MAC Randomization: What It Does and Doesn't Protect Against

The Promise of MAC Randomization

MAC addresses were designed as permanent, unique identifiers for network hardware. Every WiFi chip shipped from the factory has a 48-bit MAC address burned into it, unique among the billions of devices ever manufactured. The first three bytes identify the manufacturer (the Organizationally Unique Identifier, or OUI), and the last three bytes are a serial number.

This permanence was a feature for network administration but a disaster for privacy. A persistent, globally unique identifier attached to every wireless transmission is a tracker's dream. For years, anyone with a WiFi receiver could collect MAC addresses from passing devices and build movement profiles, track repeat visits, and correlate activity across locations.

MAC randomization was the industry's response. Instead of using the permanent hardware address, devices generate random MAC addresses for wireless operations. The idea is straightforward: if every probe request uses a different random address, the persistent tracking link is broken. The reality is more complicated.

How MAC Randomization Works

A randomized MAC address is generated by the device's operating system or WiFi driver. The address is formatted to look like a valid MAC address but with two key differences from a hardware address.

First, the locally administered bit (the second-least-significant bit of the first byte) is set to 1. This marks the address as locally assigned rather than globally assigned by a manufacturer. Any MAC address with this bit set is recognized as not being a real hardware address.

Second, the remaining bits are generated using a random or pseudo-random number generator. The quality of randomness varies by implementation - some use cryptographically secure random number generators, others use less rigorous methods that may produce patterns.

The scope and lifetime of randomized MACs depend on the implementation. Three models exist:

Per-scan randomization: A new random MAC is generated for each scanning cycle (each burst of probe requests). This provides the strongest anonymity for scanning operations because consecutive scans cannot be linked by MAC address.

Per-network randomization: A consistent random MAC is generated for each known network and reused every time the device connects to that network. This provides anonymity across networks (your home MAC differs from your office MAC) but allows tracking within a single network.

Time-based rotation: The random MAC changes at fixed intervals (e.g., every 24 hours) regardless of network. This provides a middle ground between per-scan (which can cause connectivity issues) and permanent assignment.

stateDiagram-v2
    [*] --> Disconnected
    
    state Disconnected {
        [*] --> ScanRandom: WiFi enabled
        ScanRandom --> ScanRandom: New scan cycle
        Note right of ScanRandom: Random MAC per scan
        Note right of ScanRandom: Changes every 15-20 min
    }
    
    state Connecting {
        [*] --> AuthRequest: Network found
        AuthRequest --> Association: Auth success
        Note right of AuthRequest: MAC may change here
    }
    
    state Connected {
        [*] --> PerNetworkMAC: Association complete
        PerNetworkMAC --> PerNetworkMAC: Same MAC for this SSID
        Note right of PerNetworkMAC: Stable per-network MAC
        Note right of PerNetworkMAC: Persists across sessions
    }
    
    Disconnected --> Connecting: Known network detected
    Connecting --> Connected: Association success
    Connected --> Disconnected: Disconnect/roam
    Disconnected --> Disconnected: No known network

MAC address lifecycle - how the randomization strategy changes between scanning, connecting, and connected states.

Implementation Differences Across Platforms

Each major operating system implements MAC randomization differently, with significant implications for privacy.

iOS has the most mature implementation. Since iOS 14, each network gets a unique, stable random MAC. This MAC persists for that network but differs from every other network. iOS also randomizes the scanning MAC and rotates it periodically. The implementation includes some additional protections: the sequence number is reset when the MAC changes, and some information elements are varied to reduce fingerprinting.

Android varies significantly across manufacturers and versions. Stock Android (AOSP) since Android 10 uses per-network randomized MACs by default. However, device manufacturers can modify this behavior. Some Samsung devices have offered the option to use full randomization (changing the MAC more frequently) in addition to the default per-network mode. The quality of the random number generation and the consistency of implementation across the Android ecosystem is uneven.

