VMware ESXi and vSphere Cluster Management

MAC Addresses: Structure, Use, and Network Operations

Learn how MAC addresses identify local network interfaces, how switches and ARP use them, how to find them, and how randomization, spoofing, and troubleshooting affect network operations.

What Is a MAC Address?

A MAC address is a Layer 2 identifier associated with a network interface. MAC means Media Access Control, the link-layer part of networking that controls delivery across a local Ethernet or Wi-Fi network.

A network interface can be a wired Ethernet adapter, wireless adapter, Bluetooth adapter, virtual machine adapter, or VPN-related interface. On a local link, the MAC address helps devices and switches identify where a frame should be delivered.

A MAC address identifies an interface, not a person. It is not a computer name, username, or Internet-wide location. An IP address describes a logical network location, while a MAC address is normally used only on the current Layer 2 network.

MAC Address Format and Notation

A standard Ethernet MAC address is 48 bits long. It contains six octets, and an octet is an 8-bit value. The six octets total 48 bits.

MAC addresses are usually written in hexadecimal, or base 16. Each hexadecimal digit represents four bits, so two hexadecimal digits represent one octet. For example:

00:1A:2B:3C:4D:5E

The same address may be written with different separators:

  • 00:1A:2B:3C:4D:5E uses colons.
  • 00-1A-2B-3C-4D-5E uses hyphens.
  • 001A2B3C4D5E has no separators.

Uppercase and lowercase hexadecimal letters have the same meaning. 00:1A:2B:3C:4D:5E and 00:1a:2b:3c:4d:5e represent the same address.

Reading the Components

Example notation: 00:1A:2B:3C:4D:5E

Octets: 00, 1A, 2B, 3C, 4D, 5E

Bit length: Six octets, 48 bits total

Traditional component interpretation: 00:1A:2B is the first 24-bit portion; 3C:4D:5E is the final 24-bit portion

The first 24 bits are traditionally called the Organizationally Unique Identifier, or OUI. An OUI is associated with an organization or manufacturer in globally assigned address ranges. The final 24 bits traditionally identify a particular interface within that allocation.

This division is a useful model, but it does not describe every modern address. A locally administered address is assigned by software, an administrator, or a device rather than being globally assigned as a manufacturer identity. Its values therefore do not necessarily identify a manufacturer.

Unicast, Broadcast, and Multicast

The destination MAC address determines the intended Layer 2 delivery pattern.

Unicast: One interface sends to one interface. A normal host-to-host Ethernet frame is usually unicast.

Broadcast: A frame is delivered across the local broadcast domain. The Ethernet broadcast address is FF:FF:FF:FF:FF:FF.

Multicast: A frame is sent to a group of interfaces that have subscribed or are otherwise eligible to receive it.

Switch handling: Known unicast traffic can be sent to one port; unknown unicast and broadcast traffic is commonly flooded within the applicable VLAN; multicast handling depends on switch configuration and group-awareness features.

A broadcast domain is the Layer 2 scope in which broadcast traffic is forwarded. Routers normally separate broadcast domains. MAC addressing does not provide end-to-end Internet addressing and is not normally routed unchanged across the Internet.

MAC Addresses in Ethernet Frames

An Ethernet frame is a Layer 2 unit. Its header includes a destination MAC address and a source MAC address.

  • The source field contains the MAC address of the transmitting interface on that link.
  • The destination field identifies the interface, group, or broadcast scope that should receive the frame on that link.

For example, if one computer sends a local frame to another computer, the sender places its own interface address in the source field and the other computer's local-link address in the destination field. The switch examines these fields when deciding where to send the frame.

How Switches Learn and Forward

A switch maintains a table that maps learned MAC addresses to ports and often VLANs. This table is called a MAC address table, forwarding database, or CAM table. CAM refers to the memory technology traditionally used for fast lookups.

When a frame arrives, the switch learns from the source address. It records that the source MAC was seen on the ingress port and VLAN. It then examines the destination address.

Known unicast: The destination exists in the table on an appropriate port. The switch forwards the frame only toward that port, normally not back out the receiving port.

Unknown unicast: The destination is not in the table. The switch floods the frame to eligible ports in the VLAN so the destination can receive it. When the destination replies, the switch can learn its location.

Broadcast: The switch floods the frame throughout the applicable broadcast domain, excluding the receiving port.

Relevant multicast: The switch forwards it according to its multicast behavior, which may be flooding or selective forwarding based on learned group membership.

