Nmap online course

MAC Addresses: Structure, Purpose, and How to Find Them

Learn what MAC addresses are, how 48-bit Ethernet addresses are structured, what OUIs and address bits mean, and how to find MAC addresses on Windows and Linux.

A MAC address is a link-layer identifier associated with a network interface. MAC stands for Media Access Control, a group of data-link functions used to control access to a shared network medium. Ethernet is the most common technology that uses MAC addresses.

A MAC address identifies an interface, not necessarily an entire computer. A laptop may have separate Ethernet, Wi-Fi, Bluetooth, VPN, virtual machine, or container interfaces, and each interface can have its own address. Other names for a MAC address include hardware address, physical address, and link-layer address.

For background on where MAC addressing fits in networking, see the OSI model and the TCP/IP protocol suite.

MAC Addresses in Ethernet Communication

Ethernet sends data in units called frames. Each frame includes a source MAC address and a destination MAC address. These addresses help Ethernet deliver the frame across the local network segment.

MAC addressing and IP addressing solve different problems:

• A MAC address is used for delivery on the local data-link network, such as one Ethernet or Wi-Fi LAN.
• An IP address identifies a network-layer endpoint and supports routing between different networks.

When a host sends traffic to another host on the same local network, it places the destination interface's MAC address in the Ethernet frame. When traffic must cross a router, the frame is delivered to the next hop, usually the router's interface. The router removes the old frame and creates another one for the next link. The final host's MAC address is therefore not normally carried unchanged across the entire path.

An Ethernet switch examines source addresses and learns which MAC address is reachable through each switch port. This creates a MAC-to-port association in the switch's forwarding table. For a known destination, the switch can send a frame only through the appropriate port instead of transmitting it everywhere. Unknown destinations and broadcast traffic may be flooded within the local broadcast domain.

MAC Address Length and Binary Structure

A conventional Ethernet MAC address contains 48 bits. It is divided into six octets, where an octet is an 8-bit byte:

6 octets × 8 bits = 48 bits

MAC addresses are normally displayed in hexadecimal, or base 16. Each hexadecimal digit represents 4 bits, so 12 hexadecimal digits represent the complete address:

12 hexadecimal digits × 4 bits = 48 bits

For example, the address D8:D3:85:EA:1B:EE contains six hexadecimal byte values:

D8  D3  85  EA  1B  EE
|-------|  |-------|
 first 3   last 3
 octets    octets

The first 24 bits are commonly treated as the vendor allocation portion, and the last 24 bits are traditionally used to distinguish an interface within that allocation. This is a useful description of conventional universally administered addresses, but it is not a guarantee about every address observed in practice.

OUI and the Vendor Portion

An Organizationally Unique Identifier, or OUI, is an identifier used in address allocations. In a conventional 48-bit MAC address, the OUI is commonly the first 24 bits, or first three octets. An organization receives an allocation and can then assign interface addresses within that space.

In the example D8:D3:85:EA:1B:EE, D8:D3:85 is the OUI or vendor allocation portion, while EA:1B:EE is the interface-specific portion. The first portion can be checked against an allocation database to find the organization associated with that block. No lookup is needed to understand the structure.

Vendor identification is only an indication, not proof of the physical product or owner. A MAC address may be:

• Randomized by an operating system for Wi-Fi privacy.
• Locally administered by software or an administrator.
• Spoofed so that it imitates another address.
• Assigned to a virtual machine, container, VPN adapter, or other virtual interface.
• Associated with an organization that produced a component rather than the brand visible on the finished device.

Interface-Specific Bits and Practical Uniqueness

The remaining 24 bits have traditionally been assigned by a manufacturer or allocation holder to distinguish interfaces in its address space. The design goal for a universally administered address is global uniqueness, meaning that two unrelated interfaces should not normally receive the same address.

In practice, uniqueness is not absolute. Duplicate addresses can result from configuration mistakes, cloning, virtualization, deliberate spoofing, address reuse, or local administration. Treat an observed MAC address as an identifier useful within a network context, not as permanent proof of a device's identity.

MAC Address Notation

The same 48-bit value can be written using different separators. Letter case does not change the represented address.

All three examples represent the same address:

D8:D3:85:EA:1B:EE
D8-D3-85-EA-1B-EE
D8D3.85EA.1BEE

Special MAC Address Bits and Address Types

Two important flags are encoded in the first octet. Thinking of the first octet as eight binary bits, the low-order bits indicate how the address should be interpreted:

• The individual/group bit distinguishes an individual, or unicast, address from a group address. A clear bit indicates unicast; a set bit indicates multicast or another group destination.
• The universal/local bit distinguishes a universally administered address from a locally administered address. A clear bit indicates universal administration; a set bit indicates that the address was assigned or modified locally.

