A MAC address is a unique 48-bit hardware identifier assigned to a network interface so a device can be reached on a local network at Layer 2, the Data Link layer. It is written as six pairs of hexadecimal digits, such as 00:1A:2B:3C:4D:5E, where the first half identifies the manufacturer and the second half identifies the individual card. A switch uses the MAC address to deliver each frame to the correct device, while an IP address handles routing between networks. The address is burned in at manufacture, but devices now randomize it by default on Wi-Fi to limit tracking.
What Is a MAC Address?
A MAC address is a unique 48-bit identifier assigned to a network interface so a device can be reached on a single local network at the Data Link layer. MAC stands for Media Access Control. It is also called the physical address or the hardware address, because the manufacturer writes it into the network interface card during production.
The Institute of Electrical and Electronics Engineers (IEEE) governs the structure of every MAC address through the IEEE 802 standards, so no two cards ship with the same value. A MAC address operates at Layer 2 of the OSI model, which means it identifies a device only within one local network segment and does not cross a router. That is the key boundary: the MAC address is the local hardware name, while the address a network hands out is a separate, routable logical name.
What Is the Format of a MAC Address?
A MAC address is 48 bits written as six pairs of hexadecimal digits separated by colons or hyphens, such as 00:1A:2B:3C:4D:5E. The 48 bits split into two equal halves of 24 bits each:
- The first 24 bits form the OUI. The Organizationally Unique Identifier names the manufacturer of the card and is assigned by the IEEE Registration Authority.
- The last 24 bits form the device identifier. The manufacturer assigns this portion to each card so the full address stays unique.
- Each pair is hexadecimal, 00 to FF. Six pairs give 2 to the power of 48, or roughly 281 trillion possible addresses.
- Separators vary by system. Windows tends to use hyphens, Linux and macOS use colons, and some vendors group the value into three blocks of four digits.
The classic 24-bit OUI (called an MA-L block) suits large vendors, while the IEEE also issues smaller MA-M (28-bit) and MA-S (36-bit) blocks to mid-size and IoT makers, leaving them fewer device bits. The IEEE keeps a public OUI registry, so a lookup of the first three octets returns the maker of an unknown card, which makes the full 48-bit value an EUI-48.
What Is the Difference Between a MAC Address and an IP Address?
A MAC address is a permanent Layer 2 hardware identifier, while an IP address is a changeable Layer 3 logical identifier assigned by the network. The two are not rivals; a device uses both at once on every connection.
| Attribute | MAC Address | IP Address |
|---|---|---|
| OSI layer | Layer 2 (Data Link) | Layer 3 (Network) |
| Assigned by | Manufacturer of the NIC | Router, DHCP, or administrator |
| Format | 48-bit hexadecimal (6 pairs) | 32-bit IPv4 or 128-bit IPv6 |
| Scope | Local network segment only | Across networks and the internet |
| Changeable | Fixed in hardware, can be spoofed | Changes when the network changes |
| Purpose | Identifies a device on a LAN | Routes data between networks |
In practice the IP address routes a packet to the correct network, then the MAC address delivers the frame to the correct device on the final segment. The logical side is covered in the overview of an IP address and the way the two generations of IP differ in IPv4 vs IPv6.
How Do You Read a MAC Address?
You read a MAC address by splitting it in half: the first three octets are the manufacturer prefix, the last three are the device portion.
- Take the first three pairs. In 00:1A:2B:3C:4D:5E the OUI is 00:1A:2B, the part the IEEE assigned to the maker.
- Look up the OUI. The IEEE public registry maps that prefix to a vendor, so you can name the brand of an unknown card.
- Take the last three pairs. 3C:4D:5E is the device identifier the manufacturer assigned to that specific card.
- Check the first octet’s low bits. One bit marks unicast or multicast, and the next marks whether the address is IEEE-assigned (universal) or locally administered, as a randomized address is.
That second-least-significant bit is how you spot a randomized or spoofed address: a locally administered address has it set, while a genuine burned-in address does not.
How Do Switches Use MAC Addresses?
A network switch reads the destination MAC address of each frame and forwards it only to the port connected to that device. To do this it builds a MAC address table, also called a CAM table, that maps addresses to ports.
- The switch receives a frame and records the source MAC address against the port it arrived on.
- The switch stores this pairing in its MAC address (CAM) table.
- The switch reads the destination MAC address of the frame.
- The switch forwards the frame out of the single port that matches the destination address.
- The switch floods the frame to all ports if the destination address is not yet in the table.
The Address Resolution Protocol (ARP) ties an IP address to a MAC address so a sender can build the frame in the first place, discovering the MAC address that belongs to a known IP on the local network. More on the device that does this forwarding is in the overview of a network switch.
What Are the Types of MAC Addresses?
MAC addresses divide into three types, unicast, multicast, and broadcast, based on how many devices a frame reaches. A single bit in the first octet sets the type:
- A unicast address targets one device. The least significant bit of the first octet is 0, and the frame reaches a single network card.
- A multicast address targets a group. That bit is 1, and the frame reaches every device subscribed to the group.
