Free lesson · Computer Networking

macOS / Linux

Easy10 min readnetworkingcomputer-networkstcp-ip

The Address That Lives in Hardware

Every network interface on every device - your laptop's Wi-Fi adapter, your phone's cellular modem, your server's Ethernet port - has a MAC address (Media Access Control address). This address is typically assigned by the manufacturer at the factory and burned into the hardware, making it a permanent identifier for that specific network interface.

MAC addresses operate at Layer 2 (Data Link) of the OSI model. They are the addressing mechanism that Ethernet and Wi-Fi use to deliver frames to the correct device on a local network. When a switch receives a frame, it reads the destination MAC address and forwards the frame to the port where that MAC address was last seen. Without MAC addresses, local network delivery would be impossible - every frame would have to be broadcast to every device, turning every network into a hub.

Think of a MAC address as a serial number engraved on a physical mailbox. It identifies a specific mailbox (network interface) regardless of which street it is on (which network it is connected to). An IP address, by contrast, is like a street address - it tells routers how to find you on the network, and it changes if you move to a different network. Both addressing systems are needed: MAC for local delivery within a network segment, IP for routing across networks.

MAC Address Format

A MAC address is 48 bits (6 bytes) long, typically written as six groups of two hexadecimal digits separated by colons or hyphens:

a4:83:e7:2b:5c:01    (colon notation - most common on Mac/Linux)
A4-83-E7-2B-5C-01    (hyphen notation - most common on Windows)
a483.e72b.5c01       (dot notation - Cisco convention)

All three representations describe the same address. The hex characters can be uppercase or lowercase - a4 and A4 are identical.

The 48 bits are divided into two halves with different meanings:

|<------- OUI (24 bits) ------->|<---- Device ID (24 bits) ---->|
|  a4  :  83  :  e7  |  2b  :  5c  :  01  |
|   Manufacturer ID   |   Unique per device  |

OUI (Organizationally Unique Identifier): The first 24 bits (3 bytes) identify the manufacturer. Apple, Cisco, Intel, Samsung - each has one or more OUI codes assigned by the IEEE. You can look up any OUI at the IEEE's public registry to determine which company manufactured the network interface.

Device Identifier: The remaining 24 bits (3 bytes) are assigned by the manufacturer to uniquely identify each individual network interface they produce. With 24 bits, a manufacturer can produce up to 16.7 million interfaces per OUI before needing a new OUI allocation.

Example: Identifying the manufacturer from a MAC address:

MAC address: 00:1A:2B:3C:4D:5E

OUI (first three octets): 00:1A:2B

Looking up 001A2B in the IEEE OUI registry reveals the manufacturer (in this case, Ayecom Technology). Every network forensics tool and Wireshark itself can perform this lookup automatically, showing the manufacturer name alongside the MAC address in packet captures.

This can be useful for troubleshooting - if you see unexpected traffic from a MAC address with an OUI belonging to a surveillance camera manufacturer, you know there is a camera on your network even if you did not expect one.

Special MAC Addresses

Not every MAC address identifies a single device. Several special addresses serve specific purposes:

Broadcast address: FF:FF:FF:FF:FF:FF - a frame sent to this address is delivered to every device on the local network. ARP requests use broadcast to ask "who has this IP address?" because the sender does not yet know the target's MAC address. Broadcast traffic is why large flat networks become slow - every device must process every broadcast frame.

Multicast addresses: Any MAC address with the least significant bit of the first byte set to 1 is a multicast address. Multicast frames are delivered to a group of devices that have opted into receiving traffic for that multicast group, rather than to all devices (broadcast) or a single device (unicast). IPv6 uses multicast heavily - for example, 33:33:00:00:00:01 is the multicast address for all IPv6 nodes on the local link.

Locally administered addresses: The second least significant bit of the first byte indicates whether the address was assigned by the manufacturer (0 = globally unique, assigned by the IEEE) or configured locally by an administrator or software (1 = locally administered). Locally administered addresses are used by VMs, containers, and software-defined networking, where generating a unique hardware address from the IEEE registry is impractical. Docker, for example, assigns locally administered MAC addresses to each container's virtual network interface.

