How to detect the original MAC address after it has been spoofed?

Question

We are using the following code for retrieving active MAC address of a windows pc.

private static string macId()
{
    return identifier(\"Win32_NetworkAdapt         


        

Answer 1

There can be two alternatives.

1. You can get the MAC address using the code snippet you gave before and check if that MAC address belongs to any NIC (Network Interface Card). If it doesn't belong to one, then the MAC address is obviously spoofed. Here is the code that Locates the NIC using a MAC adress

   using System.Net.Sockets;
   using System.Net;
   using System.Net.NetworkInformation;
   
   string localNicMac = "00:00:00:11:22:33".Replace(":", "-"); // Parse doesn't like colons
   
   var mac = PhysicalAddress.Parse(localNicMac);
   var localNic =
   NetworkInterface.GetAllNetworkInterfaces()
       .Where(nic => nic.GetPhysicalAddress().Equals(mac)) // Must use .Equals, not ==
       .SingleOrDefault();
   if (localNic == null)
   {
       throw new ArgumentException("Local NIC with the specified MAC could not be found.");
   }
   
   var ips =
       localNic.GetIPProperties().UnicastAddresses
       .Select(x => x.Address);
   

2. Get the network card address directly.

   a. NWIF = dotnetClass "System.Net.NetworkInformation.NetworkInterface"  
   b. the_Mac_array = NWIF.GetAllNetworkInterfaces() -- this is an array of all the Networks  
   c. the_PhysicalAddress_Array = #()  
   d. for net in the_Mac_array where (net.NetworkInterfaceType.toString()) == "Ethernet" do append   the_PhysicalAddress_Array ((net.GetPhysicalAddress()).toString())  
   e. print the_PhysicalAddress_Array
   

(( I found it here http://snipplr.com/view/23006/ ))