What Is a MAC Address?

A MAC address is a unique 48-bit hardware identifier assigned to a network interface card so devices can be identified on a local network. MAC stands for Media Access Control, and the address operates at Layer 2, the Data Link layer, of the OSI model. The Institute of Electrical and Electronics Engineers (IEEE) administers MAC address assignment through the IEEE 802 standards.

This article defines the MAC address, explains its 48-bit hexadecimal format and the split between the manufacturer identifier and the device portion, compares a MAC address with an IP address across Layer 2 and Layer 3, describes how network switches use MAC addresses to forward frames, covers MAC filtering and MAC address randomization, and shows how to find a MAC address on common systems. A MAC address is burned into the network interface card hardware at manufacture, which separates the MAC address from the changeable IP address a router assigns. Each section names the standard, format, or command involved.

What Is a MAC Address?

A MAC address is a unique 48-bit identifier permanently assigned to a network interface card to identify a device on a local network at the Data Link layer. MAC stands for Media Access Control. The MAC address is also called the physical address or the hardware address, because the manufacturer writes the MAC address into the network interface card during production.

The IEEE governs the structure of every MAC address so that no two cards share the same value. A MAC address operates at Layer 2 of the OSI model, which means a MAC address identifies a device only within a single local network segment and does not cross a router. The MAC address differs from the logical address that a network assigns after a device connects.

What Is the Format of a MAC Address?

A MAC address consists of 48 bits written as six pairs of hexadecimal digits separated by colons or hyphens, such as 00:1A:2B:3C:4D:5E. The 48 bits split into two equal halves of 24 bits each.

• The first 24 bits form the OUI. The Organizationally Unique Identifier identifies the manufacturer of the network interface card and is assigned by the IEEE.
• The last 24 bits form the device identifier. The manufacturer assigns this portion to each individual card so the full address stays unique.
• Hexadecimal digits represent the value. Each of the six pairs ranges from 00 to FF, giving 2 to the power of 48, or roughly 281 trillion, possible addresses.
• Separators vary by system. Windows often uses hyphens, while Linux and macOS use colons, and some vendors group the address into three blocks of four digits.

The IEEE maintains a public registry of OUI assignments. A lookup of the first three octets returns the manufacturer of the card, which helps identify an unknown device on a network.

What Is the Difference Between a MAC Address and an IP Address?

A MAC address is a permanent Layer 2 hardware identifier, while an IP address is a changeable Layer 3 logical identifier assigned by the network. The table below compares the two address types across their defining attributes.

A device uses both addresses at once. The IP address routes a packet to the correct network, and the MAC address delivers the frame to the correct device on the final network segment. The full role of the logical address appears in the overview of an IP address.

How Do Switches Use MAC Addresses?

A network switch reads the destination MAC address of each frame and forwards the frame only to the port connected to that device. The switch builds a MAC address table to map addresses to ports.

1. The switch receives a frame and records the source MAC address against the port it arrived on.
2. The switch stores this pairing in a MAC address table, also called a CAM table.
3. The switch reads the destination MAC address of the frame.
4. The switch forwards the frame out of the single port that matches the destination address.
5. The switch floods the frame to all ports if the destination address is not yet in the table.

The Address Resolution Protocol (ARP) links an IP address to a MAC address so a device can build the frame. ARP lets a sender discover the MAC address that belongs to a known IP address on the local network.

What Is MAC Filtering?

MAC filtering is a router feature that allows or blocks devices on a network based on a list of approved or denied MAC addresses. An administrator enters the MAC address of each permitted device into the router.

• An allowlist permits named devices. The router accepts only the MAC addresses on the approved list and blocks every other device.
• A blocklist denies named devices. The router blocks specific MAC addresses while allowing all others to connect.
• MAC filtering adds a control layer, not strong security. A MAC address travels unencrypted in every frame, so an attacker can read and copy an approved address.
• MAC spoofing defeats the filter. Spoofing changes the reported MAC address in software to match an approved value and bypass the list.