graph TD
    subgraph MACTypes["MAC Address Types"]
        direction TB
        UNI["Unicast<br/>Single device<br/>e.g., a4:83:e7:2b:5c:01"]
        BROAD["Broadcast<br/>All devices<br/>FF:FF:FF:FF:FF:FF"]
        MULTI["Multicast<br/>Group of devices<br/>First byte LSB = 1"]
    end

    subgraph Admin["Administration"]
        direction TB
        GLOBAL["Globally Unique (UAA)<br/>Assigned by manufacturer<br/>Second bit of first byte = 0"]
        LOCAL["Locally Administered (LAA)<br/>Set by software/admin<br/>Second bit of first byte = 1"]
    end

    style UNI fill:#4f46e5,stroke:#4338ca,color:#fff
    style BROAD fill:#7c3aed,stroke:#6d28d9,color:#fff
    style MULTI fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style GLOBAL fill:#a78bfa,stroke:#8b5cf6,color:#fff
    style LOCAL fill:#c4b5fd,stroke:#a78bfa,color:#000

This diagram shows the types of MAC addresses. Under MAC Address Types, there are three categories: Unicast addresses that identify a single device, Broadcast addresses (all F's) that reach all devices on the local network, and Multicast addresses where the least significant bit of the first byte is set to 1, reaching a group of devices. Under Administration, there are two categories: Globally Unique addresses assigned by manufacturers where the second bit of the first byte is 0, and Locally Administered addresses set by software or administrators where the second bit is 1.

MAC vs IP - Two Addressing Systems for Two Different Jobs

One of the most common sources of confusion for networking beginners is why two addressing systems exist. If IP addresses can identify any device on the internet, why do we also need MAC addresses? The answer comes down to the fundamental difference between local delivery and global routing.

The key insight is that MAC addresses are flat while IP addresses are hierarchical. A MAC address like a4:83:e7:2b:5c:01 tells you nothing about where the device is on the network - it just identifies the hardware. An IP address like 10.0.3.15 tells you the device is on network 10.0.3.0/24, which a router can use to make forwarding decisions.

This is why both are needed. Routers use IP addresses to find the correct network. Once the packet reaches the correct local network, switches use MAC addresses to find the correct device. The translation from IP to MAC - "I know the destination IP, but I need the destination MAC to actually deliver the frame" - is handled by ARP (Address Resolution Protocol), which we cover in Topic 6.

An analogy that makes this concrete: imagine you are sending a package from New York to a colleague in an office building in San Francisco. The street address (123 Market Street, San Francisco, CA 94105) is like the IP address - it gets the package to the right building. But once the package arrives at the building, the mailroom needs the recipient's name or office number to deliver it to the right desk. The office number is like the MAC address - it handles the final, local delivery.

The key difference is that the street address is hierarchical (state → city → street → number) which enables routing, while the office number is flat (just a number, no geographic hierarchy). The same hierarchical-vs-flat distinction applies to IP addresses vs MAC addresses, and it explains why routers use IP addresses (they need hierarchical structure for routing decisions) while switches use MAC addresses (they only need a flat lookup table for local forwarding).

The MAC Address Table

Switches maintain a MAC address table (also called a CAM table - Content Addressable Memory table) that maps MAC addresses to switch ports. When a frame arrives at the switch, it reads the source MAC address and records which port it came from. Over time, the switch builds a complete map of which MAC address is reachable through which port.

When a frame arrives with a destination MAC that the switch has seen before, it forwards the frame only to the port where that MAC was recorded. When the destination MAC is unknown (not in the table), the switch floods the frame - sending it out every port except the one it arrived on. The device with that MAC address will respond, and the switch will learn which port it is on.

MAC address table entries have a timeout (typically 300 seconds / 5 minutes). If the switch does not see traffic from a MAC address within the timeout period, it removes the entry. This handles the case where a device is unplugged and plugged into a different port - the old entry expires, and the new port is learned when the device transmits.

The learning process happens automatically and continuously. There is no manual configuration - the switch passively observes traffic and builds its table from the source MAC addresses of incoming frames. This self-learning behavior is what makes Ethernet switches plug-and-play devices that work without any configuration in most environments. You plug in a cable, the switch learns the new device's MAC address within the first frame it sends, and traffic starts flowing correctly.

In large enterprise networks or data centers, switches may connect to other switches, creating a hierarchy. When Switch A is connected to Switch B on port 5, Switch A's MAC address table records all of Switch B's devices as reachable via port 5. The MAC address table does not distinguish between a directly connected device and a device reachable through another switch - it simply maps the MAC to the port where frames from that MAC arrive.

graph TD
    subgraph Switch["Switch MAC Address Table"]
        direction TB
        TABLE["MAC Address Table<br/><br/>Port 1 → a4:83:e7:2b:5c:01<br/>Port 2 → b8:27:eb:3f:4a:22<br/>Port 3 → dc:a6:32:11:55:99<br/>Port 4 → (unknown)"]
    end

