VMware ESXi and vSphere Cluster Management

MAC Addresses: Structure, Purpose, and Use in Networks

Learn what MAC addresses are, how Ethernet switches and ARP use them, how to find them, and how they differ from IP addresses.

A MAC address is a link-layer identifier associated with a network interface. MAC stands for Media Access Control, a part of data-link networking that controls how devices use a local network medium.

Ethernet and Wi-Fi use MAC addresses to deliver frames across a local network. A computer, phone, printer, or virtual machine can have more than one MAC address because each wired, wireless, or virtual network interface can have its own identifier.

MAC Address Format

The common MAC address is 48 bits long. It is usually written as six hexadecimal octets, with each octet representing eight bits. For example, 00:1A:2B:3C:4D:5E contains six hexadecimal values and 12 hexadecimal digits.

OUI and Interface-Specific Portion

In many manufacturer-assigned addresses, the first 24 bits are the Organizationally Unique Identifier, or OUI. The OUI identifies an organization or manufacturer allocation. The remaining 24 bits identify an interface within that allocation.

For 00:1A:2B:3C:4D:5E, 00:1A:2B is commonly treated as the OUI portion and 3C:4D:5E as the interface-specific portion. This division is a useful convention, but software-generated, virtual, and randomized addresses may not follow a manufacturer-oriented interpretation.

Universal and Local Administration Bits

Two indicators are carried in the first octet:

• The least significant bit indicates whether the address is intended for an individual interface, called unicast, or a group, called multicast. A value of 0 indicates individual addressing; a value of 1 indicates group addressing.
• The next bit indicates administration. A value of 0 represents a universally administered address, normally assigned through a manufacturer allocation. A value of 1 represents a locally administered address, set by software, an administrator, a virtual machine platform, or a privacy feature.

These bits are interpreted from the binary form of the first octet, even though the address is normally displayed in hexadecimal.

Unicast, Multicast, and Broadcast

Broadcast traffic is local in scope. Ethernet switches normally keep it within the same VLAN rather than forwarding it into another VLAN. Routers do not normally forward Ethernet broadcasts between networks.

MAC Addresses in Ethernet Frames

An Ethernet frame is a Layer 2 data unit. Its conceptual structure includes a destination MAC address, a source MAC address, an EtherType or length field, a payload, and a frame check sequence.

The destination field tells the local network where the frame should go. The source field identifies the interface that transmitted it. A network interface normally accepts frames addressed to its own MAC address, the broadcast address, or a multicast group it has joined. Interfaces may also be configured to receive additional traffic for monitoring or special purposes.

MAC-address forwarding is a Layer 2 function because it operates on the data-link frame rather than using the IP packet's Layer 3 addressing information.

Switches and MAC Address Tables

A switch maintains a MAC address table, also called a CAM table. The table associates learned MAC addresses with switch ports and VLANs.

1. Learning: When a frame arrives, the switch records the source MAC address and the incoming port in the appropriate VLAN.
2. Known-unicast forwarding: If the destination MAC is in the table, the switch forwards the frame only through the associated port, unless that port is the incoming port.
3. Unknown-unicast flooding: If the destination is not known, the switch sends the frame through other eligible ports in the same VLAN. When the destination responds, the switch can learn its location.
4. Aging: Dynamic entries expire after a period without relevant traffic. Aging allows the table to adapt when a device moves to another port or disconnects.

Broadcast frames are flooded to eligible ports within their VLAN, but a normal switch does not forward them beyond that VLAN. A VLAN is a logical Layer 2 network and broadcast domain.

MAC Addresses and IP Addresses

An IP packet is encapsulated inside a local-link frame for each network hop. If a workstation sends traffic to an internet host, the first frame is addressed to the default gateway's MAC address, not the remote host's MAC address. The IP packet can retain the remote destination IP address while the frame is rebuilt on each routed link.

ARP and Address Resolution

Address Resolution Protocol (ARP) maps an IPv4 address to a MAC address on the local network. Before sending to a local IPv4 destination, a host checks its ARP cache.

1. The workstation wants to send to 192.168.1.20 and checks its ARP cache.
2. If no usable entry exists, it broadcasts an ARP request asking which interface owns that IPv4 address.
3. The device using that address sends an ARP reply containing its MAC address, normally as a unicast reply.
4. The workstation stores the result temporarily and sends the Ethernet frame to the learned MAC address.

Stale or incorrect ARP entries can cause traffic to be sent to the wrong interface or can prevent communication. Clearing or refreshing the cache may help, but the underlying cause should also be investigated.

IPv6 does not use ARP. Neighbor Discovery, part of IPv6, provides neighbor address resolution and related functions using ICMPv6 messages, including multicast rather than an IPv4-style broadcast request.

Assignment, Persistence, and Randomization

Traditional hardware interfaces commonly receive a manufacturer-assigned address from an allocated OUI range. Software can instead configure a locally administered address. Virtual machines, containers, operating systems, and network appliances frequently use software-configured values.