Entries age out after a period of inactivity. Aging prevents obsolete information from lasting forever. If a device moves to another port, the switch relearns the source address when it next sends traffic. Until learning stabilizes, frames may be flooded or forwarded using recently updated information.

Example: Learning and Forwarding

A switch receives a frame from AA:AA:AA:AA:AA:AA on port 3. It records that address on port 3. If the destination is known on port 7, the switch forwards the frame only to port 7. If the destination is unknown, it floods eligible ports in the same VLAN.

MAC Addresses and IP Addresses

Purpose — MAC: Identifies a local-link interface for Layer 2 delivery.

Purpose — IP: Identifies a logical address and network location for Layer 3 delivery.

Scope — MAC: Normally the current Ethernet or Wi-Fi segment, VLAN, or other Layer 2 link.

Scope — IP: Can be used across multiple routed networks.

Forwarding device — MAC: Ethernet switches and wireless infrastructure use MAC addresses to deliver local frames.

Forwarding device — IP: Routers use IP addresses to select paths between networks.

Change across a router — MAC: The Layer 2 source and destination addresses are replaced for the next link.

Change across a router — IP: The packet's source and destination IP addresses normally remain the same across routed hops, although routing features such as translation can modify them.

Local-Destination Example

Suppose a host sends IPv4 traffic to 192.168.1.20, and that address is on the host's own subnet. The host uses ARP to discover the MAC address associated with 192.168.1.20. It then sends an Ethernet frame to that destination MAC while the IP packet uses destination IP address 192.168.1.20.

Remote-Destination Example

If the destination is a public IP address outside the local subnet, the host does not try to discover the remote server's MAC address. Instead, it sends the first frame to the MAC address of its default gateway, which is the local router used to reach remote networks.

The IP destination remains the remote server. At the router, the old Ethernet frame is removed and a new Layer 2 frame is created for the next link. Each routed hop uses new local MAC addresses while the packet continues toward its IP destination.

Address Resolution

IPv4 ARP

ARP, the Address Resolution Protocol, maps a local IPv4 address to a MAC address. The basic process is:

  1. The host checks its ARP cache for a current mapping.
  2. If no usable mapping exists, it broadcasts an ARP request asking which interface owns the target IPv4 address.
  3. The device with that IPv4 address sends an ARP reply, commonly as a unicast response.
  4. The sender stores the mapping in its ARP cache for a limited time.
  5. When the entry expires or becomes invalid, resolution can occur again.

ARP resolution is needed for the next device on the local link. For remote traffic, that next device is normally the default gateway, not the final Internet server.

IPv6 Neighbor Discovery

IPv6 does not use ARP. It uses Neighbor Discovery, which performs link-layer address discovery and other local-link functions using IPv6 control messages, including multicast rather than an Ethernet-wide ARP broadcast.

Finding MAC Addresses on Devices

A computer can have several MAC addresses. Common examples include a wired Ethernet adapter, Wi-Fi adapter, Bluetooth interface, virtual machine adapter, container or bridge interface, and VPN-related interface. Identify the adapter that is active and connected to the network being investigated.

Windows — ipconfig /all: Locate the adapter and its Physical Address.

Windows — getmac /v: List MAC addresses together with adapter associations.

Windows — arp -a: View the IPv4 ARP cache and its address mappings.

Linux — ip link show: View interfaces and their link-layer addresses.

Linux — ip neigh show: View IPv4 and IPv6 neighbor-cache entries.

macOS — ifconfig: Locate the interface's ether address.

macOS — arp -a: View ARP cache entries.

Cisco IOS — show mac address-table: View learned MAC addresses, VLANs, and switch ports.

Cisco IOS — show arp: View IPv4-to-MAC mappings on the device.

Matching an Address to the Correct Adapter

  1. List all interfaces and note their names, connection state, IP addresses, and MAC addresses.
  2. Match the subnet and IP address to the network connection under test.
  3. Compare the host's address with the switch table, wireless access point client list, or ARP/neighbor cache.
  4. Ignore disconnected, virtual, Bluetooth, and VPN interfaces unless they are part of the problem.

Factory Addresses, Local Addresses, Randomization, and Spoofing

A factory-assigned address is programmed or assigned by the adapter manufacturer or platform. A locally administered address is selected locally and marked so it is not treated as a globally assigned manufacturer address. A temporary randomized Wi-Fi address is commonly used to reduce tracking across wireless networks.

MAC changes can have legitimate purposes, including privacy, laboratory testing, replacing network hardware, virtual machine operation, and compatibility with a network that expects a particular interface identity.

