Which MAC address shows itself to the network/router, VBox MAC, Windows MAC or Wifi adapter MAC?

[Thomas N.]

I can't seem to find an reliable answer to this question. I'm running Ubuntu 20.04 on VBox with Windows 10 host. I use a program called Technitium MAC address changer v.6 to change the Wifi adapter MAC address when I'm using only the host OS.

Which MAC address shows itself to the network if I'm using Ubuntu in VBox? And does changing the MAC address in the VBox settings change which MAC address the network/router sees?

If I'm unaware of a link that explains this stuff, I'd appreciate someone sharing that here or if not, an perhaps some answers? Thank you so much.

[BillG]

Why would you want to change the MAC address? What is that supposed to do for you?

To change the MAC address in the virtual machine, simply go to to the network settings of the virtual machine. Go to the Network settings and click the Advanced arrow. Where it displays the MAC address, click the blue cycle icon on the right of the MAC address.

The virtual machine does not have a wi-fi adapter. It only emulates wired NICs. The only way to get a wi-fi adapter in a vm is to have a USB adapter in the host and capture the device in the vm.

If you are using bridged networking, the vm will look just like another physical machine on the network. It will use its own IP and MAC address and that is what the router will see.

[fth0]

If you are using bridged networking, the vm will look just like another physical machine on the network. It will use its own IP and MAC address and that is what the router will see.

I beg to differ: Please take a look at the second green box in 6.5. Bridged Networking.

Which MAC address shows itself to the network if I'm using Ubuntu in VBox? And does changing the MAC address in the VBox settings change which MAC address the network/router sees?

This depends on the networking setup. Start reading at the link I gave above, then read the whole chapter around it if necessary.

[BillG]

Correct. I always forget about bridging to wi-fi. I never do it myself.

[Thomas N.]

Sorry it took so long to respond. I had a lot of trouble logging back in to the forum.

Well, the reason to hide one's MAC address is for privacy on the public network.

My current networking system in VBox is NAT.

After rereading the VBox user guide and studying your posts, my understanding is NAT does not change the MAC address of the physical Wifi card at all as seen by the public wifi network. Bridged can but only if connected to the internet via ethernet cable; bridged doesn't if connected to the internet via Wifi. Is that correct? So Bill, changing the MAC address in Settings as you've decribed would only spoof the MAC address to the public Wifi network if connected via Ethernet cable?

Using NAT, would the MAC address spoofed on the Windows host OS by the Technitium MAC address changer show on the public Wifi network or would it be the real MAC address of the physical Wifi card?

And if the host OS is also running a VPN connection through a TAP adapter, does that change the MAC address that the network sees?

If not for privacy and anonymity, I'm not seeing right now why, for example, privacy advocates suggest using Linux distros inside a VM. What does it get you?

[Thomas N.]

Are there any knowledgeable people here who could shed some more light on this for me? BillG? fth0?

[BillG]

If you are using NAT to a NIC on the host, the MAC add of the VM would not be visible on the public network, just as a physical machine behind NAT would not display its MAC address on the public network. NAT was developed to allow machines to run in their own private network behind the NAT device. Only the NAT device itself has a connection to the public network. The NAT device retrieves data from the public Internet on behalf of its clients (using its own address) then redirects them through the private network. If the host machine is itself on a LAN behind a NAT router, the vms behind VirtualBox NAT are two hops from the public network.

Why are you so concerned about the MAC address of a vm? What do you think an intruder could do with it?

I have no idea why people use Technitium MAC Address Changer. Just another layer of abstraction I guess. I cannot see any purpose whatever for it on a private network.

[fth0]

After rereading the VBox user guide and studying your posts, my understanding is NAT does not change the MAC address of the physical Wifi card at all as seen by the public wifi network. Bridged can but only if connected to the internet via ethernet cable; bridged doesn't if connected to the internet via Wifi. Is that correct? So Bill, changing the MAC address in Settings as you've decribed would only spoof the MAC address to the public Wifi network if connected via Ethernet cable?

Yes, and yes.

Using NAT, would the MAC address spoofed on the Windows host OS by the Technitium MAC address changer show on the public Wifi network or would it be the real MAC address of the physical Wifi card?

I don't know. I'd expect the VirtualBox NAT implementation to query the MAC address of the WiFi adapter only once, but I don't know when that happens nor which method is used. I'd suggest to install and use Wireshark on your Windows host and investigate it yourself. TIA for letting us know the result.

And if the host OS is also running a VPN connection through a TAP adapter, does that change the MAC address that the network sees?

I don't understand that question (e.g. you were talking about a Windows host, and I know TAP interfaces from Linux)?

If not for privacy and anonymity, I'm not seeing right now why, for example, privacy advocates suggest using Linux distros inside a VM. What does it get you?

There are a lot of different aspects that can be summarized under the terms privacy and anonymity. One could write a book about it, but that's also the reason I'm reluctant to start explaining it. Google will give you more information on this topic than you can read.

[Thomas N.]

Thanks for the great responses. Still trying to digest them.

Why are you so concerned about the MAC address of a vm? What do you think an intruder could do with it?

What I'm concerned about is the physical MAC address of my host Wifi Card appearing on, for example, a library's router/network or a Starbucks' router/network and wondering if VBox can prevent that.

I'd suggest to install and use Wireshark on your Windows host and investigate it yourself. TIA for letting us know the result.

That sounds like a great suggestion.