A MAC address is a hardware identifier assigned to a network interface — six bytes, usually written as twelve hex digits, burned into the adapter by its manufacturer. Every network interface has one: the ethernet port on your motherboard, the Wi-Fi card, the Bluetooth radio, and every virtual adapter created by VPN software, Hyper-V or a virtual machine. Anti-cheats read them for two reasons. They are stable. Unlike an IP address, which changes when you reconnect or move, a MAC address stays with the adapter for its lifetime. That makes it a good anchor for a fingerprint. They are plural. A typical machine exposes three to six of them, which is a lot of entropy for very little effort. Even i
is a hardware identifier assigned to a network interface — six bytes, usually written as twelve hex digits, burned into the adapter by its manufacturer. Every network interface has one: the ethernet port on your motherboard, the Wi-Fi card, the Bluetooth radio, and every virtual adapter created by VPN software, Hyper-V or a virtual machine. Anti-cheats read them for two reasons.
Unlike an IP address, which changes when you reconnect or move, a MAC address stays with the adapter for its lifetime. That makes it a good anchor for a fingerprint.
A typical machine exposes three to six of them, which is a lot of entropy for very little effort. Even if two people happen to share one adapter model, the combination across all adapters is close to unique. The first three bytes are the manufacturer prefix, which also tells the anti-cheat something about your hardware before it reads anything else. One common misconception worth correcting:
a MAC address does not travel across the internet
. Routers replace it at each hop, so a game server never sees yours directly. It is read locally, by the anti-cheat running on your machine, and reported as part of the fingerprint. That is why a VPN does nothing to hide it — the VPN changes your apparent IP, not what the anti-cheat reads from your adapter.
Windows lets you change a MAC address without any third-party software, through the adapter's advanced properties or the registry. It is worth understanding why that is usually not sufficient. Manual spoofing covers one adapter. You change the ethernet adapter and forget the Wi-Fi card, the Bluetooth radio and the virtual adapter your VPN created. The anti-cheat reads all of them. A partial change can leave you more identifiable than no change, because the combination is now unique in a new way. Not every driver honours it. The registry override works for many adapters and is silently ignored by others, particularly some Intel and Realtek drivers. You can set the value, see it in the interfa
Windows lets you change a MAC address without any third-party software, through the adapter's advanced properties or the registry. It is worth understanding why that is usually not sufficient.
Manual spoofing covers one adapter.
You change the ethernet adapter and forget the Wi-Fi card, the Bluetooth radio and the virtual adapter your VPN created. The anti-cheat reads all of them. A partial change can leave you more identifiable than no change, because the combination is now unique in a new way.
The registry override works for many adapters and is silently ignored by others, particularly some Intel and Realtek drivers. You can set the value, see it in the interface, and have the hardware continue reporting its original address to anything reading at a lower level.
Driver updates, Windows feature updates and adapter resets all restore the original. If you spoofed manually months ago, you may well be unspoofed now without knowing.
A MAC address with the wrong bits set in the first byte marks itself as locally administered or multicast. An anti-cheat reading a multicast address as a hardware identifier knows immediately that it is fake — which is worse than the real value. A proper tool changes every adapter, generates addresses with plausible manufacturer prefixes, and does it at a level the driver cannot ignore. The VOIDEX spoofer handles MAC alongside board and disk identifiers, which matters because changing one class of identifier alone rarely helps — see what a spoofer is.
A badly spoofed MAC address is a stronger signal than an unspoofed one. These are the errors that produce that outcome. Using an obviously fake prefix. The first three bytes identify a manufacturer. Addresses beginning 00:00:00, or with a prefix belonging to no real vendor, stand out immediately. A good tool picks a prefix belonging to an actual network hardware vendor. Setting the locally-administered bit. The second-least-significant bit of the first byte marks an address as locally assigned rather than manufacturer-burned. Real hardware essentially never has it set. Many manual guides produce addresses that do. Changing one adapter and leaving the rest. Covered above, and it is the most c
A badly spoofed MAC address is a stronger signal than an unspoofed one. These are the errors that produce that outcome.
Using an obviously fake prefix.
The first three bytes identify a manufacturer. Addresses beginning 00:00:00, or with a prefix belonging to no real vendor, stand out immediately. A good tool picks a prefix belonging to an actual network hardware vendor.
Setting the locally-administered bit.
The second-least-significant bit of the first byte marks an address as locally assigned rather than manufacturer-burned. Real hardware essentially never has it set. Many manual guides produce addresses that do.
Changing one adapter and leaving the rest.
Covered above, and it is the most common error by far.
VPN clients, Hyper-V, WSL and virtual machine software all create adapters with their own addresses. They are read like any other.
Randomising every session in an obvious way.
Complete randomness across sessions is itself a pattern, particularly if the prefixes are inconsistent with any real hardware. Stable-but-fake is usually better than differently-fake every day.