Windows introduced random hardware addresses in Windows 10. Users can enable per-network random MACs in the WiFi settings. When enabled, Windows generates a stable random MAC for each network, similar to the iOS approach. However, the feature is not enabled by default and many users are unaware of it.

macOS added MAC randomization for scanning in macOS Monterey (2021) and per-network random MACs in later versions. The implementation is generally solid but arrived several years after iOS, leaving a gap during which Mac laptops were more trackable than iPhones.

Linux supports MAC randomization through NetworkManager and iwd (iNet Wireless Daemon). The implementation is configurable, allowing users to choose between no randomization, per-scan randomization, and per-network randomization. The default behavior depends on the distribution and configuration.

Scanning MACs vs. Association MACs

A critical distinction that many people miss: the MAC address used during scanning (probe requests) and the MAC address used when connected to a network are often different, and they have different privacy properties.

The scanning MAC is used in probe requests sent while the device is looking for networks. This is the address that passive listeners see. Modern implementations randomize this aggressively - it may change every few minutes or with each scan cycle. This makes passive tracking of disconnected devices difficult.

The association MAC is the address the device uses when it connects to (associates with) a network. On modern systems, this is a stable per-network random MAC. It persists across connections to the same network, meaning the network operator can track the device's connection history. Your office WiFi sees the same MAC every time your phone connects, allowing the network to track your daily arrival and departure times.

This split creates an interesting privacy asymmetry. A passive observer in public (like a retail tracker) sees only the scanning MAC, which changes frequently. But a network operator (like your employer, your ISP, or a coffee shop WiFi provider) sees the association MAC, which is stable. The privacy improvement from randomization depends heavily on who is doing the tracking.

There is also a transition vulnerability. When a device finds a known network and transitions from scanning to connecting, it must switch from its random scanning MAC to its per-network association MAC. An observer who is monitoring both the probe requests and the association handshake can potentially link the two MACs if the timing is close enough.

Timing Correlation Attacks

Timing correlation is the most practical attack against MAC randomization. The concept is simple: even if the MAC address changes, the timing and physical characteristics of transmissions can link before-and-after addresses to the same device.

Consider a device that changes its MAC address. Just before the change, a probe request is sent from MAC address A with signal strength -45 dBm. Immediately after, a probe request appears from MAC address B, also with signal strength -45 dBm. If no other devices appeared or disappeared in that interval, MAC A and MAC B are almost certainly the same device.

Signal strength alone is a weak correlator because multiple devices can have similar signal strengths. But combined with other timing signals, the correlation becomes very strong:

Burst timing: Probe requests are sent in bursts (multiple channels scanned in rapid succession). The inter-frame timing within a burst is characteristic of specific device types and driver implementations. If the old MAC and new MAC show identical burst timing patterns, they are likely the same device.

Presence correlation: If MAC A disappears at exactly the moment MAC B appears, and this happens at a location with only a few devices, the correlation is straightforward. In a crowded location, this is harder, but combining signal strength with timing still narrows the candidates.

Probe frequency: Different devices probe at different rates, influenced by their operating system, power state, and configuration. A device that probes every 23 seconds with MAC A and then probes every 23 seconds with MAC B is likely the same device.

Channel scanning pattern: The order in which a device scans WiFi channels can be distinctive. If MAC A scans channels 1, 6, 11, 36, 40, 44 in that order, and MAC B follows the same pattern, the devices are likely identical.

Fingerprinting Beyond the MAC Address

The MAC address is just one field in a probe request frame. The remaining fields contain technical information that stays constant across MAC changes because it reflects the physical hardware, not a software-assigned address.

Supported rates: The list of data rates a device advertises depends on its hardware capabilities. An 802.11ax (WiFi 6) device advertises different rates than an 802.11ac (WiFi 5) device. Within each generation, different chipsets may support slightly different rate sets.

