Linux online course

What Is a MAC Address?

Learn what a MAC address is, how 48-bit Ethernet addresses are structured, how switches and ARP use them, and how to view or change them in Linux.

What Is a MAC Address?

A MAC address is a link-layer address associated with a network interface. MAC stands for Media Access Control, a data-link networking function concerned with sending data across a local network medium.

A network interface may be provided by a physical network interface card (NIC), a Wi-Fi adapter, a USB adapter, or software such as a virtual machine interface. The interface uses its MAC address when communicating on the local Ethernet or Wi-Fi network segment.

MAC addresses and IP addresses have different jobs. A MAC address is used for delivery on the local Layer 2 network. An IP address identifies a network-layer destination and allows routers to move packets between different networks.

MAC Address Length and Notation

A traditional Ethernet MAC address is 48 bits long. Since 8 bits make one byte, this is equal to 6 bytes. In networking documentation, a byte is also commonly called an octet, so a conventional MAC address contains six octets.

MAC addresses are normally written as 12 hexadecimal digits. Hexadecimal is base 16 and uses the digits 0 through 9 and the letters A through F. Two hexadecimal digits represent one byte because one hexadecimal digit represents four bits.

For example, D8 represents one byte, or eight bits. Six such byte values form the 48-bit address D8:D3:85:C0:00:08.

How a MAC Address Is Structured

In the conventional allocation layout, a 48-bit address is divided into two 24-bit portions. The initial portion is a vendor-related registered prefix, commonly called an Organizationally Unique Identifier (OUI). The remaining portion identifies an interface within the allocation.

Manufacturers and other organizations receive registered identifier blocks and use them when assigning addresses to network interfaces. The first three displayed octets can therefore often identify the organization associated with a vendor block. This is not a guarantee of the current device maker, retailer, product brand, or device model. Addresses may be assigned to an adapter manufacturer, virtual platform, or another organization.

Example: D8:D3:85:C0:00:08

Read this address as six hexadecimal octets:

D8 : D3 : 85 : C0 : 00 : 08
[ vendor-related prefix [ interface-specific portion

In the conventional layout, D8:D3:85 is the first 24-bit vendor-assigned prefix, and C0:00:08 is the interface-specific portion. A vendor lookup is required to determine which organization owns a particular prefix. The result should be treated as allocation information, not proof of the physical device's current brand.

MAC Addresses on a Local Network

Ethernet sends data in units called Ethernet frames. A frame contains a destination MAC address, a source MAC address, and payload data. The destination tells the local network which interface should receive the frame, while the source identifies the interface that sent it.

A switch is a Layer 2 device that forwards frames. As frames arrive, the switch learns which source MAC addresses are reachable through each physical port. It stores this information in a forwarding table. When a frame arrives for a known destination, the switch normally forwards it only through the port associated with that MAC address instead of sending it to every port.

Traffic addressed to one interface is called unicast. The Ethernet broadcast address is FF:FF:FF:FF:FF:FF. A broadcast frame is delivered to every interface in the local broadcast domain. Multicast traffic is addressed to a group, so it can be delivered to interfaces that have joined a specified group rather than to one interface or every interface.

MAC Addresses, IP Addresses, and ARP

Suppose two computers are on the same IPv4 subnet. The sending computer has an IP packet for the other computer. Before placing that packet into an Ethernet frame, it normally needs the peer's local MAC address.

Address Resolution Protocol (ARP) maps a local IPv4 address to a MAC address. A host can send an ARP request asking which interface owns an IPv4 address. The relevant host replies with its MAC address, and the sender can then construct an Ethernet frame for that address. Operating systems cache these mappings for a period of time.

IPv6 uses Neighbor Discovery, carried through ICMPv6, for the corresponding neighbor-resolution functions. IPv6 does not use ARP.

For a destination outside the local subnet, the host does not send the first Ethernet frame directly to the remote host's MAC address. Instead, it sends the frame to the MAC address of the local default gateway, which is the router used to reach other networks. The IP packet still names the remote destination, while the Ethernet destination applies only to the next local hop.

Are MAC Addresses Permanent and Unique?

Globally administered hardware addresses are intended to be unique. This allocation goal helps switches and other Layer 2 devices distinguish interfaces. It is not an absolute guarantee: manufacturing errors, manual configuration, virtualization, and software changes can produce duplicates.

A factory-programmed address may be stored in interface hardware or firmware. However, operating systems can often replace the address presented by the interface. This is called MAC spoofing when the interface is made to present another address, or MAC changing more generally.

A locally administered address is assigned by software or an administrator rather than taken directly from a globally assigned vendor block. Operating systems and Wi-Fi devices may use generated or randomized MAC addresses for privacy. MAC randomization can reduce long-term tracking based only on a hardware address, especially while scanning for or joining wireless networks.