    PC1["PC 1<br/>a4:83:e7:2b:5c:01"] -->|Port 1| TABLE
    PC2["PC 2<br/>b8:27:eb:3f:4a:22"] -->|Port 2| TABLE
    PC3["PC 3<br/>dc:a6:32:11:55:99"] -->|Port 3| TABLE
    PC4["PC 4<br/>(new device)"] -->|Port 4| TABLE

    style TABLE fill:#4f46e5,stroke:#4338ca,color:#fff
    style PC1 fill:#7c3aed,stroke:#6d28d9,color:#fff
    style PC2 fill:#7c3aed,stroke:#6d28d9,color:#fff
    style PC3 fill:#7c3aed,stroke:#6d28d9,color:#fff
    style PC4 fill:#a78bfa,stroke:#8b5cf6,color:#fff

This diagram shows a switch with its MAC address table. The table maps Port 1 to MAC address a4:83:e7:2b:5c:01 (PC 1), Port 2 to b8:27:eb:3f:4a:22 (PC 2), Port 3 to dc:a6:32:11:55:99 (PC 3), and Port 4 to an unknown new device. Four PCs are connected, one to each port. The switch has learned the MAC addresses of PCs 1, 2, and 3 from their previous traffic, but PC 4 is new and not yet in the table.

Why MAC Addresses Are "Permanent" - And When They Are Not

MAC addresses are often described as permanent identifiers burned into hardware at the factory. This is true for the default behavior - the address stored in the NIC's firmware does not change. But modern operating systems allow MAC address spoofing - overriding the hardware address with a software-configured alternative.

Legitimate uses of MAC spoofing include:

• Privacy protection: Apple, Google, and Microsoft have implemented MAC address randomization in their mobile and desktop operating systems. When your phone scans for Wi-Fi networks, it uses a random MAC address instead of its real one, preventing stores and advertisers from tracking your movement through physical spaces by your MAC address.
• Virtual machines and containers: Hypervisors and container runtimes assign locally administered MAC addresses to virtual network interfaces. A single physical server running 50 containers needs 50 distinct MAC addresses, none of which correspond to physical hardware.
• Network testing: Engineers may temporarily change a machine's MAC address to test network access control lists, switch behavior, or to replicate an issue seen on a specific device.

Malicious uses of MAC spoofing include impersonating another device to bypass MAC-based access controls (which is why MAC-based authentication alone is never considered secure).

Interview: MAC addresses rarely come up directly in System Design interviews, but understanding the distinction between Layer 2 and Layer 3 addressing prevents common mistakes:

Mistake: Assuming that "each server has a unique address" means IP address only. In network segmentation discussions, MAC addresses determine local delivery while IP addresses determine which network segment a device belongs to.

Mistake: Not understanding why ARP exists. If someone asks "how does a device know where to send a frame?", the answer involves both IP (to identify the destination) and MAC (to actually deliver the frame on the local network). The gap between these two addressing systems is what ARP bridges.

Useful knowledge: Cloud VPC networking (AWS, GCP, Azure) virtualizes Layer 2 entirely. Virtual MAC addresses are assigned to VM network interfaces, and the cloud provider's software-defined networking handles frame delivery. Understanding that MAC addresses exist even in virtual environments helps you reason about network architecture in cloud deployments.

Viewing Your MAC Address

You can check your device's MAC address with these commands:

# macOS / Linux
ifconfig | grep ether
# or
ip link show

# Windows (Command Prompt)
ipconfig /all
# Look for "Physical Address"

# Linux (specific interface)
cat /sys/class/net/eth0/address

What Comes Next

The next topic covers switches and hubs - the physical devices that use MAC addresses to move data on a local network. You will learn how switches build their MAC address tables, why switches replaced hubs, and the concepts of collision domains and broadcast domains that determine how network traffic is contained and controlled.

Exercise: Starter: Run ifconfig (Mac/Linux) or ipconfig /all (Windows) and find your MAC address. Identify the OUI (first three octets). Look up the OUI online to determine which company manufactured your network interface. Does the manufacturer match the brand of your device, or is it a third-party chipmaker?

Intermediate: Research MAC address randomization on your phone or laptop. Is it enabled by default? Does your device use a different random MAC for each Wi-Fi network it connects to, or does it use the same random MAC everywhere? What privacy benefits does this provide, and what problems can it cause for networks that use MAC-based access control?

Advanced: Consider a data center with 10,000 servers, each with two network interfaces. How many MAC addresses exist in this environment? If each top-of-rack switch has a 32K MAC address table (a common size), how many switches are needed to have every server's MAC address in at least one switch's table? What happens when a switch's MAC address table is full - research the "MAC address table overflow" issue and its security implications.

Back to Computer Networking