33
votes

Os:REDHAT LINUX Linux manage: 2.6.18.8-1 #

Is this possible to read MAC address form NIC directly ? I have below code but it just read from above layer but not the card itself !!!

I'm trying to figure out how to find the original MAC address of an ethernet NIC on my linux box. I understand how to find the current MAC address using ifconfig, but if the address has been changed, say by using 'ifconfig eth0 hw ether uu:vv:ww:yy:xx:zz',or I set "permanent" it using vi /etc/sysconfig/network-scripts/ifcfg-eth0.this file...I can successfully UP it in REBOOT also. how do I find the original? There must be a way to find it, because it is still burned permanently into the card, but I can't find a tool to read the burned in address. is there any utility for it or command for it? I suppose to write C code for it. but don't know how to do this in above case.

** below code gives my current MAC but not original MAC

#include <stdio.h>              /* Standard I/O */
#include <stdlib.h>             /* Standard Library */
#include <errno.h>              /* Error number and related */


#define ENUMS
#include <sys/socket.h>
#include <net/route.h>
#include <net/if.h>
#include <features.h>           /* for the glibc version number */
#if __GLIBC__ >= 2 && __GLIBC_MINOR >= 1
#include <netpacket/packet.h>
#include <net/ethernet.h>       /* the L2 protocols */
#else
#include <asm/types.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>     /* The L2 protocols */
#endif
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/un.h>
#include <sys/ioctl.h>
#include <netdb.h>


int main( int argc, char * argv[] ){

unsigned char  mac[IFHWADDRLEN];
int i;
    get_local_hwaddr( argv[1], mac );
    for( i = 0; i < IFHWADDRLEN; i++ ){
        printf( "%02X:", (unsigned int)(mac[i]) );
    }

}


int get_local_hwaddr(const char *ifname, unsigned char *mac)
{
    struct ifreq ifr;
    int fd;
    int rv;                     // return value - error value from df or ioctl call

    /* determine the local MAC address */
    strcpy(ifr.ifr_name, ifname);
    fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_IP);
    if (fd < 0)
        rv = fd;
    else {
        rv = ioctl(fd, SIOCGIFHWADDR, &ifr);
        if (rv >= 0)            /* worked okay */
            memcpy(mac, ifr.ifr_hwaddr.sa_data, IFHWADDRLEN);
    }

    return rv;
}
7
Just because it is burned there, does not mean it HAS to be available. I don't know how linux and the cards work, but it would be entirely plausible if the MAC was only restored on a power cycle when the cards' firmware does initialization.Prof. Falken
I just want to UP my machine with SPOOFED MAC and I can do it successfully . but during that I want my original MAC for my application. that is my issue.Jatin Bodarya
I think @AmigableClarkKant is suggesting that a full power cycle might make the NIC initialize from firmware. Don't just restart; shutdown, wait, power on. That might restart the NIC with its original MAC address. Then you could retrieve and store the original MAC address before you change it at run time.Mike Sherrill 'Cat Recall'
ohh.... I have no Idea How to do that Pragmatically.. There is no other way that I can get it whenever I want in my application... using C code (without storing it somewhere)Jatin Bodarya
It is a matter of "how do you get that information", assuming it is available. All the drivers for the network cards will know how to do this, but like I describe below, the information is read then stored, and if that gets overwritten later, then that's it - gone. You could add some code to each driver, but that would be a lot of work, and almost certain not to get into the Linux kernel, so you'd forever carry a patch for every network driver available - that would be rather a lot of effort to maintain...Mats Petersson

7 Answers

59
votes

Certainly in ethtool 3.1 you can just print the address: ethtool -P|--show-permaddr DEVNAME Show permanent hardware address

e.g.

ethtool -P eth0

Permanent address: 94:de:80:6a:21:25

18
votes

Try cat /sys/class/net/eth0/address or cat /sys/class/net/em1/address if using Fedora. It should work.

The original answer is here: Notes of a Systems Admin

8
votes

The only way to find the original MAC address is to use the same method the network card driver does - unfortunately, I don't believe there is a generic way to tell the driver to provide it's MAC address "as provided by the hardware". Of course, there are cases where there isn't a hardware network card for that particular interface - virtual network drivers for virtualization and when using bridges and software switches for example.

And of course, the hardware may be such that you can't actually read the "original" MAC address when it has been overwritten by software, because there is only one set of registers for the MAC address itself.

I had a quick look at the pcnet32.c drivers (because it's one of the models of network card that I have a rough idea how it works and where the different registers are, etc, so I can see what it does). As far as I can see, it supports no method of actually asking "what is your PROM ethernet address" - the MAC address is read out during the "probe1" section of the module initialization, and stored away. No further access to those hardware registers is made.

7
votes

Well, the old ethernet address remains in the first bytes of the card eeprom (at least for some types of cards), so it is possible to extract it using ethtool

bash$ sudo ethtool -e eth1
Offset      Values
------      ------
0x0000      tt uu ww xx yy zz 79 03 
0x....

where tt:uu:ww:xx:yy:zz is old mac address

6
votes

This may not be the programmatic way, but why not search dmesg. All of my machines' NICs spit out the MAC address at detection time.

Try something like this:

dmesg|grep eth0

Different NICs display the MAC address differently, but the log will always contain the kernel given name of the adapter (in most cases eth0 or wlan0).

0
votes

In Ubuntu 18.4 LTS
First you need to find the network interface names on the computer by command

ls /sys/class/net

My output is

docker0  enp0s31f6  lo

Now you can use the command as discussed above, dont forget the sudo

sudo ethtool -P enp0s31f6
-1
votes

This command lists all the ethernet devices and original HW addresses.

dmesg | grep eth | grep IRQ | awk {'print "permanent address of " $5 " " $9'} |tr "," " "