MAC Address: Complete Guide

A MAC (Media Access Control) address is a unique identifier assigned to network interfaces for communications at the data link layer of a network. While IP addresses can change, MAC addresses are typically permanent hardware identifiers. Understanding MAC addresses is essential for network administration, troubleshooting, and security.

What is a MAC Address?

A MAC address is a 48-bit (6-byte) hardware identifier assigned to network interface controllers (NICs) by manufacturers. It uniquely identifies each device on a local network segment.

MAC Address Format

Standard notation: 00:1A:2B:3C:4D:5E 00-1A-2B-3C-4D-5E 001A.2B3C.4D5E (Cisco format)

Components: - First 24 bits (3 bytes): OUI (Organizationally Unique Identifier) - identifies manufacturer - Last 24 bits (3 bytes): NIC-specific identifier - unique to device

Example breakdown: 00:1A:2B:3C:4D:5E └─┬──┘ └───┬────┘ OUI Device ID (Manufacturer) (Unique)

Common OUI Examples

| OUI | Manufacturer | |-----|--------------| | 00:50:56 | VMware | | 00:0C:29 | VMware | | 08:00:27 | VirtualBox | | 00:1B:63 | Apple | | 00:50:F2 | Microsoft | | 00:15:5D | Microsoft Hyper-V | | DC:A6:32 | Raspberry Pi |

MAC Address vs IP Address

Key Differences

| Feature | MAC Address | IP Address | |---------|-------------|------------| | Layer | Data Link (Layer 2) | Network (Layer 3) | | Scope | Local network only | Global (routable) | | Assignment | Manufacturer (hardware) | DHCP or manual (software) | | Permanence | Usually permanent | Can change | | Format | 48-bit hexadecimal | 32-bit (IPv4) or 128-bit (IPv6) | | Example | 00:1A:2B:3C:4D:5E | 192.168.1.100 | | Purpose | Local device identification | Network routing |

How They Work Together

When you send data over a network:

Application layer: Uses domain name (google.com)
DNS resolution: Converts to IP address (142.250.185.46)
Network layer: Uses IP address for routing
Data link layer: Uses MAC address for local delivery
Physical layer: Transmits actual bits

Example communication: Your Computer (192.168.1.100, MAC: AA:BB:CC:DD:EE:FF) ↓ Needs to reach: 8.8.8.8 (Google DNS) ↓ Sends to gateway: 192.168.1.1 ↓ Uses ARP to find gateway's MAC address ↓ Packet sent to gateway's MAC: 11:22:33:44:55:66 ↓ Gateway routes based on IP address

How MAC Addresses Work

ARP (Address Resolution Protocol)

ARP translates IP addresses to MAC addresses on local networks.

ARP Process: 1. Device needs to send data to 192.168.1.50 2. Checks ARP cache for MAC address 3. If not found, broadcasts ARP request: "Who has 192.168.1.50?" 4. Device with that IP responds: "I'm 192.168.1.50, my MAC is XX:XX:XX:XX:XX:XX" 5. Requesting device caches this information 6. Data sent using destination MAC address

View ARP cache:

Windows: arp -a

Linux/Mac: arp -n ip neighbor show

MAC Address Tables (Switches)

Network switches maintain MAC address tables to forward frames efficiently.

How switches learn: 1. Frame arrives on port 1 with source MAC AA:BB:CC:DD:EE:FF 2. Switch records: "MAC AA:BB:CC:DD:EE:FF is on port 1" 3. When frame destined for that MAC arrives, switch forwards only to port 1 4. Reduces unnecessary traffic on other ports

View MAC table (Cisco switch): show mac address-table

Types of MAC Addresses

Unicast MAC Address

Identifies a single network interface.

Format: Least significant bit of first octet is 0

Example: 00:1A:2B:3C:4D:5E Binary first octet: 00000000 (LSB is 0)

Multicast MAC Address

Identifies a group of devices.

Format: Least significant bit of first octet is 1

Example: 01:00:5E:00:00:01 (IPv4 multicast) 33:33:00:00:00:01 (IPv6 multicast) Binary first octet: 00000001 (LSB is 1)

Broadcast MAC Address

Sent to all devices on local network.

