MAC Addresses: Identification and Use on Local Networks

Learn how MAC addresses identify network interfaces, how switches and ARP use them, how to find them on major platforms, and why MAC filtering is limited security.

A MAC address is a link-layer identifier associated with a network interface. MAC means Media Access Control, a function concerned with controlling access to a shared network medium. Network interfaces include physical hardware such as Ethernet and Wi-Fi adapters, as well as virtual interfaces created by virtual machines, containers, VPNs, and other software.

MAC addresses are used mainly to deliver Ethernet and Wi-Fi frames across a local network segment. A computer can have several MAC addresses because each network interface can have its own address. For example, a laptop may show separate addresses for wired Ethernet, Wi-Fi, Bluetooth, a virtual machine adapter, and a VPN interface.

MAC Addresses and Network Layers

MAC addressing belongs to the data-link layer, often called Layer 2. An Ethernet frame has source and destination MAC fields, while an IP packet carried inside that frame has source and destination IP addresses.

MAC address: supports local frame delivery between interfaces on the same Layer 2 network.
IP address: provides logical addressing and routing between different networks.

A router connects separate Layer 2 networks. At every router hop, the old Ethernet frame is removed and a new link-layer frame is created for the next link. The end-to-end IP packet is typically retained, although routers may change some IP header fields such as the time-to-live or hop limit.

MAC Address Versus IP Address

Scope: a MAC address is meaningful on its local link or VLAN; an IP address can identify a destination across multiple networks.
Delivery: switches use MAC addresses to forward frames; routers use IP addresses to forward packets.
Changes at a router: link-layer source and destination addresses change at each hop, while the packet's IP destination normally remains the remote host.
Assignment: MAC addresses are associated with interfaces, whereas IP addresses are assigned through configuration or services such as DHCP.

MAC Address Format

The traditional Ethernet MAC address is 48 bits, or 6 bytes. Each byte is written as two hexadecimal digits, so the complete address contains 12 hexadecimal digits.

For example, 00:1A:2B:3C:4D:5E contains six byte pairs: 00, 1A, 2B, 3C, 4D, and 5E. The same value may be displayed with different separators.

Common Notation

Colon-separated: 00:1A:2B:3C:4D:5E
Hyphen-separated: 00-1A-2B-3C-4D-5E
Dot-separated: 001A.2B3C.4D5E

These three forms represent the same 48-bit value. Operating systems and network equipment may choose different display formats.

Organizational and Device Portions

In a traditionally assigned address, the first 24 bits, or first three bytes, are commonly called the OUI, meaning Organizationally Unique Identifier. It is associated with an organization or manufacturer. The remaining 24 bits identify an interface within that assignment.

The OUI is useful for inventory clues, but it is not proof of the current manufacturer or physical device. Virtual interfaces, address changes, private Wi-Fi addresses, and spoofing can make the displayed value differ from a factory assignment.

Address Assignment Bits

Two low-order bits in the first byte classify important address properties:

The individual/group bit indicates unicast when clear and multicast when set.
The universal/local bit indicates a universally administered address when clear and a locally administered address when set.

A locally administered address is assigned by local software, an administrator, or an operating system rather than being used as a globally assigned manufacturer identity. Private or randomized Wi-Fi addresses commonly use this category.

Unicast, Multicast, and Broadcast

Unicast traffic is intended for one receiving interface. Most ordinary host-to-host traffic is unicast.
Multicast traffic is sent to a group of interested receivers. The receivers subscribe or otherwise listen for the relevant group.
Broadcast traffic is sent to every device in a broadcast domain. The Ethernet broadcast address is FF:FF:FF:FF:FF:FF, also called the all-ones address.

How Local Communication Uses MAC Addresses

An Ethernet frame is a data-link-layer unit. Among other fields, it contains a destination MAC address and a source MAC address. A sender places the receiving interface's MAC address in the destination field and its own interface address in the source field.

IPv4 and ARP

Applications usually identify destinations with IP addresses rather than MAC addresses. On an IPv4 LAN, a host uses ARP, the Address Resolution Protocol, to map a local IPv4 address to a MAC address.

A workstation at 192.168.1.10 needs to send to 192.168.1.25.
It checks its ARP cache for an existing mapping.
If no mapping exists, it sends an ARP request as a broadcast asking which interface owns 192.168.1.25.
The device using that address replies with its MAC address.
The workstation places that MAC address in the destination field of subsequent Ethernet frames.

