MAC Addresses: Ethernet Layer 2 Addressing for CCNA
Learn how Ethernet MAC addresses identify local interfaces, how switches learn and forward frames, how MACs change across routed hops, and how to troubleshoot them.
A Media Access Control (MAC) address is a Layer 2 address used by Ethernet to deliver frames across a local network. A MAC address normally identifies a network interface, not necessarily an entire device. A laptop with Wi-Fi and Ethernet, for example, usually has a different MAC address for each interface.
MAC addressing works with Layer 2 of the OSI model. IP addressing operates at Layer 3 and supports communication across routed networks. Ethernet uses MAC addresses for delivery on the local link or VLAN, while routers use IP addresses to move packets between networks.
What a MAC Address Does
When one Ethernet interface sends a frame, it places its own MAC address in the source field and the receiving interface's MAC address in the destination field. Switches inspect these fields to decide whether to forward, filter, or flood the frame.
MAC delivery is local. If a workstation sends traffic to a device in another subnet, it does not place the remote device's MAC address in the first frame. It sends the frame to the MAC address of its default gateway, which is the next-hop router on the local network.
MAC Address Format and Notation
Ethernet commonly uses the EUI-48 format: 48 bits divided into six 8-bit octets. An octet is represented by two hexadecimal digits, so a MAC address contains 6 × 2 = 12 hexadecimal characters. Each hexadecimal digit represents four bits, giving 12 × 4 = 48 bits.
For universally administered addresses, the first 24 bits are the Organizationally Unique Identifier (OUI), associated with an assigned organization or manufacturer. The final 24 bits identify the interface within that allocation. The OUI is not a guarantee that the current physical manufacturer or user can be identified: addresses can be locally assigned, changed, virtualized, or spoofed.
Administration and Group Bits
The first octet contains two important flags. Written from the least-significant side, the low-order bit is the individual/group (I/G) bit. A value of 0 indicates an individual, normally unicast, address; a value of 1 indicates a group address, such as multicast or broadcast. The next bit is the universal/local (U/L) bit. A value of 0 indicates a universally administered address, while a value of 1 indicates a locally administered address.
For example, 00:1A:2B:3C:4D:5E begins with binary 00000000. Its I/G bit is 0 and its U/L bit is 0, so it is an individual, universally administered address. The same address can be written as 00-1A-2B-3C-4D-5E or 001A.2B3C.4D5E.
A locally administered address is assigned by software, an administrator, or a virtualization platform rather than being used directly as a globally assigned manufacturer address. Virtual machines, containers, privacy features, laboratory devices, and wireless systems may use locally administered values.
MAC addresses are intended to be unique within the relevant Layer 2 domain, but duplicates can occur through configuration mistakes, cloning, virtualization, or spoofing. Duplicate addresses can cause traffic to reach the wrong interface and can make a switch repeatedly move one table entry between ports.
Unicast, Broadcast, and Multicast
Broadcast uses the all-ones Ethernet address, FF:FF:FF:FF:FF:FF. Every device in the local broadcast domain processes the frame. Routers normally do not forward Layer 2 broadcasts between interfaces.
Multicast sends traffic to a group rather than to every local device. Common IPv4 multicast Ethernet mappings begin with 01:00:5E. IPv6 multicast mappings begin with 33:33. Switches may treat multicast as a group transmission, and features such as IGMP snooping can limit delivery to ports with interested receivers.
MAC Fields in an Ethernet Frame
The destination MAC field appears before the source MAC field near the beginning of an Ethernet frame. An EtherType or length field follows them and identifies the payload protocol or payload length. The remainder of the frame carries the payload and error-detection information.
The destination MAC is evaluated by the receiving network interface hardware and by switches on the local segment. A switch learns from the source address, then looks up the destination address. It does not learn a destination address merely because it appears as a destination.
At every routed Ethernet hop, the incoming Layer 2 frame is removed and a new frame is created. Therefore, source and destination MAC addresses normally change at each routed hop. In a typical routed packet, the end-host source and destination IP addresses remain the same from the original sender to the final receiver, although routing devices may change other IP header fields such as TTL or hop limit.
How a Switch Learns MAC Addresses
A switch maintains a MAC address table, also called a CAM table or forwarding database. The table maps a MAC address to an incoming switch interface and a VLAN.
- A frame arrives on an interface.
- The switch reads the source MAC address and records it against the ingress interface and VLAN.
- The switch checks the destination MAC address in that VLAN's table.
- The switch forwards, filters, or floods the frame according to the lookup result.
Dynamic entries are learned automatically and have an aging timer. If a device stops transmitting, its inactive entry eventually expires. If the device moves to another interface, a new frame from that device causes the switch to relearn the address on the new interface. Static MAC entries can be configured manually and are not handled like ordinary dynamically learned entries.
Switch Forwarding Decisions
Known-unicast forwarding is the efficient case: the destination MAC is present for the same VLAN, so the switch sends the frame only to the associated interface. If the destination is associated with the interface where the frame arrived, the switch filters it because sending it back would be unnecessary.
For an unknown unicast, the switch floods the frame to other eligible interfaces in the incoming VLAN. A reply usually allows the switch to learn the previously unknown source address. Broadcast frames are also flooded within the VLAN. Switches do not normally flood these frames across VLAN boundaries; a VLAN is a separate Layer 2 broadcast domain.