HT/VHT/HE capabilities: The High Throughput, Very High Throughput, and High Efficiency capability information elements describe the device's MIMO configuration, channel width support, and other advanced features. These are hardware-determined and unique to specific chipset models.

Vendor-specific information elements: Many devices include proprietary information elements in their probe requests. These can identify the manufacturer, chipset, and sometimes the specific device model. Apple devices include Wi-Fi Alliance P2P (WiFi Direct) elements. Intel chipsets include Intel-specific capabilities.

Country and regulatory information: Devices advertise which WiFi channels they support based on their regional configuration. A device configured for the US supports different channels than one configured for Japan or Europe.

Combining these fields creates a device fingerprint. Research by Matte et al. (2016) demonstrated that the combination of information elements in probe requests could uniquely identify approximately 50% of devices tested, even with randomized MACs. More recent research using machine learning classifiers has achieved higher identification rates by considering subtle variations in how different drivers format their probe requests.

graph TD
    subgraph ProbeFrame["Probe Request Frame Fields"]
        MAC[MAC Address - Randomized]
        SEQ[Sequence Number]
        RATES[Supported Rates]
        HT[HT Capabilities]
        VHT[VHT Capabilities]
        HE[HE Capabilities]
        VENDOR[Vendor Specific IEs]
        COUNTRY[Country Element]
        SSID_F[SSID Field]
    end
    
    subgraph RandomizedFields["Changes with MAC"]
        R1[MAC Address]
        R2[Sequence Number - sometimes]
    end
    
    subgraph StableFields["Stays Constant"]
        S1[Supported Rates]
        S2[HT/VHT/HE Caps]
        S3[Vendor IEs]
        S4[Country Element]
        S5[Channel List]
    end
    
    subgraph Fingerprint["Device Fingerprint"]
        FP[Unique Device Signature]
    end
    
    MAC --> R1
    SEQ --> R2
    RATES --> S1
    HT --> S2
    VHT --> S2
    HE --> S2
    VENDOR --> S3
    COUNTRY --> S4
    
    S1 --> FP
    S2 --> FP
    S3 --> FP
    S4 --> FP
    S5 --> FP
    
    R1 -.->|Timing correlation| FP
    R2 -.->|If not reset| FP

Which probe request fields change with MAC randomization and which remain stable, forming a persistent fingerprint.

Network-Side De-anonymization

Once a device connects to a network, additional de-anonymization techniques become available to the network operator.

DHCP fingerprinting: The DHCP (Dynamic Host Configuration Protocol) exchange that assigns an IP address contains device-identifying information. The DHCP options requested, their order, and the hostname field can fingerprint the device type and sometimes identify the specific device. Many devices include their model name or a user-set name in the DHCP hostname field (e.g., "Janes-iPhone" or "DESKTOP-AB12CD").

mDNS/DNS-SD: Multicast DNS and DNS Service Discovery allow devices to advertise services on the local network. Apple devices advertise AirPlay, AirDrop, and other services that include the device name and model. These advertisements use the device's real hostname, which often contains the owner's name.

HTTP and TLS fingerprinting: Even encrypted HTTPS traffic reveals device information through the TLS Client Hello message. The JA3 fingerprint (a hash of TLS parameters) can identify specific browser versions and, by extension, device types. HTTP traffic (if any is unencrypted) includes User-Agent strings that explicitly identify the device and OS version.

IPv6 SLAAC: Stateless Address Autoconfiguration in IPv6 can use the device's MAC address (including the real hardware MAC) to generate its IPv6 address. While modern systems use privacy extensions (RFC 4941) to randomize the interface identifier, not all implementations do this correctly, and the randomized interface identifier may itself become a tracking vector.

The net effect is that MAC randomization protects primarily against passive, pre-association tracking. Once a device connects to a network, the network operator has numerous alternative methods to identify and track it. The per-network random MAC helps prevent cross-network correlation (your ISP cannot easily link your home activity to your office activity), but it does not provide anonymity within a single network.

