VMware ESXi and vSphere Cluster Management

What Is a MAC Address?

Learn what a MAC address is, how 48-bit addresses are structured, how switches use them, and how MAC addresses differ from IP addresses on Linux networks.

A MAC address is a link-layer identifier associated with a network interface. MAC stands for Media Access Control, a part of networking concerned with access to local network media and delivery of frames.

Ethernet adapters and Wi-Fi adapters use MAC-style addresses to deliver traffic across a local network. A MAC address helps a switch or wireless access point identify the local interface that should receive a frame. It does not route traffic across the Internet. Routing between different networks is handled by IP addresses and routers.

MAC Address Format

A conventional MAC address is 48 bits long, which equals 6 bytes. It is normally displayed as 12 hexadecimal digits. Hexadecimal is base-16 notation using the digits 0 through 9 and the letters A through F.

Each pair of hexadecimal digits represents one byte. For example, D8:D3:85:C0:00:08 contains six pairs: D8, D3, 85, C0, 00, and 08.

These notations represent the same six-byte value. Tools and operating systems may prefer one style, so do not assume that different separators mean different addresses.

How a MAC Address Is Structured

Traditional 48-bit MAC addressing divides the address into two 24-bit portions. The first 24 bits, or first three bytes, commonly identify a manufacturer's registered assignment. This part is often called the Organizationally Unique Identifier (OUI). The remaining 24 bits, or final three bytes, are assigned by the manufacturer to distinguish individual interfaces.

In the sample address D8:D3:85:C0:00:08, D8:D3:85 is the traditional vendor-related portion and C0:00:08 is the interface-specific portion. This division is useful for understanding traditional assignments, but it does not guarantee that every address currently in use follows a factory-manufacturer pattern.

How MAC Addresses Are Assigned

A network-interface manufacturer commonly assigns a factory MAC address to an Ethernet or Wi-Fi adapter. Historically, the goal was for these hardware addresses to be globally unique, allowing local network devices to distinguish interfaces reliably.

Uniqueness is an intended property, not an absolute guarantee. An address can be changed in software, copied or cloned onto another interface, randomized for privacy, or incorrectly duplicated because of a manufacturing or configuration error.

A locally administered address is designated as locally assigned rather than globally assigned by a manufacturer. Operating systems use locally administered addresses for features such as Wi-Fi privacy, virtual networking, testing, and interface configuration. The address presented by an operating system therefore may not be the same as the factory value stored in adapter firmware.

MAC Addresses Belong to Interfaces

A MAC address belongs to a network interface, not necessarily to an entire computer. One computer can have several interfaces, each with its own address.

• A wired Ethernet adapter can have one MAC address.
• A Wi-Fi adapter can have another.
• Bluetooth networking, virtual adapters, containers, and virtual machines can expose additional addresses.
• A virtual machine usually presents a virtual network interface with a virtual MAC address to the host or network.

The factory address may be stored in adapter firmware or other nonvolatile hardware storage. However, many operating systems can override the address presented by the interface. This is commonly called MAC spoofing when an address is deliberately changed, although changing an address can also be used for legitimate testing, compatibility, or privacy purposes.

How MAC Addressing Works on a LAN

A LAN, or local area network, is a network such as a home, school, or office network. On an Ethernet LAN, devices exchange frames containing source and destination MAC addresses. Wi-Fi uses MAC-style link-layer addressing for local wireless communication as well.

A switch is a Layer 2 device that forwards Ethernet frames. It learns by examining the source MAC address of incoming frames and recording which switch port leads toward that address. Its forwarding table might conceptually contain entries like these:

When the destination is a known unicast address, meaning traffic for one interface, the switch forwards the frame through the port associated with that address. If the destination is not yet in the forwarding table, the switch normally floods the frame out appropriate other ports. The destination device can respond, allowing the switch to learn where it is located.

Ethernet also supports other destination types:

• Unicast: sent to one destination interface.
• Multicast: sent to a group of interested receivers.
• Broadcast: sent to every host in the local broadcast domain. The Ethernet broadcast address is FF:FF:FF:FF:FF:FF.

MAC Addresses and IP Addresses

MAC and IP addresses solve different problems. A MAC address supports delivery on the local link, while an IP address supports addressing and routing between networks.