Example: Two Hosts in the Same VLAN
Host A sends a frame to Host B on the same VLAN. The switch first learns Host A's source MAC on the ingress port. If Host B's MAC is not in the table, the switch floods the frame to other ports in that VLAN. Host B receives the frame and replies. The switch learns Host B's source MAC on Host B's port. Later frames between the hosts can be forwarded directly between the two ports.
MAC Addresses Across a Routed Path
Assume a workstation is sending to a server on a remote subnet. The workstation compares the server's IP address with its own subnet. Because the server is remote, the workstation selects its default gateway as the next hop.
The router removes the incoming Ethernet frame, examines the IP packet, selects the next route, and encapsulates the packet in a new Layer 2 frame. The IP endpoints identify the overall communication; the MAC endpoints identify the current link.
Address Resolution: Finding the Next-Hop MAC
Before sending an IPv4 packet over Ethernet, a host must map the local next-hop IPv4 address to a MAC address. For same-subnet traffic, the next hop is the destination host. For off-subnet traffic, the next hop is the default gateway.
ARP, the Address Resolution Protocol, performs this mapping. The sender broadcasts an ARP request asking which interface owns an IPv4 address. The owner normally sends an ARP reply containing its MAC address. The sender stores the result in an ARP cache, and network devices may display related information as a neighbor table.
Address resolution is performed only for the next-hop Layer 3 address on the local link. A workstation does not ARP for the final server's address when the server is remote; it ARPs for the default gateway.
IPv6 uses Neighbor Discovery instead of ARP. Neighbor Discovery uses IPv6 control messages and multicast rather than an Ethernet broadcast request. It also supports functions such as router discovery and neighbor reachability detection.
Operational Verification
On endpoints, useful commands include ipconfig /all and arp -a on Windows, ip link show and ip neigh show on Linux, and ifconfig and arp -a on macOS.
To locate an endpoint, obtain its MAC address from the operating system, DHCP records, or device documentation. Search the switch table for the address and VLAN. If the result is an uplink, the address belongs to a downstream switch or another device behind that path; continue tracing. A MAC table shows a Layer 2 location, not necessarily the final physical user or wall jack.
MAC Troubleshooting
Same-VLAN Host Cannot Communicate
- Verify both ports are assigned to the expected VLAN.
- Check whether the switch learns each endpoint MAC on the expected interface.
- Inspect link state, interface errors, and port-security status.
- After Layer 2 checks pass, verify the endpoints' IP addresses and masks.
Traffic Is Flooded Instead of Sent to One Port
- Check whether the destination MAC is absent from the table.
- Confirm that the destination has transmitted recently and could be learned.
- Verify that the lookup is occurring in the correct VLAN.
- Consider aging, topology changes, or a downstream path that prevents source learning.
Unexpected Port or MAC Flapping
MAC flapping means the same MAC is repeatedly learned on different interfaces. Identify the interfaces involved, then check for an accidental Layer 2 loop, an unauthorized switch, an incorrectly connected downstream switch, a virtual-machine MAC conflict, a migrated endpoint, or spoofing. Confirm VLAN and interface status before clearing dynamic entries or waiting for them to age.
Remote Networks Are Unreachable
- Verify that the host resolves the default gateway IP to the correct gateway MAC.
- Check the gateway interface's VLAN and Layer 2 reachability.
- Distinguish a gateway or routing problem from a same-LAN MAC learning problem.
MAC-Related Switch Security
Port security limits or validates the MAC addresses allowed on a switch interface. Common controls include a maximum number of MAC addresses, sticky learning, and a violation action. Sticky learning records observed addresses as secure entries, while violation actions can protect the port in different ways.
interface GigabitEthernet1/0/10
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrictThis is a lab example. Syntax and defaults vary by switch platform and software release. Understand the operational impact before selecting a violation mode. A strict setting can block a legitimate phone, access point, virtual machine, or replacement computer if the maximum or secure-address list does not match the real port design. Clear or update stale secure MAC configuration only through an approved change process.
MAC addresses alone are not a strong identity mechanism because they can be changed or spoofed. Security designs should combine port security with appropriate VLAN controls, loop prevention, DHCP snooping, IP source guard, authentication, monitoring, and sensible handling of unknown-unicast traffic. MAC-table exhaustion is another concern: an attacker may attempt to fill a switch's dynamic table, causing more unknown-unicast flooding.
Key CCNA Notes
- MAC addresses are Layer 2 interface identifiers, commonly 48 bits in EUI-48 format.
- The first 24 bits are commonly called the OUI; the last 24 bits form the remaining interface-specific portion for universally administered addresses.
- The I/G bit distinguishes individual addresses from group addresses.
- A switch learns source MAC addresses together with an interface and VLAN.
- Known unicast traffic is forwarded selectively; unknown unicast and broadcast traffic are flooded within the VLAN.
- Routers replace Ethernet source and destination MAC addresses at every routed hop.
- For remote IPv4 traffic, a host resolves the default gateway MAC, not the remote host MAC.
- IPv6 Neighbor Discovery provides address-resolution functions using multicast rather than ARP broadcast.
- A MAC address table identifies a Layer 2 path, which may lead to an uplink rather than directly to an endpoint.
- Duplicate MACs, wrong VLANs, stale entries, loops, and port-security violations are common operational causes of Layer 2 problems.
Related CCNA Topics
Continue with Cisco trunk ports, router-on-a-stick inter-VLAN routing, OSPF configuration, and computer networking fundamentals.