Re: Faking ethernet source MAC in NF_IP_POST_ROUTING

[Mario <netfilter@mail.bg>]

On Wednesday 23 June 2004 19:15, Phillip Whelan wrote:
> Hello,
>
> Quote: (myself)
>   "I've been working lately on a netfilter hook extension which Rewrites
> outgoing ARP packets to spoof a host's MAC address."
>
> I already managed to solve a problem involving ARP replies automagically
> updating arp caches by modifying the arp payload's sender hw_addr. (or
> perhaps, the tha... whatever, it works).
>
> The kernel is now spoofing itself, etc... but, it still sends out packets
> with the real MAC address. This, of course confuses the end host to no
> ends.
>
> In NF_IP_POST_ROUTING, the skb->mac is not NULL, but skb->mac_len is 0.
> Directly modifying the skb->mac would just lead to memory corruption.
> How would I modify the source MAC address? (Im inside NF_IP_POST_ROUTING).
> Can I access through a negative offset from skb->data? (net/ipv4/arp.c does
> this, I think).


You can modify MAC address by using ebtables & bridge extentions.
Using ebtables on bridge device you can have multiple MACs and can do MAC SNAT 
or DNAT.iptables can't change MAC addresses because iptables is 
layer3.ebtables is layer2 and it can modify MACs.Try it! It works! Tested ;P~
You can use it also if you want to conflict huge ip classes...some ISPs are 
using this way to stop their clients using their local area networks if they 
are not paying.It can be useful in your case.