Impersonating Router

Question

Is it possible to completely(mean what type of network device from vendor id) impersonate Router as computer or laptop by cloning mac address of the computer or laptop ? Whether it is possible to know after cloning mac address that router is router and not connected PC ?(I mean to Network Provider)

For Example: Ethernet Feed (CAT-5) to Laptop with Hotspot to Multiple device over WiFi (CASE-1)

Ethernet Feed (CAT-5) to Router to Multiple device over WiFi (CASE-2)

Is it possible to make CASE 2 look like CASE 1 without knowing Network Admin Presence of Router.. ?

Answer 1

It sounds like you are asking how to allow multiple devices to share an Internet connection without the ISP knowing exactly what is connected. For example, perhaps your ISP only allows you to connect a single computer, but you want to use a router to connect more than one via NAT. In this case, yes, it is possible to do this, and most routers specifically include a function to facilitate it.

The steps required will depend on your specific router, but they will usually be fairly similar. In this example, we’ll do it for a D-Link DIR-655 (if you specify your router, I can try to update it for that):

1. Open your router’s configuration page and log in
2. Look for something like setup or Internet or WAN (you may need to go through manual setup)
3. Once you’ve located the WAN-configuration page, locate the DHCP section
4. Most routers will include the ability to specify a MAC address, and most will even include a [Clone/Copy PC] button to let you copy the computers’s MAC address automatically:
5. You may also need to copy the computer/host name, though most ISPs only lock based on MAC address
6. Click [Save] or [Apply] and reboot the router

Now you should be able to share the Internet connection with multiple devices. The ISP might still be able to detect that multiple devices are connected with some kind of probing or traffic-analysis, but few, if any bother going to such extremes.

Answer 2

This question is badly worded and thus difficult to answer. You should provide more details on the hardware, and how you mean "completely impersonate". Also you should confirm the nature of the router [presumably WAN] connection.

In the simple case where you are just getting an Ethernet feed and the upstream provider is not running anything fancy (like BGP for failover) the answer is "Mostly"

In this case all you need to do is clone the MAC address on the router - how you do this will depend on the OS (and if the OS does not support it, you might need to get a card which does, but this can definately be done in software under Linux). You will then need to set the same mechanisms [ie MTU, IP address, gateway, netmask] to get this to work.

Note that I said "Mostly" in my answer. This is because it is usually possible for a device to be "fingerprinted", which gives an indication of the OS. I'm not familiar with this being used very widely for network engineers (hackers are a different story). Another possibility is that the provider may have hooks [ like be running an SSH server on the router, or remote management ] which they would were no longer accessible if they provided a router to you for management purposes.

For the sake of clarity, if you are in a situation of "Provide your own CISCO router" (for example) and you want to plug in a PC directly (you will want to secure it), but make it look - to the casual observer or helpdesk dummy - who for whatever reason can directly view the remote end of the connection - they will probably just look up the first part of the MAC address and see who it was assigned to. By faking the cards mac address - which is trivial to do on ethernet - you can fool this check.