What Is MAC Address Randomization?

MAC address randomization replaces the permanent hardware MAC address with a random value when a device scans for or joins a Wi-Fi network, to limit tracking. Apple, Google, and Microsoft added randomization to iOS, Android, and Windows.

A device that broadcasts its real MAC address can be tracked across locations, because the address stays constant. Randomization generates a different address per network or per scan, so observers cannot link the device across separate Wi-Fi networks.

The feature affects MAC filtering, because a randomized address does not match a stored allowlist entry. A user can disable randomization for a trusted network so the device presents a consistent address to a filter or a static lease.

How Do You Find a MAC Address?

A MAC address is found through a command-line tool or the network settings of the operating system. Each system labels the value as the physical address or the hardware address.

• On Windows, run getmac or ipconfig /all. The Physical Address line under each adapter shows the MAC address.
• On macOS, open Network settings or run ifconfig. The ether line for the active interface shows the MAC address.
• On Linux, run ip link or ifconfig. The link/ether value lists the MAC address of each interface.
• On a phone, open the Wi-Fi or About settings. The Wi-Fi MAC address appears under the device information or network details.

The router admin page also lists the MAC address of every connected device beside its assigned IP address. Confirming which address belongs to a device helps before assigning it a static IP address.

What Are the Types of MAC Addresses?

MAC addresses divide into three types: unicast, multicast, and broadcast, based on how many devices a frame reaches. A single bit in the first octet sets the type.

• A unicast MAC address targets one device. The least significant bit of the first octet is 0, and the frame reaches a single network interface card.
• A multicast MAC address targets a group. The least significant bit of the first octet is 1, and the frame reaches every device subscribed to the group.
• The broadcast MAC address targets all devices. The address FF:FF:FF:FF:FF:FF reaches every device on the local network segment at once.
• A universal address differs from a local one. The second-least bit marks whether the IEEE assigned the address universally or an administrator set it locally.

The broadcast address carries protocols such as ARP that must reach every device. A switch forwards a broadcast frame out of every port except the one it arrived on.

What Is MAC Address Spoofing?

MAC address spoofing is the practice of changing the MAC address a device reports in software to a value other than the one burned into the hardware. The operating system overrides the hardware address before frames leave the interface.

A user spoofs a MAC address to bypass a MAC filter, to replace a failed device that holds a fixed lease, or to limit tracking on a public network. An attacker spoofs a MAC address to impersonate an approved device and join a restricted network. Spoofing is possible because the MAC address travels unencrypted in every frame, so any device on the segment can read an approved address and copy it.

The ease of spoofing is the reason MAC filtering provides weak security on its own. Tools on Windows, macOS, and Linux change the reported address through the adapter settings or a command.

Key Takeaways

• A MAC address is a 48-bit hardware identifier. The manufacturer writes the address into the network interface card at production.
• The address splits into OUI and device parts. The first 24 bits identify the vendor, and the last 24 bits identify the card.
• A MAC address works at Layer 2. The address identifies a device on a local network and does not cross a router.
• Switches forward frames by MAC address. A switch maps each address to a port in its MAC address table.
• Randomization limits Wi-Fi tracking. Modern devices present a random MAC address when scanning or joining a network.

Last Thoughts on a MAC Address

A MAC address is the 48-bit hardware identifier that a manufacturer writes into a network interface card so the device is uniquely named on a local network. The address splits into a vendor prefix assigned by the IEEE and a device portion, and the address operates at Layer 2 while an IP address operates at Layer 3.

Switches forward frames by reading the destination MAC address, MAC filtering allows or blocks devices by address, and randomization hides the permanent address on Wi-Fi. The layer where a MAC address operates is explained in the overview of the OSI model, the logical counterpart in the overview of an IP address, and the wider structure on the how networks work hub.