- The broadcast address targets all devices. The value FF:FF:FF:FF:FF:FF reaches every device on the local segment at once.
- Universal differs from local. The second-least-significant bit marks whether the IEEE assigned the address (universal) or software set it (locally administered).
The broadcast address carries protocols such as ARP that must reach every device, and a switch forwards a broadcast frame out of every port except the one it arrived on.
What Is MAC Filtering?
MAC filtering is a router feature that allows or blocks devices based on a list of approved or denied MAC addresses. An administrator enters the MAC address of each permitted device into the router.
- An allowlist permits named devices. The router accepts only the addresses on the approved list and blocks every other device.
- A blocklist denies named devices. The router blocks specific addresses while allowing all others to connect.
- It adds a control layer, not real security. A MAC address travels unencrypted in every frame, so anyone nearby can read an approved value.
- Spoofing defeats the filter. Changing the reported MAC address in software to match an approved value bypasses the list entirely.
What Is MAC Address Spoofing?
MAC address spoofing is changing the MAC address a device reports in software to a value other than the one burned into the hardware. The operating system overrides the hardware address before frames leave the interface.
People spoof a MAC address for legitimate reasons, to bypass a filter on their own network, to keep a fixed lease when replacing a failed device, or to limit tracking on a public network. An attacker spoofs one to impersonate an approved device and join a restricted network. It is easy because the MAC address travels unencrypted in every frame, so any device on the segment can read an approved value and copy it, and Windows, macOS, and Linux all expose the setting through the adapter or a command. That ease is exactly why MAC filtering is weak on its own.
How Do You Find a MAC Address?
A MAC address is found through a command-line tool or the network settings of the operating system. Each system labels the value as the physical address or the hardware address.
- On Windows, run getmac or ipconfig /all. The Physical Address line under each adapter shows the MAC address.
- On macOS, open Network settings or run ifconfig. The ether line for the active interface shows the MAC address.
- On Linux, run ip link or ifconfig. The link/ether value lists the MAC address of each interface.
- On a phone, open the Wi-Fi or About settings. The Wi-Fi MAC address appears under device information or network details, often labeled private if randomization is on.
The router admin page also lists the MAC address of every connected device beside its assigned IP address. Confirming which address belongs to a device is the usual first step before assigning it a static IP address.
Last Thoughts on MAC Addresses
A MAC address is the 48-bit hardware identifier a manufacturer writes into a network interface so the device is uniquely named on a local network. It splits into a vendor prefix (the OUI) assigned by the IEEE and a device portion, and it operates at Layer 2 while an IP address operates at Layer 3. The two work together on every connection: the IP address routes a packet to the right network, and the MAC address delivers the frame to the right device on the final hop.
Switches forward frames by reading the destination MAC address, MAC filtering allows or blocks devices by address but is easily spoofed, and randomization now hides the permanent address on Wi-Fi by default. The wider structure these pieces fit into is laid out in the overview of a computer network.
Key Takeaways:
- A MAC address is a 48-bit hardware identifier written into the network interface at manufacture.
- It is six hexadecimal pairs; the first 24 bits are the OUI (vendor prefix), the last 24 bits identify the card.
- A MAC address works at Layer 2 and stays on the local segment, while an IP address works at Layer 3 and routes between networks.
- Switches forward frames by mapping each MAC address to a port in their CAM table.
- MAC filtering is weak security because the address is sent unencrypted and is trivially spoofed; encryption is the real defense.
- Phones and laptops now randomize the MAC address by default on Wi-Fi to limit tracking.
Frequently Asked Questions (FAQs)
What is a MAC address in simple terms?
A MAC address is a 48-bit hardware identifier built into a network interface so a device can be reached on a local network. It works at Layer 2, the Data Link layer, and a switch uses it to deliver each frame to the right device.
What does a MAC address look like?
A MAC address is 48 bits written as six pairs of hexadecimal digits, such as 00:1A:2B:3C:4D:5E. The first three pairs are the manufacturer prefix (the OUI) and the last three identify the individual card.
What is the difference between a MAC address and an IP address?
A MAC address is a fixed Layer 2 hardware identifier assigned by the manufacturer and used only on the local segment. An IP address is a changeable Layer 3 logical address assigned by the network and used to route data between networks.
Can a MAC address be changed?
The burned-in address is fixed in hardware, but the address a device reports can be changed in software through MAC spoofing. Phones and laptops also randomize the MAC address by default when scanning for or joining Wi-Fi to limit tracking.
Is MAC filtering good security?
No. MAC filtering is a weak control because a MAC address travels unencrypted in every frame, so an attacker can read an approved address and spoof it to bypass the list. Use WPA2 or WPA3 encryption as the real defense and treat filtering as a minor extra.
Why does my phone show a random MAC address?
Modern phones present a private, randomized MAC address per network so you cannot be tracked across Wi-Fi locations. Apple calls it Private Wi-Fi Address, Android has used randomization by default since Android 10, and Windows 11 offers random hardware addresses with a daily-rotate option.