IPv6 does not use ARP. Its Neighbor Discovery mechanisms, carried through ICMPv6, perform corresponding link-layer address resolution and neighbor functions.

Remote Destinations and the Default Gateway

When the destination IP is outside the local IP network, the host does not try to discover the remote server's MAC address. Instead, it sends the first local frame to the MAC address of its default gateway, the local router used to reach outside networks.

For example, a workstation may create an IP packet addressed to a web server on another network. The packet names the web server as its IP destination, but the first Ethernet frame names the router's local interface as its MAC destination. After the router receives the frame, it creates a new frame for the next link.

Switching and MAC Address Tables

A switch maintains a MAC address table, also called a CAM table. The table maps learned MAC addresses to switch ports and VLANs. A VLAN is a logical Layer 2 network segment and broadcast domain.

MAC Learning and Forwarding

When a frame arrives, the switch reads its source MAC address.
The switch records that source address against the incoming port and VLAN.
If the destination MAC is known on another port in the same VLAN, the switch forwards the frame only through that port.
If the destination MAC is unknown, the switch floods the frame through relevant ports in the VLAN, except the incoming port.
When the destination replies, the switch learns the reply's source location and can usually forward later frames directly.

Switches normally forward broadcasts throughout the relevant VLAN because every device in that broadcast domain may need to receive them. Routers normally stop broadcasts at a Layer 3 boundary, preventing a local broadcast from spreading across all connected networks.

MAC Table Aging

Learned entries are temporary. After an aging timer expires without seeing traffic from an address, the switch removes the entry. This allows the table to adapt when a device moves to another port, disconnects, or changes its interface.

If a frame later arrives for an aged-out address, the switch treats the destination as unknown and floods it within the VLAN until it learns the correct location again.

Special Cases and Privacy Features

Broadcast and Multicast

The broadcast address FF:FF:FF:FF:FF:FF reaches every interface in the local broadcast domain that accepts the relevant frame. Multicast addresses support group delivery, such as discovery, service announcements, and routing protocols. Broadcast and multicast traffic can consume resources, which is one reason network designs limit broadcast domains with VLANs and routers.

Randomized or Private Wi-Fi MAC Addresses

Modern operating systems may use a private or randomized MAC address when joining Wi-Fi networks. The purpose is to reduce tracking based on a persistent hardware identifier. A phone might use one private address for one saved wireless network and a different address on another network.

This feature can affect administration. A DHCP reservation or wireless allowlist must use the address the device actually presents on that network, not necessarily the factory address printed on the hardware or shown on another connection.

MAC Spoofing

MAC spoofing means presenting a modified MAC address from an interface. Legitimate uses include testing, replacing a failed adapter while preserving a reservation, privacy configuration, and compatibility with systems that expect a particular address. Using a spoofed address to bypass access controls, impersonate another device, or disrupt a network is misuse.

Finding a MAC Address

The correct address depends on the active interface. First identify whether the device is using Ethernet, Wi-Fi, a virtual adapter, Bluetooth, a VPN, or another connection. Loopback interfaces do not represent a physical LAN connection and are generally not the address to give to a DHCP administrator.

Windows

ipconfig /all

Locate the active adapter and its Physical Address. The verbose adapter details also show whether the interface has an IP configuration.

getmac /v

This lists MAC addresses with adapter names and connection information. To inspect cached IPv4 mappings, use:

arp -a

macOS

networksetup -listallhardwareports

This lists hardware ports, device names, and Ethernet addresses. For lower-level interface details, use:

ifconfig

Look for the ether field on the relevant interface. Cached IPv4 address-to-MAC mappings are available with:

arp -a

Linux

ip link show

Find the active interface and its link/ether value. Neighbor cache entries for both IPv4 and IPv6 can be inspected with:

ip neigh show

Mobile Devices

On Android and iOS, open the details for the connected Wi-Fi network in the network settings. Look for a Wi-Fi address, private address, or randomized address setting. The wording differs by operating-system version. Make sure you inspect the address for the currently connected network, because private addressing may use a different value per network.

Switches

On a Cisco-style switch, an administrator can inspect learned addresses with:

show mac address-table

The output normally includes the VLAN, learned MAC address, type, and switch port.

Commands for MAC and Neighbor Information

Windows — ipconfig /all: locate adapter names and Physical Address values.
Windows — getmac /v: list MAC addresses with adapter details.
Windows — arp -a: view IPv4 ARP cache entries.
macOS — networksetup -listallhardwareports: map hardware ports to device names and Ethernet addresses.
macOS — ifconfig: inspect interfaces and their ether fields.
macOS — arp -a: view cached IPv4 mappings.
Linux — ip link show: list interfaces and link-layer addresses.
Linux — ip neigh show: view IPv4 ARP and IPv6 neighbor entries.
Switch CLI — show mac address-table: inspect learned addresses, VLANs, and ports.

