MAC address randomization on desktops is still unfinished

MAC address randomization made phones look like a new radio every time they probe a café. Desktop PCs never got that cultural upgrade. The wired Ethernet adapter in a workstation still often presents a burned-in address to everything from DHCP to license checks, and plenty of software treats that address as a hardware ID.

MAC rotation is one module in a privacy suite, not the suite. It belongs next to SMBIOS and disks, not in place of them.

What a MAC address is for

A Media Access Control address is how frames find a network interface on a local segment. It was never designed as a global tracking cookie. It became one because it is unique, available, and boring to query.

Collectors like it because:

• it survives OS reinstalls if it is burned in
• it is easy to read from userland
• it pairs cleanly with other inventory fields
• even a locally administered address still distinguishes machines on a LAN

A VPN does not touch this. Your packets may exit elsewhere. Your NIC is still your NIC.

Why phones and PCs diverged

Phones live on hostile RF. Probe requests without randomization are a physical tracking gift. Vendors were pushed, regulators were loud, and randomization shipped.

Desktops live on networks that administrators want to inventory. DHCP reservations, switch port security, MDM, and ISPs all had reasons to keep MACs stable. Licensing libraries followed the stability.

So you get a split culture: a phone that is ashamed of its MAC, a PC that prints it on a sticker.

Randomized versus locally administered

There is a bit in a MAC that says “this is not the burned-in address.” Privacy-preserving randomization should set that bit. Some amateur spoofs do not, which produces values that look like vendor addresses they are not. That is an anomaly. Anomalies get scored.

A serious hardware fingerprinting pipeline will also notice if:

• the MAC changed but the SMBIOS UUID did not
• two adapters changed in lockstep every minute
• the OUI is nonsense

Rotation has to be coherent with the rest of the seeded identity. That is why SpoofHWID generates NICs as part of the seed, not as a coin flip on the side. See seeded hardware identities.

Wired adapters are the leak you forget

People remember Wi-Fi. They forget Ethernet. They forget the second NIC on a motherboard. They forget a USB dongle they used once.

Each interface is a name. A machine with three names is easier to recognize, not harder, if only one name changes. Temporary masking has to consider the set.

Where MAC rotation sits in a session

In a temporary HWID masking model, MAC rotation lasts for the session and reverts on reboot, same as the rest of the bundle. That is the correct default for a workstation.

If you need a stable lab LAN identity for a few days of testing, keep the seed. Do not permanently rewrite the EEPROM on a NIC you still use for work. The recovery story on cheap adapters is not cute.

What MAC rotation will not do

It will not hide you from a site that never saw your MAC in the first place. Browsers do not send MACs to websites. This is local and LAN-visible identity, plus whatever local software decides to upload.

It will not replace account hygiene. It will not replace the rest of the hardware bundle. It will not make a desktop behave like an iPhone on every network stack.

Practical checks

Before a session:

• list the adapters you actually have
• note which ones a target application enumerates
• apply the seeded profile
• confirm the presented MACs changed as a set
• reboot later and confirm the burned-in values returned

If a value does not return, stop. Temporary is the contract.

For coverage questions, Status is the living list. For the control surface, use the menu on the homepage. For access windows, Pricing is enough. MAC randomization is a chapter, not the book.