What the Research Shows

Academic research on MAC randomization effectiveness paints a mixed picture.

A 2017 study by Martin et al. tested MAC randomization across 15 device models and found that 96% of Android devices and 100% of iOS devices used randomized MACs for scanning. However, the study also found that most devices could be tracked through a combination of timing, signal strength, and information element fingerprinting, with accuracy rates above 80% in moderate-density environments.

Vanhoef et al. (2016) demonstrated that sequence number tracking could link randomized MACs with high reliability. When a device changes its MAC but does not reset its sequence counter, the monotonically increasing sequence number creates a clear link between the old and new addresses. iOS eventually fixed this by resetting the sequence number on MAC change; Android fixes have been inconsistent across manufacturers.

A 2020 study by Uras et al. evaluated MAC randomization in a real-world retail environment and found that while simple MAC-based tracking was disrupted, fingerprinting techniques could still track 72% of devices across MAC changes. The researchers used a combination of probe request timing, supported rates, and information elements as features for a machine learning classifier.

More recent work by Brik et al. explored radiometric identification - using the physical characteristics of a device's radio transmitter (frequency offset, clock skew, modulation artifacts) to fingerprint individual devices. These physical-layer characteristics are determined by manufacturing variations in the radio hardware and cannot be changed by software. The research showed that individual devices could be identified with accuracy above 90% using standard SDR equipment.

Practical Limits of Current Implementations

The current state of MAC randomization can be summarized as: it raises the bar for tracking but does not prevent it for motivated adversaries.

For casual tracking (a retailer counting foot traffic with commodity hardware and basic software), MAC randomization is effective. The simple approach of counting unique MACs and assuming each represents a unique device no longer works reliably. Tracking individual devices across visits requires active effort and more sophisticated techniques.

For targeted tracking by a resourced adversary, MAC randomization provides limited protection. A combination of timing correlation, information element fingerprinting, and signal analysis can re-identify most devices with readily available equipment and publicly documented techniques.

The per-network association MAC is a significant gap. Any network you regularly connect to can track your connection patterns over time. If you connect to your employer's WiFi, they can see when you arrive and leave. If you connect to a coffee shop's WiFi, the provider can track your visit frequency. The randomization protects against cross-network linking but not within-network tracking.

BLE adds another dimension. While this article focuses on WiFi MAC randomization, many devices also broadcast BLE advertisements with their own MAC addresses. BLE randomization implementations vary and may be less mature than WiFi randomization. A device that randomizes its WiFi MAC effectively but uses a persistent BLE MAC is still trackable. Assessing the full picture of wireless emissions from a device requires examining both WiFi and BLE behavior.

Future Directions

Several approaches are being explored to strengthen MAC randomization.

Enhanced information element randomization would vary the technical fields in probe requests alongside the MAC address, making fingerprinting harder. This requires careful implementation to avoid breaking network compatibility.

Reduced probing minimizes the data available for tracking by probing less frequently or switching to purely passive scanning. Apple has moved in this direction with recent iOS versions, probing less aggressively when the device is idle.

Standardized privacy extensions in the 802.11 working group aim to incorporate privacy protections directly into the WiFi standard rather than leaving them to individual implementations. This would ensure consistent privacy behavior across all compliant devices.

Full traffic randomization would change the MAC address periodically even while connected to a network, not just during scanning. This is technically challenging because MAC changes during an active connection can cause disconnection, but some researchers have proposed methods to handle the transition seamlessly.

For security professionals assessing wireless privacy risks, the BLEShark Nano provides visibility into the BLE side of device tracking. Understanding what your devices broadcast over BLE - advertisement data, MAC addresses, service UUIDs - is essential for a complete privacy assessment. WiFi probe analysis shows one piece of the puzzle; BLE analysis shows another. Together, they reveal the full scope of your wireless footprint.