Address: FF:FF:FF:FF:FF:FF

Use cases: - ARP requests - DHCP discovery - Network announcements

Finding Your MAC Address

Windows

Method 1: Command Prompt ipconfig /all Look for "Physical Address"

Method 2: Settings Settings → Network & Internet → Status → View hardware properties

Method 3: Network Connections Control Panel → Network Connections → Right-click adapter → Status → Details

macOS

Method 1: Terminal ifconfig Look for "ether"

Method 2: System Preferences System Preferences → Network → Advanced → Hardware

Method 3: System Information Apple menu → About This Mac → System Report → Network

Linux

Method 1: Terminal ip link show ifconfig

Method 2: Network Manager nmcli device show

Method 3: System Settings Settings → Network → Gear icon → Details

Mobile Devices

iOS: Settings → General → About → Wi-Fi Address

Android: Settings → About Phone → Status → Wi-Fi MAC Address

Router/Network Devices

Access router admin panel: Usually at 192.168.1.1 or 192.168.0.1 Look in Status or Device Info section

MAC Address Spoofing

What is MAC Spoofing?

Changing your device's MAC address to impersonate another device or hide your identity.

Why Spoof MAC Addresses?

Legitimate reasons: - Bypass MAC-based access controls for testing - Replace network card without reconfiguring - Privacy on public networks - Network troubleshooting

Malicious reasons: - Bypass network access controls - Impersonate authorized devices - Evade tracking - Launch attacks

How to Change MAC Address

Windows: Device Manager → Network Adapters → Right-click adapter → Properties → Advanced → Network Address → Enter new MAC

Linux: sudo ifconfig eth0 down sudo ifconfig eth0 hw ether 00:11:22:33:44:55 sudo ifconfig eth0 up

macOS: sudo ifconfig en0 ether 00:11:22:33:44:55

Note: Changes are usually temporary and reset after reboot.

Detecting MAC Spoofing

Signs of spoofing: - Duplicate MAC addresses on network - MAC address doesn't match OUI database - Unusual MAC address patterns - Conflicts in ARP tables

Detection tools: - Network monitoring software - IDS/IPS systems - Switch port security - ARP monitoring

MAC Address Security

MAC Address Filtering

Routers can restrict network access based on MAC addresses.

How it works: 1. Configure allowed MAC addresses in router 2. Router only permits traffic from listed MACs 3. Unknown devices are blocked

Pros: - Simple to implement - No client configuration needed - Basic access control

Cons: - Easily bypassed by MAC spoofing - Maintenance overhead (adding/removing devices) - False sense of security - Not effective as primary security measure

Recommendation: Use as supplementary security, not primary defense. Combine with WPA3 encryption and strong passwords.

Port Security (Switches)

Enterprise switches can restrict which MAC addresses are allowed on each port.

Configuration (Cisco example): interface GigabitEthernet0/1 switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security mac-address sticky switchport port-security violation restrict

Violation actions: - Protect: Drops packets from unauthorized MACs - Restrict: Drops packets and logs violation - Shutdown: Disables port entirely

MAC Address Privacy

Privacy concerns: - MAC addresses can track your device - Public WiFi networks log MAC addresses - Retailers use MAC tracking for analytics - Persistent across network changes

Privacy protection: - Use MAC randomization (available on modern devices) - Change MAC address periodically - Disable WiFi when not in use - Use VPN for additional privacy

MAC Randomization: Modern operating systems support random MAC addresses: - iOS 14+: Enabled by default for WiFi - Android 10+: Randomization per network - Windows 10: Random MACs for WiFi - macOS: Available in recent versions

Troubleshooting with MAC Addresses

Common Issues

Duplicate MAC Addresses

Symptoms: - Intermittent connectivity - IP conflicts - Network instability

Causes: - Cloned virtual machines - MAC spoofing - Manufacturing defects (rare)

Solutions: - Identify conflicting devices - Change MAC on virtual machines - Investigate unauthorized devices

ARP Cache Poisoning

Symptoms: - Man-in-the-middle attacks - Traffic redirection - Network performance issues

Detection: arp -a Look for duplicate IP entries with different MACs

Prevention: - Static ARP entries for critical devices - Dynamic ARP Inspection (DAI) on switches - Network monitoring

MAC Flooding Attack

Attack: Overwhelm switch MAC table with fake entries

Result: Switch acts as hub, broadcasting all traffic

Prevention: - Port security on switches - MAC address table limits - Network monitoring

Diagnostic Commands

View MAC address: Windows: getmac Linux: ip link show Mac: ifconfig

View ARP table: Windows: arp -a Linux: ip neighbor Mac: arp -a

Clear ARP cache: Windows: arp -d Linux: ip neighbor flush all Mac: sudo arp -d -a

MAC Addresses in Different Technologies

Ethernet

Standard 48-bit MAC addresses as described above.