A locally administered address is set locally rather than obtained from a vendor's universal allocation. Modern devices may use locally administered and randomized addresses as a privacy feature. Consequently, a vendor lookup can be missing or misleading.

Broadcast traffic does not cross a router as one continuous Ethernet broadcast. Routers separate broadcast domains, although they may provide higher-layer services that perform similar discovery functions.

Find a MAC Address on Windows

Command Prompt with ipconfig

Open Command Prompt and run:

ipconfig /all

Windows lists detailed information for each adapter. Look for the field named Physical Address. That field commonly contains the adapter's MAC address.

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . : example
   Description . . . . . . . . . . . : Wireless Adapter
   Physical Address. . . . . . . . . : D8-D3-85-EA-1B-EE
   DHCP Enabled. . . . . . . . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.0.2.25

A computer can show many adapters. Select the relevant connected Ethernet or Wi-Fi adapter rather than a disconnected interface, loopback interface, Bluetooth adapter, VPN, virtual machine, or container interface.

PowerShell with Get-NetAdapter

PowerShell provides a concise alternative:

Get-NetAdapter

Review the adapter name, status, and MAC address. The active adapter normally has a status such as Up, but confirm that it is the interface connected to the network you are investigating.

Find a MAC Address on Linux

Modern iproute2 commands

The modern command-line tool is ip. To display interfaces and link-layer information, run:

ip link show

Find the link/ether field for the interface of interest:

2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP
    link/ether d8:d3:85:ea:1b:ee brd ff:ff:ff:ff:ff:ff

Here, enp3s0 is the interface name and d8:d3:85:ea:1b:ee is its Ethernet MAC address. The brd value is the Ethernet broadcast address.

You can also use:

ip addr show

This command displays IP addresses and related interface information. Depending on the Linux version and interface type, look for a link/ether line.

Choosing the correct Linux interface

• Names such as eth0 or enp3s0 commonly represent wired Ethernet.
• Names such as wlan0 or wlp2s0 commonly represent Wi-Fi.
• lo is the loopback interface and is not a physical Ethernet adapter.
• Names beginning with vir, br, docker, or similar prefixes may represent virtual or bridge interfaces.

Interface naming varies by distribution and configuration. Check the interface state and connection rather than relying only on its name.

Legacy ifconfig utility

Older documentation may show:

ifconfig -a

ifconfig belongs to the legacy net-tools package and may not be installed on a current Linux system. Prefer ip link show or ip addr show. If ifconfig is available, its output may label the MAC address as ether or HWaddr.

MAC Addresses, ARP, and Nmap

MAC addresses are normally observable directly only on the same local Layer 2 segment. ARP, the Address Resolution Protocol, resolves an IPv4 address to a link-layer address on a local network. A host can use ARP to learn which MAC address corresponds to a nearby IPv4 host.

When Nmap performs local network discovery, ARP-based methods can reveal the MAC addresses of nearby IPv4 systems when the scanner and targets share the same Ethernet or Wi-Fi segment. MAC vendor information may help organize discovered assets, but it should not be treated as proof of device identity.

A scan result can report a target's IP address even when it cannot report that target's MAC address. An Nmap scan of a remote Internet host generally cannot reveal the remote host's Ethernet MAC address because routers separate Layer 2 networks. The scanner normally sees the MAC address of its local next hop, not the final remote machine.

For related discovery concepts, see how to discover whether a host is online, TCP SYN ping host discovery, and how to interpret scan results.

Troubleshooting Common MAC Address Questions

Multiple MAC addresses appear on one computer

This is normal. Wired, Wi-Fi, Bluetooth, VPN, virtual machine, container, and other interfaces can all have separate addresses. Identify the interface that is active and relevant to your task.

The expected Linux command is not found

If Linux reports that ifconfig is not found, use ip link show or ip addr show. The modern ip utility is usually available through the iproute2 tools.

A vendor lookup does not match the hardware brand

The address may be locally administered, randomized, spoofed, assigned to a virtual interface, or associated with a component supplier rather than the visible product manufacturer. Examine the universal/local bit and the interface context before drawing conclusions.

The address changes between network connections

Different network interfaces naturally have different MAC addresses. In addition, modern Wi-Fi clients may use a randomized MAC address for a particular network or connection, so the displayed value can change over time.

A scan does not show a remote machine's MAC address

MAC addresses operate on a local Layer 2 network. Across routers, the scanner normally sees the next-hop router's link-layer address rather than the final remote host's address. This is expected behavior, not necessarily a scanning failure.