In highly secure enterprise environments or during advanced penetration testing engagements, relying on a static Media Access Control (MAC) address poses a significant operational security risk. A static MAC address broadcast by a Wi-Fi interface can be easily tracked across multiple physical locations, enabling bad actors to correlate device movement and network activity. To mitigate this tracking, administrators running Rocky Linux (or other RHEL-derivatives like CentOS and AlmaLinux) can configure NetworkManager to automatically generate and apply a randomized MAC address every time the system connects to a wireless network. By leveraging NetworkManager’s built-in dispatcher scripts, this rotation occurs seamlessly and autonomously in the background.
The Role of NetworkManager in MAC Randomization
NetworkManager is the default network configuration daemon in modern Rocky Linux deployments. While administrators often use the nmcli command-line tool to manage static IPs or VPN connections, NetworkManager also possesses deep integration with the Linux kernel’s networking stack, allowing it to manipulate interface hardware addresses before the interface fully initializes.
NetworkManager supports two primary modes of MAC randomization for Wi-Fi connections:
- Random: Generates a completely new, mathematically random MAC address every single time the device connects to any Wi-Fi network. This provides maximum privacy.
- Stable: Generates a random MAC address, but associates it specifically with the SSID of the network. If you reconnect to “Corporate_WiFi”, it uses the same spoofed MAC address it used last time. This is useful for captive portals that require MAC registration, while still masking your true hardware address.
Configuring Global Randomization via Configuration Files
To enforce MAC address rotation across the entire operating system, you must modify the core NetworkManager configuration. NetworkManager reads configuration snippets from the /etc/NetworkManager/conf.d/ directory.
Open a terminal and create a new configuration file using a text editor with root privileges:
sudo nano /etc/NetworkManager/conf.d/00-macrandomize.confTo enforce maximum privacy (a completely new MAC address on every connection), insert the following configuration block:
[device]
wifi.scan-rand-mac-address=yes
[connection]
wifi.cloned-mac-address=random
ethernet.cloned-mac-address=randomIf you prefer the “Stable” approach to prevent issues with hotel captive portals, change random to stable in the [connection] block.
The wifi.scan-rand-mac-address=yes parameter is particularly crucial. It instructs NetworkManager to spoof the MAC address during the passive background scanning phase, before the device even attempts to associate with an Access Point, preventing tracking via unassociated probe requests.
Restarting the Daemon to Apply Changes
Once the configuration file is saved, you must restart the NetworkManager service for the daemon to parse the new rules and apply them to the kernel interfaces.
sudo systemctl restart NetworkManagerVerifying the MAC Rotation
To confirm the configuration is active, you must inspect the hardware address currently assigned to your Wi-Fi interface (typically named wlan0 or wlp2s0). First, check your actual, physical burned-in MAC address using the ethtool utility (you may need to install it via sudo dnf install ethtool):
sudo ethtool -P wlp2s0Next, connect to a Wi-Fi network and check the currently active MAC address using the standard IP utility:
ip link show wlp2s0The link/ether address displayed by the ip link command should now be completely different from the permanent address displayed by ethtool. Furthermore, because NetworkManager handles this at the daemon level, the rotation survives reboots, suspend/resume cycles, and manual interface toggles, ensuring continuous operational security without requiring manual scripting interventions.