I'm going to be honest: I did NOT read your whole post, I just read the bit question at the top "Bypass MAC filtering"
First of all, let me say that this topic does vary from OS to OS - so, I'm gonna assume we're talking about Windows.
Also: Sorry for the CAPS -- it's for EMPHASIS on KEY POINTS.
Normally, I DO NOT answer these kinds of questions I just give hints at where you can look to get the info, but in this case I will give you some direct information about this. Get ready because I'm about flood you with LOTS of hacker info. The reason I don't mind giving you this kind of information is because MAC filtering on wireless networks makes NO SENSE AT ALL. Almost ANY card on ANY OS can be made to use whatever MAC you tell it to!! People that put MAC filtering on their networks are usually the types that try to "hide" their SSID, like it's some kind of secret.. silly. OK- let me also say, that if you do use MAC filtering, it makes sense to set up some kind of IDS to monitor for DUPLICATE MACs ON THE NETWORK...otherwise it's a silly waste of time and just a false sense of security.
(HERE IS THE JUICY PART) Most APs let you set up a list of trusted MAC addresses. Any packets sent from other MACs are ignored. Once upon a time (probably before you were born) there was a time when MAC addresses were static, sometimes burned into the hardware itself. Those days are long gone and this is why whenever I hear about common users MAC filtering and feeling so secure because of it, it makes me laugh out loud. (MORE JUICE HERE) In order to defeat MAC filtering here is what you do: 1. You need to get the MAC of someone already on the network. To do this you need a PASSIVE SCANNER. A passive scanner will give you a list of addressed already connected to the client. Usually, you wait for the user to disconnect from the network.. other options include DDOSing the user off (lol) or ATTEMPTING TO SHARE THE MAC ADDRESS. Once you have gotten a users MAC, it only takes a second or two to clone it! THIS IS WHERE IT GET SPECIFIC TO THE OS: Even Winblows lets you edit your MAC. The MAC for a given interface is STORED INSIDE OF A REGISTRY KEY. BUT SOME TOOLS DO EXIST TO AUTOMATE THIS! Here is how to do it: Open REGEDIT and go to:
"HKLM\SYSTEM\currentControlSet\Control\
Class\
{4D36E972-E325-11CE-BFC1-08002bE10318}"
Once you get there, look for your wireless card and when you find it you need to create a new key named:
"NetworkAddress" of the type "REG_SZ"
Next, insert the desired MAC (should be 12 digits)
(For anyone else that reads this in the future: It's NOT a good idea to set random addresses! The card might not like this if it doesn't come from the pool of valid numbers from the IEEE, so IF YOU AREN'T TRYING TO COPY SOMEONES ELSE'S MAC THEN JUST CHANGE THE LAST THREE BYTES ONLY! still specific to Winblowz btw)
All you basically need to do is use a tool like NMap to get his MAC... then there are tools you can use (even with Winblows) to spoof your MAC to anything you want..OR you can follow the detailed advice above.
There is A LOT more you can do here.. but I cannot get into that stuff for obvious ethical reasons.
ON A SIDE NOTE: MAC filtering usually takes more time that it's worth and remember that MAC filtering IS NOT A SECURITY CONTROL! Anyone can easily bypass it! There is no point to it unless you have an IDS set up that will alert you about duplicate MACs on the network! But even then, AN ATTACKER CAN JUST WAIT UNTIL YOU DISCONNECT, THEN WHAT CAN YOU DO? ...that's right...NOTHING.