Two active interfaces with the same MAC address on one Layer 2 network can cause unreliable connectivity. Switch forwarding tables may repeatedly move the address between ports, causing frames to reach the wrong host or disappear.

View MAC Addresses in Linux

Current Linux systems generally use the ip command from the iproute2 tools. List interfaces and their link-layer addresses with:

ip link show

Look for the link/ether field on Ethernet-style interfaces. Interface names may look like enp0s3, eno1, or wlan0.

2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
    link/ether d8:d3:85:c0:00:08 brd ff:ff:ff:ff:ff:ff

Inspect one interface by name:

ip link show dev enp0s3

For only the current address, read the sysfs file for the interface:

cat /sys/class/net/enp0s3/address

Replace enp0s3 with the actual interface name. Older systems may provide commands such as ifconfig, but iproute2 tools are preferred on current Linux distributions.

To inspect IPv4 neighbor-to-MAC mappings learned through ARP, use:

ip neigh show

Changing or Randomizing a MAC Address in Linux

Legitimate reasons to change an address include controlled testing, privacy features, replacing a failed interface identity in a lab, and testing network access policies. Changing an address generally requires administrative privileges, and the interface usually needs to be down first.

This example changes the address temporarily to a locally administered unicast value:

sudo ip link set dev enp0s3 down
sudo ip link set dev enp0s3 address 02:11:22:33:44:55
sudo ip link set dev enp0s3 up

The first byte 02 is commonly used for a locally administered unicast address: its relevant flags indicate local administration and unicast delivery. The change may disappear after reboot or be replaced by network-management configuration.

NetworkManager can configure a cloned MAC address for a connection profile:

nmcli connection modify "Wired connection 1" 802-3-ethernet.cloned-mac-address 02:11:22:33:44:55

Reconnect the profile after changing it. To request a randomized Wi-Fi address:

nmcli connection modify "Wi-Fi connection" 802-11-wireless.cloned-mac-address random

Connection names, supported settings, and persistent configuration methods depend on the distribution, NetworkManager version, driver, and connection type.

Practical Network Administration Uses

• DHCP reservations: A router can consistently assign a local IPv4 address to a printer or server by matching its MAC address.
• Switch-port diagnostics: Administrators can locate a device by checking which switch port learned its MAC address.
• Inventory: MAC addresses can help associate network adapters with hosts in a local asset list.
• Router client lists: Home routers commonly show connected interfaces by MAC address and assigned IP address.
• MAC-based access controls: A network may permit or reject listed addresses, although this is not strong security.

MAC filtering is weak as an authentication method because an address can often be observed on the local network and imitated. It should not replace encryption, authenticated access, or other security controls.

A MAC address visible on one local network is not a device identity that automatically persists across routed networks. Routers replace the Layer 2 frame for each hop, so a remote network normally sees the MAC address of the next local device on its own segment, not the original sender's local MAC address.

Troubleshooting MAC Address Problems

No network access after changing an address

• Confirm that the interface is up with ip link show.
• Verify the active address with cat /sys/class/net/<interface>/address.
• Reconnect the network profile or renew the DHCP lease.
• Check whether the network requires registration of the original address.

Intermittent connectivity or traffic reaches the wrong host

A likely cause is that two active interfaces on the same Layer 2 network have the same MAC address. Restore a unique address, review switch logs for MAC movement, and avoid manually assigning an address already in use.

A DHCP reservation is not being used

Compare the router's reservation with the address currently presented by the client. Wi-Fi MAC randomization may mean that the current address differs from the hardware address recorded in the reservation. Correct the reservation or address, then renew the DHCP lease.

A vendor lookup shows an unexpected organization

The prefix identifies an allocated organization block, not necessarily the retailer or final product brand. Also check for a locally administered or randomized address, a virtual machine, a USB adapter, a bridge, or replaced network hardware.

A MAC-filtered network rejects the client

Verify the active MAC address rather than relying on an old label or inventory record. Wi-Fi and Ethernet use different interfaces and therefore usually have different addresses. If authorized, ask the network administrator to update the approved-device list.

Exam-Relevant Notes

• A conventional Ethernet MAC address is 48 bits, or 6 bytes, written as 12 hexadecimal digits.
• Two hexadecimal digits represent one byte, and each displayed pair separated by punctuation is an octet.
• The first 24 bits commonly represent an OUI or vendor-related allocation; the final 24 bits commonly identify an interface within that allocation.
• Ethernet frames contain source and destination MAC addresses.
• Switches learn MAC locations and forward frames through the appropriate ports.
• FF:FF:FF:FF:FF:FF is the Ethernet broadcast address.
• ARP resolves local IPv4 addresses to MAC addresses; IPv6 uses Neighbor Discovery instead.
• For an off-subnet destination, the local Ethernet frame is addressed to the default gateway's MAC address.
• MAC addresses can be changed or randomized, so they are not reliable permanent identities or strong security credentials.