ARP and Neighbor Discovery

When an IPv4 computer needs to send traffic to a destination on the same subnet, it needs both the destination IP address and the local destination's MAC address. ARP, the Address Resolution Protocol, helps discover that mapping. The computer can then place the destination MAC address in the Ethernet frame.

For IPv6, Neighbor Discovery performs the corresponding link-layer address discovery functions. These mechanisms associate a local IP destination with a link-layer address; they do not turn a MAC address into a global Internet identity.

Local and Remote Destinations

Suppose a computer sends IPv4 traffic to a printer on the same subnet. It uses ARP to learn the printer's MAC address, then places that address in the destination field of the local Ethernet frame.

Now suppose the computer sends traffic to a website on a remote network. The first frame is addressed to the MAC address of the computer's local router, or default gateway. The remote website's MAC address is not placed in that first local frame. At each router hop, the old link-layer frame is removed and a new frame is created for the next link. The end device's MAC address is therefore not used unchanged across the Internet.

Finding a MAC Address on Linux

Modern Linux systems provide the ip command through the iproute2 tools. To list interfaces and their link-layer addresses, run:

ip link show

For a shorter, easier-to-scan output, use:

ip -br link

Look for the interface that is actually being used. Common names include eth0 or names beginning with en for wired Ethernet, and wlan0 or names beginning with wl for Wi-Fi. The address may appear after link/ether in detailed output.

After identifying an interface, such as eth0, you can read its current address directly from the system filesystem:

cat /sys/class/net/eth0/address

Replace eth0 with the actual interface name. The older ifconfig command is still encountered in some documentation, but ip link and ip -br link are the preferred modern tools.

Viewing Local Neighbor Mappings

To view IP-to-link-layer mappings currently known by Linux, run:

ip neigh show

This output can help connect a local IP address with the MAC address Linux learned through ARP or IPv6 Neighbor Discovery. The older command arp -n can inspect IPv4 ARP entries, but ip neigh show is the preferred modern alternative.

Privacy and Security Considerations

Devices on the same local network can often observe MAC addresses in local traffic or network-management information. A MAC address should not be treated as reliable proof of a person's identity, a device's ownership, or a permanent global identifier.

MAC randomization is a privacy feature commonly used by Wi-Fi clients. A phone or laptop may present a changing locally administered address when joining a wireless network. The address visible to that network can therefore differ from the factory-assigned Wi-Fi address. This makes long-term tracking across unrelated wireless networks more difficult.

MAC filtering allows a network device to accept or reject configured addresses, but it is weak access control. A MAC address can be imitated, and randomization can cause an expected address to change. Use stronger controls such as WPA2 or WPA3 authentication, appropriate credentials, network segmentation, and enterprise authentication where suitable.

Troubleshooting MAC Address Problems

The Expected MAC Address Is Not Shown

First list every interface with ip -br link. The wrong interface may have been checked, or the device may be using Wi-Fi instead of wired Ethernet. The interface may also be virtual, or the operating system may be using a locally administered or randomized address.

The Address Does Not Match the Adapter Label

A software override or MAC spoofing may be active. Wi-Fi randomization may also be enabled, or the label may belong to a different physical interface. Compare the address shown for the active interface with the interface configuration and privacy settings.

MAC Filtering Does Not Provide the Expected Protection

Addresses can be imitated, a client may randomize its address, or the configured address may belong to another adapter. Treat MAC filtering as an administrative convenience rather than a security boundary. Use authenticated wireless security and segmentation for meaningful protection.

Two Devices Cause Intermittent Local Connectivity

Duplicate MAC addresses can result from cloning, incorrect configuration, or virtual-machine settings. Look for conflicting entries in switch forwarding information or host neighbor tables. Then correct the virtual-interface configuration or assign a distinct address as appropriate.

Summary

• A MAC address is a link-layer identifier associated with a network interface.
• A conventional MAC address is 48 bits, or six bytes, normally shown as 12 hexadecimal digits.
• The first three bytes traditionally represent a vendor-related OUI assignment, while the final three bytes distinguish an interface.
• Switches use MAC addresses to forward frames within a local LAN.
• IP addresses support communication between networks; routers replace link-layer frame information at each hop.
• Linux users can inspect addresses with ip link show, ip -br link, and cat /sys/class/net/<interface>/address.
• MAC addresses can be randomized, overridden, duplicated, or spoofed, so they are not reliable global identities or strong access controls.

For a related explanation of network-layer addressing, see What Is a MAC Address?.