Unit

MAC Addresses: Identification, Structure, and Ethernet Use

Learn how MAC addresses identify network interfaces, how Ethernet formats and uses them, how switches learn them, and how ARP resolves local IPv4 destinations.

A Media Access Control (MAC) address is a link-layer address associated with a network interface on an Ethernet or Wi-Fi network. It helps deliver link-layer frames to the correct interface on a local network.

A MAC address identifies an interface, not a person or necessarily an entire device. A computer with wired Ethernet, Wi-Fi, Bluetooth, and virtual network interfaces can have several MAC addresses. Each network interface controller (NIC), whether physical or virtual, may have its own address.

MAC addressing and IP addressing solve different problems. A MAC address is used for delivery across one local link or broadcast domain. An IP address is a logical address used to identify a host or interface across interconnected networks and to support routing.

MAC Address Format

The standard Ethernet MAC address is 48 bits long. It contains six octets. An octet is an 8-bit value, so six octets contain 6 × 8 = 48 bits.

MAC addresses are normally written in hexadecimal, or base 16. One hexadecimal digit represents four bits, so two hexadecimal digits represent one octet. The values 0 through 9 are written as digits, and the values 10 through 15 are written as A through F.

For example, 00:1A:2B:3C:4D:5E contains six octets: 00, 1A, 2B, 3C, 4D, and 5E. Each pair of hexadecimal digits represents 8 bits.

These representations describe the same 48-bit value. Separators make the value easier to read; they do not change the address.

MAC Address Components and Bits

The first three octets commonly represent an Organizationally Unique Identifier (OUI). An OUI is a manufacturer-associated prefix assigned through the relevant address-registration process. In 00:1A:2B:3C:4D:5E, 00:1A:2B is the commonly identified OUI portion, while 3C:4D:5E is used to distinguish an interface within that allocation.

The remaining portion is often called the device-specific, interface-specific, or NIC-specific portion. The exact assignment method depends on the manufacturer or organization. An OUI is not proof that a particular company currently owns or operates the device, especially when a locally administered or randomized address is being used.

The two lowest-order bits of the first octet have special meanings:

• Individual/group bit (I/G bit): A value of 0 indicates an individual, or unicast, address. A value of 1 indicates a group address, such as multicast. The all-ones broadcast address is also a group destination.
• Universal/local bit (U/L bit): A value of 0 indicates a universally administered address. A value of 1 indicates a locally administered address.

A universally administered address is normally assigned by a manufacturer or another recognized authority. A locally administered address is selected by software, an administrator, a virtualization platform, or a privacy feature. Wi-Fi devices may use randomized locally administered MAC addresses when scanning for or joining networks.

When interpreting the first octet as a binary value, the I/G bit is the least significant bit and the U/L bit is the next least significant bit. These flags are part of the address value; they are not extra characters added to the displayed address.

MAC Address Types

A broadcast frame does not cross a router as the same Ethernet broadcast. Routers separate broadcast domains. Multicast delivery also depends on the relevant protocol and network-device configuration.

MAC Addresses in Ethernet Communication

An Ethernet frame is a link-layer data unit. Among its fields are a destination MAC address and a source MAC address.

• The destination MAC address identifies the interface that should receive the frame on the current LAN, or identifies a broadcast or multicast group.
• The source MAC address identifies the interface that transmitted the frame on the current link.
• The frame payload commonly contains an IP packet, but Ethernet can carry other network-layer protocols as well.

Suppose Host A sends data to Host B on the same Ethernet LAN. Host A places Host B's MAC address in the destination field and its own interface MAC address in the source field. A switch examines the destination MAC address and forwards the frame toward the port where Host B is connected.

MAC addresses are generally relevant only within the current local broadcast domain. When a router forwards an IP packet to another network, it removes the incoming link-layer frame and creates a new frame for the next link. The new frame normally has the router's outgoing-interface MAC address as its source and the next-hop device's MAC address as its destination. The remote host's MAC address is not carried unchanged across every routed hop.

Local and Remote IP Destinations

For a destination in the host's local subnet, the Ethernet destination MAC belongs to the target host. For a destination outside the local subnet, the Ethernet destination MAC belongs to the default gateway, which is the local router interface used to reach other networks.

For example, a host might send an IP packet to a remote web server, but its first Ethernet frame is addressed to the router's local-interface MAC address. The router then forwards the packet in a new frame on the next network.

How a Switch Learns and Forwards MAC Addresses

An Ethernet switch maintains a MAC address table, also called a CAM table. The table maps learned source MAC addresses to switch ports, usually within a VLAN.

When a frame arrives, the switch learns from the source address first. If a frame with source MAC 00:1A:2B:3C:4D:5E arrives on port 3, the switch records that address as reachable through port 3. The switch repeats this process as devices transmit.

Flooding an unknown unicast is different from sending every frame everywhere permanently. Once the destination interface transmits and the switch learns its source address, later frames can use known-unicast forwarding.