MAC spoofing means changing the address an interface presents. Impersonating another device can cause collisions, bypass weak controls, disrupt access, or violate organizational policy. Perform such changes only in an authorized environment.

Why MAC Filtering Is Weak Security

MAC filtering allows or denies listed addresses, but a MAC address is visible on the local Layer 2 network and can often be changed by software. An attacker who can observe an allowed address may be able to imitate it. Filtering can be useful for basic administration, but it is not a strong substitute for authentication and encryption.

Wi-Fi randomization can affect DHCP reservations, allow lists, captive portals, and device tracking. A phone may present one address for a particular wireless network and a different temporary address elsewhere. Check the address currently presented on that network before changing an allow list or reservation.

Operational Security and Access Control

  • MAC filtering: Compares a presented MAC address with an allow or deny list. It is easy to administer but provides weak identity assurance.
  • Port security: A switch feature that restricts which MAC addresses may appear on a port, how many may be learned, and what happens after a violation.
  • 802.1X: Port-based network access control that authenticates a user or device before granting network access. It provides stronger access control than relying on a MAC address alone.

MAC addresses are generally visible to devices sharing the local Layer 2 segment. They are not normally carried unchanged through routers, so a remote Internet server generally cannot use the original local Ethernet MAC as an end-to-end identifier.

Common MAC-Related Faults

Duplicate MAC Addresses

If two devices present the same MAC address on one VLAN, the switch may repeatedly relearn that address on different ports. The table appears to move or flap between ports. Frames are sent to whichever port was learned most recently, causing intermittent connectivity.

Common causes include cloned virtual machines, copied interface settings, or manually configured addresses. Look for the same MAC on multiple ports and inspect switch movement logs.

Stale ARP or Neighbor Information

An old address mapping can send traffic to the wrong interface after hardware replacement, address changes, or failover. Inspect the ARP or neighbor cache and allow normal expiration or clear entries according to the operating system and change policy.

Incorrect VLAN Placement

A device can have an IP address yet fail to reach an expected local device if the switch port, wireless network, or trunk places it in the wrong VLAN. Confirm the intended VLAN and IP subnet before treating the problem as an ARP or host-firewall issue.

Wireless Client Isolation

Some access points prevent wireless clients from communicating directly with one another. If ARP and switch or access-point learning appear correct, check client isolation and host firewall settings.

Port-Security Violation

A switch port may be disabled after a new device is connected if port security limits the number of learned addresses or expects a specific address. Review the violation status and configuration. Clear or modify it only through authorized change control.

Structured Troubleshooting

Local Device Cannot Reach Another Local Device

  1. Confirm both devices are in the expected VLAN and IP subnet.
  2. Inspect the ARP or IPv6 neighbor cache for the target address.
  3. Verify that the destination MAC is learned on the expected switch port or wireless connection.
  4. After Layer 2 connectivity is confirmed, check host firewalls and wireless client isolation.

Local Access Works but Remote Networks Do Not

  1. Verify the host's default gateway configuration.
  2. Confirm that the gateway's IP address resolves to a MAC address.
  3. Separate the local Layer 2 problem from routing, DNS, and upstream connectivity problems.

Wi-Fi Allow List Fails After Reconnection

  1. Determine whether private or randomized Wi-Fi addressing is enabled.
  2. Compare the address currently presented by the device with the registered address.
  3. Update the allowed address only according to network policy.

Exam-Relevant Summary

  • A MAC address is a Layer 2 interface identifier, not a username, computer name, or Internet-wide location.
  • A traditional MAC address is 48 bits, written as six hexadecimal octets.
  • The first 24 bits are traditionally the OUI; locally administered addresses may not identify a manufacturer.
  • Unicast is one-to-one, broadcast is one-to-all within a broadcast domain, and multicast is one-to-many.
  • FF:FF:FF:FF:FF:FF is the Ethernet broadcast address.
  • Switches learn source MAC addresses and use a CAM table or forwarding database for known-unicast forwarding.
  • Unknown unicast, broadcast, and relevant multicast traffic may be flooded.
  • IPv4 uses ARP; IPv6 uses Neighbor Discovery.
  • For remote traffic, the first frame targets the default gateway's MAC, not the remote server's MAC.
  • Routers replace Layer 2 addresses at each hop while the routed IP destination normally remains unchanged.
  • MAC filtering is not strong security; port security and 802.1X address different access-control needs.

For a related reference, see MAC address operations.