Administration and Security

Useful Administrative Applications

DHCP reservations: consistently assign a local IP address to a printer, server, camera, or other interface.
Network inventory: associate observed interfaces with rooms, users, equipment, or switch ports.
Access-control lists: apply a policy to an interface address in environments where this is appropriate.
Troubleshooting: compare a device's address with ARP entries, switch tables, and wireless controller records.

A DHCP reservation must use the MAC address of the active interface. If a device switches between Ethernet and Wi-Fi, each interface may need a separate reservation. Private Wi-Fi addressing can also make a recorded factory address differ from the address seen by the access point.

MAC Filtering Is Not Strong Authentication

MAC filtering allows or denies listed interface addresses. It can reduce accidental connections or provide basic administrative control, but it is not strong security. An attacker who can observe local traffic may learn an allowed address and configure an interface to imitate it.

Use stronger controls such as appropriate Wi-Fi encryption, authenticated network access, account controls, segmentation, and monitoring. Treat a MAC allowlist as one policy input, not as proof of a device's identity.

Privacy Considerations

A persistent wireless MAC address can help observers recognize that the same device has returned to a network or location. MAC randomization reduces this tracking risk. The trade-off is that inventory systems, reservations, and access policies must account for the address currently used by the device.

Troubleshooting MAC-Related Problems

Same-LAN Communication Fails

Confirm both devices have valid IP settings in the expected subnet and VLAN.
Inspect ARP or IPv6 neighbor entries to see whether the destination IP resolves to a MAC address.
Check the switch MAC table, port state, and VLAN membership.
Verify the cable, Wi-Fi association, interface status, and local firewall.

A DHCP Reservation Gives the Wrong Address

Confirm that the reservation uses the active interface's MAC address.
Check whether the device is using Wi-Fi instead of Ethernet, or the reverse.
Check whether private or randomized Wi-Fi addressing is enabled.
Correct the reservation and renew the DHCP lease.

An Access Policy Denies a Known Device

Compare the address observed by the network with the address recorded in the policy.
Check for MAC randomization.
Verify the expected interface and VLAN.
Do not rely on a MAC allowlist as the sole security control.

A Switch Shows a MAC Moving Between Ports

Check whether the device was physically moved.
Investigate loops, unmanaged switches, bridges, and virtualization settings.
Review port-security and VLAN configuration before disabling a port.

Practical Examples

Recognizing Equivalent Notation

00:1A:2B:3C:4D:5E, 00-1A-2B-3C-4D-5E, and 001A.2B3C.4D5E represent one 48-bit MAC address.

Local Versus Remote Traffic

For a workstation at 192.168.1.10 sending to 192.168.1.25 on the same LAN, ARP discovers the destination interface's MAC address, and the Ethernet destination field contains that address.

For a web server on another network, the IP packet contains the web server's IP address, but the first Ethernet frame contains the default gateway's MAC address. The router then uses a new frame on the next link.

Switch Learning

If a switch receives a frame from a device on port 3, it learns the source MAC on port 3. Later frames addressed to that MAC can be sent only to port 3. If the destination is not yet in the table, the switch floods the frame within the VLAN except through the incoming port.

DHCP Reservation and Private Wi-Fi

An administrator can reserve a printer's local IP address using the printer interface's MAC address. If a phone uses a private Wi-Fi address, however, the address shown for that saved wireless network—not necessarily the factory address—must be used for a network-specific reservation or policy.

Exam-Relevant Notes

A standard MAC address is 48 bits or 6 bytes.
The first 24 bits are commonly associated with an OUI; the remaining portion is traditionally device-specific.
MAC addresses operate at the data-link layer and support local frame delivery.
IP addresses support logical routing between networks.
ARP maps IPv4 addresses to MAC addresses on a local network; IPv6 uses Neighbor Discovery.
A remote destination is reached first through the default gateway's MAC address.
A switch learns from source MAC addresses, forwards known destinations selectively, floods unknown destinations, and ages learned entries.
FF:FF:FF:FF:FF:FF is the Ethernet broadcast address.
MAC filtering is easy to imitate and should not be treated as strong authentication.

For related background, review computer networking fundamentals, CSMA/CD, IP routing, and packet capture with tcpdump.