesn’t work with randomized MACs.

## Stuart D Gathman

The “stable” option (keep the same hashed MAC for a given connection) should work with those situations. That still reduces legibility compared to using the same MAC across all connections. (Where “connection” is a NetworkManager connection object, not a “connection activation”, which is confusingly called a “connection” in other contexts.)

## mythcat

… is an interesting article as a solution, I do not consider it a practical solution. In relation to an internet provider I would prefer a selinux with software (browser, web server) or network traffic encryption.

## Stuart D Gathman

Don’t confuse privacy with legibility. Protecting the content of your transmissions is very important also, but does not address legibility. You can see a similar distinction in news discussions where certain government agencies track phone calls – which numbers called which other numbers – without necessarily recording or decrypting the actual content of the call.

## dekks herton

Maybe not worth the effort on 2 fronts, many wifi chips have buggy implementations & this https://www.theregister.co.uk/2017/03/10/mac_address_randomization/

## Stuart D Gathman

The 2017 paper you mention notes bugs in Android implementations (not relevant for Fedora), and a hardware bug in RTS/CTS protocol for most (nearly all) WiFi chipsets. You can see whether Fedora was able to successfully set the MAC by using ip link or ifconfig.

The hardware bug works like this:

WiFi clients send RTS to a WAP when they want to transmit, and the WAP responds with CTS. The attack works on WiFi chipsets that support AP mode. If you send RTS to the permanent MAC of the WiFi chipset, even if it is currently a client, it will respond with CTS based on radio conditions as if it were an AP. The CTS response does not contain the MAC, but it only responds to its permanent MAC in the RTS (when radio conditions would be clear for a client to send).

Thus the attack requires guessing the permanent MAC of the device in the RTS, and using a random MAC in the RTS. Since a

lotof RTS/CTS packets are used for WiFi, you get a lot of guesses. When you get a CTS response to the random MAC used in the RTS, you know your guess of the permanent MAC was correct.This does

notdirectly divulge the permanent MAC, but confirms a guess of the permanent MAC. The guess does not have to be random, however. For instance, if you have ever used your permanent MAC, it can be added to a database of MACs to guess at. A little creative thought can come up with more ways to utilize this correct guess confirmation flaw.## Zac

Thanks for writing something on privacy. I appreciate the time spent to do this and to share some wisdom. Like many things with privacy, its very individual to the person and situation. I never perceived this article to provide absolute protection, and I don’t think that was the intent of the author. This article however, is yet another tool to put in our toolbox to use. I hope others will see this as well.

Thanks