Learned entries have an aging timer. If a switch does not see traffic from a learned MAC address for a configured period, it removes the entry. This prevents stale information from lasting indefinitely after a device moves, disconnects, or changes its interface state. The next frame to that destination may be flooded until the switch learns the address again.

Example: Learning and Forwarding

1. Host A sends a frame toward Host B through a switch.
2. The switch records Host A's source MAC address and the port on which the frame arrived.
3. If Host B's MAC address is not in the CAM table, the switch floods the frame through eligible ports other than Host A's incoming port.
4. Host B replies. The switch learns Host B's source MAC address and its port.
5. Subsequent frames from A to B are known unicast and are sent only through Host B's recorded port.

MAC Address Resolution with ARP

An IPv4 host needs a destination MAC address before it can place an IPv4 packet inside an Ethernet frame. Address Resolution Protocol (ARP) maps a local IPv4 address to a MAC address.

1. The host checks its ARP cache for a current mapping.
2. If no mapping exists, it broadcasts an ARP request asking which interface owns the local IPv4 address.
3. The device using that IPv4 address sends an ARP reply, normally as a unicast response containing its MAC address.
4. The original host stores the mapping temporarily and sends the IPv4 packet in a unicast Ethernet frame.

For an off-network IPv4 destination, the host does not ARP for the remote server's MAC address. It resolves the default gateway's local IPv4 address instead and places the gateway's MAC address in the first Ethernet frame.

IPv6 does not use ARP. It uses Neighbor Discovery, which operates through IPv6 control messages and multicast rather than IPv4 ARP broadcasts.

Viewing Addresses and Tables

ip link show
arp -a

The exact display may label a MAC address as a physical address, link/ether address, hardware address, or BIA. The output can also show virtual interfaces that have their own addresses.

Limits and Security Considerations

A MAC address is not a reliable permanent identity. Many systems allow software to change, override, or randomize the address. Changing an interface's address or impersonating another address is commonly called MAC spoofing.

Switch port security and MAC filtering can provide limited access control. For example, a switch may restrict which learned MAC addresses are allowed on a port or may disable a port after a violation. These controls can reduce accidental connections or deter simple unauthorized access, but they are not strong authentication by themselves because an address can often be copied or changed.

Duplicate MAC addresses on the same LAN create ambiguity. A switch may learn one address on port 2 and then see the same source address on port 7. The CAM-table entry can repeatedly move between ports, a behavior called MAC flapping. Frames may then be sent to the wrong port or connectivity may work intermittently.

• Check virtual-machine settings, network bridges, cloning operations, and manually configured addresses when duplicates are suspected.
• Look for repeated messages showing one MAC address learned on different switch ports.
• Do not treat an observed MAC address as proof of a user's identity.

Troubleshooting MAC and Local-Network Problems

Local Device Is Unreachable

• Check the ARP cache for an entry for the destination IPv4 address.
• Confirm that the destination is connected to the expected LAN or VLAN.
• Inspect the switch MAC address table and verify that the destination MAC is learned on the expected port.
• Check interface state, cabling or wireless association, and VLAN membership.

Connectivity Is Intermittent

• Check for duplicate MAC address use or MAC spoofing.
• Look for CAM-table flapping, in which one MAC address repeatedly appears on different switch ports.
• Compare the host's configured address with the address shown by the operating system and the switch.

A Switch Floods Expected Unicast Traffic

• Confirm that the destination device has transmitted recently enough for the switch to learn its source MAC address.
• Check whether the learned entry has aged out.
• Verify VLAN membership and physical link status.

Local Access Works but Remote Access Fails

• Verify that the host resolves and uses the default gateway's MAC address for the remote destination.
• Check the gateway's ARP entry and its interface or VLAN connection.
• Separate link-layer reachability from IP routing and default-gateway configuration. A correct MAC table cannot fix an incorrect route.

Exam-Relevant Summary

• A MAC address is a link-layer address for a network interface; one device can have multiple MAC addresses.
• Standard Ethernet MAC addresses are 48 bits, represented as six hexadecimal octets.
• The first three octets commonly identify an OUI, while the remaining portion distinguishes an interface allocation.
• The first-octet I/G bit distinguishes individual and group addressing; the U/L bit distinguishes universal and local administration.
• FF:FF:FF:FF:FF:FF is the Ethernet broadcast address.
• Ethernet frames contain source and destination MAC addresses.
• A switch learns source MAC addresses, stores them in a CAM table, forwards known unicast traffic selectively, and floods unknown unicast and broadcast traffic within the relevant VLAN.
• Learned switch entries age out after a period without observed traffic.
• ARP maps a local IPv4 address to a MAC address. For a remote IPv4 destination, the first frame uses the default gateway's MAC address.
• MAC addresses can be changed or spoofed, so they should not be considered secure identities.

For related study, review basic MAC address concepts, computer networking fundamentals, IP routing, access and trunk ports, and packet inspection with tcpdump.