lol, I used to do this all the time at non-free wifi hotspot locations, only I'd start off with a ping sweep of the entire subnet (nmap -sP) in order to get my ARP cache filled with a bunch of potential usable IP/mac addresses on the network. From there, I'd iterate through each one and set the IP & mac address until I found one that would let me through the firewall.
Granted, being a NOC engineer at Wayport (now AT&T WiFi) certainly helped me understand how it all works.
Granted, being a NOC engineer at Wayport (now AT&T WiFi) certainly helped me understand how it all works.