MAC addresses are not guaranteed to be globally unique in every practical situation. Cloning, manual configuration errors, virtualization, faulty hardware, and deliberate spoofing can create duplicates.

Modern Wi-Fi clients often support MAC randomization. A phone or laptop may use a changing or per-network address when scanning for or joining wireless networks. This reduces passive tracking based on a stable hardware identifier, so the address shown by an access point may differ from the factory-assigned address.

Finding a MAC Address

First identify the active interface. A system may list Ethernet, Wi-Fi, VPN, Bluetooth, loopback, container, and virtual-machine interfaces. Match the interface to its connection state, IP address, VLAN, and physical or wireless connection.

To investigate a managed switch, use the vendor's equivalent of:

show mac address-table

Exact switch syntax varies. Check the VLAN and port columns, not only the MAC value.

Administrative Uses

• DHCP reservations: A DHCP server can associate a device's current MAC address with a preferred IPv4 address. This is different from assigning an IP address to the MAC address itself at Layer 2; the DHCP server uses the identifier when selecting a lease.
• Inventory: MAC addresses help associate interfaces with managed devices, switch ports, and wireless clients.
• MAC filtering: An access point or switch can allow or deny listed addresses.
• Access control: Network access systems can use interface identifiers as one input to authentication or policy decisions.
• Switch port security: A switch can limit which source MAC addresses are accepted on a port and can generate alerts when unexpected addresses appear.

MAC filtering alone is weak security. An authorized address can often be changed or spoofed, and a randomized Wi-Fi address can make a static allow-list difficult to maintain. Stronger designs use authentication, encryption, segmentation, endpoint controls, and monitoring.

Security and Troubleshooting

MAC Spoofing

MAC spoofing means changing the address presented by an interface. It can be legitimate during laboratory testing, interoperability work, privacy protection, or recovery from a faulty configuration. It can also bypass weak MAC allow-lists, impersonate another local device, or create address conflicts.

Duplicate MAC Addresses

Two interfaces using the same MAC address can cause intermittent connectivity. A switch may repeatedly relearn the address on different ports, producing a moving or flapping MAC-table entry. Check cloned virtual machines, manually configured addresses, spoofing, and incorrectly restored device images.

VLAN Placement

Layer 2 reachability depends on VLAN placement. Two devices can have addresses that appear to be in the same IP subnet but still fail to communicate if they are placed in different VLANs or if the VLAN is not carried across a trunk. Conversely, devices in the same VLAN share a broadcast domain even when application traffic is blocked by host firewalls.

Useful Investigation Sequence

1. Confirm the target is powered on and connected to the expected wired or wireless interface.
2. Identify the active interface and its VLAN or network connection.
3. Check the local ARP or IPv6 neighbor table for the target.
4. Verify the switch or access point has learned the expected MAC on the expected port or wireless association.
5. Check for duplicate MAC addresses, table movement, loops, or incorrect VLAN configuration.
6. After Layer 2 and Layer 3 reachability work, investigate host firewalls, service listeners, authentication, and application configuration.

A device can appear in a neighbor or network table yet lack application connectivity. The table may contain a recently learned or stale entry, while a firewall blocks the service, the service is stopped, the device is on an unexpected VLAN, or the IP-to-MAC mapping is incorrect.

Common Problems

• Known IP but unreachable device: Confirm both devices share the expected VLAN or that routing exists, inspect ARP or Neighbor Discovery, verify the target interface, and then check firewalls.
• MAC moving between switch ports: Look for duplicate addresses, cloned virtual machines, spoofing, Layer 2 loops, and unintended downstream switching.
• DHCP reservation fails: Compare the reservation with the active interface's current address, account for Wi-Fi randomization, verify the DHCP scope and VLAN, and renew the lease.
• Wireless access list rejects a known device: Use the Wi-Fi adapter's address rather than Ethernet or a virtual adapter, check private addressing, and confirm the access point's accepted format.
• Unexpected flooding: Check whether the switch has learned the destination, review table aging and topology changes, and verify that the destination is responding in the correct VLAN.

Exam- and Practice-Relevant Notes

• MAC addresses are local-link identifiers; IP addresses are logical, routable addresses.
• The Ethernet broadcast address is FF:FF:FF:FF:FF:FF.
• Switches learn from source MAC addresses and forward based on destination MAC addresses.
• Unknown unicast traffic is flooded within the VLAN; broadcasts normally remain within the VLAN.
• A host sends to the next-hop MAC address. For a remote destination, that next hop is usually the default gateway.
• ARP resolves IPv4 addresses locally. IPv6 uses Neighbor Discovery instead.
• A MAC address can change because of local administration, virtualization, randomization, or spoofing.

Understanding MAC addresses provides the foundation for studying Ethernet, switching, VLANs, ARP, and local network troubleshooting.