WiFi

Uses same MAC address format as Ethernet. Modern devices may use randomized MACs for privacy.

Bluetooth

Uses 48-bit Bluetooth Device Address (BD_ADDR), similar format to MAC addresses.

Virtual Machines

Hypervisors assign virtual MAC addresses: - VMware: 00:50:56:XX:XX:XX or 00:0C:29:XX:XX:XX - VirtualBox: 08:00:27:XX:XX:XX - Hyper-V: 00:15:5D:XX:XX:XX

Containers (Docker)

Docker assigns MAC addresses to container network interfaces, typically in the 02:42:XX:XX:XX:XX range.

MAC Address Best Practices

For Users

Know your MAC addresses - Document MACs of your devices
Enable MAC randomization - Use privacy features on mobile devices
Monitor for duplicates - Check for MAC conflicts
Secure your network - Don't rely solely on MAC filtering
Update firmware - Keep network devices updated

For Network Administrators

Document MAC addresses - Maintain inventory of authorized devices
Implement port security - Restrict MACs on switch ports
Monitor MAC tables - Watch for unusual activity
Use DHCP reservations - Tie IP addresses to MAC addresses
Enable logging - Track MAC-based events
Regular audits - Review connected devices periodically

For Security

Don't rely on MAC filtering alone - Use strong encryption (WPA3)
Implement 802.1X - Network access control
Monitor for spoofing - Detect MAC address changes
Use VLANs - Segment network by function
Enable DAI - Dynamic ARP Inspection on switches

Advanced Topics

EUI-64 (Extended Unique Identifier)

IPv6 can derive interface IDs from MAC addresses using EUI-64:

Process: 1. Take MAC: 00:1A:2B:3C:4D:5E 2. Insert FF:FE in middle: 00:1A:2B:FF:FE:3C:4D:5E 3. Flip 7th bit: 02:1A:2B:FF:FE:3C:4D:5E 4. Result: IPv6 interface ID

Privacy concerns: Reveals hardware MAC in IPv6 address

Solution: IPv6 privacy extensions generate random interface IDs

MAC-in-MAC Encapsulation

Used in provider networks to tunnel customer MAC addresses: - IEEE 802.1ah (Provider Backbone Bridges) - Allows multiple customer networks over shared infrastructure - Preserves customer MAC addresses

MAC Address Aging

Switches remove MAC table entries after inactivity: - Default aging time: 300 seconds (5 minutes) - Configurable: Can be adjusted based on needs - Purpose: Free up table space, adapt to topology changes

Conclusion

MAC addresses are fundamental to network communication, providing unique hardware identifiers for devices on local networks. While they operate at a lower level than IP addresses, understanding MAC addresses is crucial for network administration, troubleshooting, and security.

Network Fundamentals

ARP - IP to MAC address mapping
What is an IP Address? - Layer 3 addressing
DHCP - MAC-based IP assignment
Broadcast Address - MAC broadcast

IPv6 and MAC

IPv6 Address Format - EUI-64 from MAC
IPv6 Privacy Extensions - Hiding MAC in IPv6
What is an IPv6 Address? - SLAAC uses MAC

Security

Firewall Basics - MAC filtering
IP Spoofing - MAC spoofing
Network Scanning - MAC discovery
Hide IP Address - MAC and privacy

Network Management

Network Troubleshooting - MAC issues
IP Conflict - Duplicate MAC addresses
Change IP Address - MAC remains same

Explore More

Networking Basics - Essential concepts
OSI Model - Layer 2 data link

Key takeaways: - MAC addresses are 48-bit hardware identifiers assigned by manufacturers - They work at Layer 2 (Data Link) for local network communication - ARP translates between IP addresses and MAC addresses - MAC filtering provides basic security but is easily bypassed - Modern devices support MAC randomization for privacy - Switches use MAC addresses to efficiently forward traffic - MAC spoofing is possible but detectable - Combine MAC-based controls with strong encryption and authentication

Whether you're setting up a home network, administering enterprise infrastructure, or troubleshooting connectivity issues, knowledge of MAC addresses helps you understand how devices communicate and how to secure your network effectively.