6.2 MAC Addresses

Uniqueness of MAC Addresses

Every network device that connects to an Ethernet network uses a Media Access Control address, usually called a MAC address. A MAC address is a low level identifier that belongs to the network interface itself, not to a protocol like IP. It is intended to be globally unique so that no two network interfaces in the world share the same MAC address.

A MAC address is 48 bits long. In human readable form it is usually written as six groups of two hexadecimal digits, for example 00:1A:2B:3C:4D:5E or 00-1A-2B-3C-4D-5E. Each pair of hexadecimal digits represents 8 bits, so six pairs give $6 \times 8 = 48$ bits. Because hexadecimal digits can represent values from 0 to 15, you will often see letters A to F in MAC addresses.

The 48 bit space allows for $2^{48}$ possible MAC addresses. This very large number makes it practical to give each physical network interface its own unique address. In practice, some addresses are reserved for special purposes, so not all combinations are used for ordinary devices.

MAC addresses are assigned to network interface cards by manufacturers. The first part of the MAC address is allocated to the manufacturer, and the remaining part is set by that manufacturer to create individual addresses for each device they build. This structure helps maintain global uniqueness across different vendors.

Structure of a MAC Address

A MAC address has an internal structure that splits the 48 bits into two main fields. The first 24 bits are called the Organizationally Unique Identifier, or OUI. The OUI identifies the vendor that produced the network interface. The last 24 bits are called the device identifier, or NIC specific portion, which is assigned by the vendor to distinguish individual interfaces.

You can think of the OUI as a vendor prefix, and the remaining bits as a serial number that the vendor controls. The combination of vendor prefix and serial number must be unique for each network interface.

A typical layout looks like this:

When the MAC address is written as six pairs, the first three pairs contain the OUI, and the last three contain the device identifier. For example, in 00:1A:2B:3C:4D:5E, the OUI is 00:1A:2B and the device identifier is 3C:4D:5E.

Within the first byte of the MAC address, two special bits carry additional meaning. These bits indicate whether the address is locally or universally administered and whether it is intended for a single device or a group. These properties will be used later to distinguish unicast, multicast, broadcast, and locally overridden addresses.

Unicast, Multicast, and Broadcast MAC Addresses

In Ethernet, MAC addresses can represent a single device, a group of devices, or all devices on a local network. These three categories are called unicast, multicast, and broadcast.

A unicast MAC address identifies one specific network interface. Frames sent to a unicast MAC are intended for that single destination. Most of the MAC addresses you see on ordinary devices are unicast addresses. By convention, a unicast MAC address has its least significant bit of the first byte set to 0.

A multicast MAC address identifies a group of interfaces that are interested in the same traffic. Frames sent to a multicast MAC address can be accepted by multiple devices at the same time. For example, some streaming or discovery protocols use multicast so that many hosts can receive the same data. In a multicast MAC address the least significant bit of the first byte is set to 1.

The broadcast MAC address is a special case. It is a MAC address where all bits are set to 1. In hexadecimal notation, this is FF:FF:FF:FF:FF:FF. A frame sent to the broadcast MAC address is processed by every device on the local Ethernet network. Some low level protocols use broadcast MAC frames to discover devices or to ask questions to all hosts on the local network at once.

Universal vs Local Administration

Manufacturers usually burn a MAC address into each network card at the factory. These are called universally administered addresses and are based on the OUI allocations that vendors receive. With a universally administered MAC, the combination of OUI and device identifier should be unique across the entire world.

There are situations where an administrator may want to override the factory assigned MAC address. Examples include special clustering software, virtual machines that need predictable MAC values, or privacy features in some operating systems. When a MAC address is overridden in software, it becomes a locally administered address.

The difference between universal and local administration is indicated by a specific bit in the first byte of the MAC address. This bit is often called the U/L bit, for universal or local. When this bit is 0, the address is treated as universally administered. When it is 1, the address is treated as locally administered.

The U/L bit is not a security control. It is only an indicator of how the address was intended to be assigned. Network devices do not authenticate the MAC address against any central authority. They only treat it as a label for communication at the Ethernet level.

MAC Addresses and Ethernet Frames

In Ethernet communication, every frame has a source MAC address and a destination MAC address in its header. These two fields indicate who sent the frame and who should receive it on the local network segment.

The source MAC address always contains the MAC address of the interface that transmitted the frame. Ethernet devices rely on this source field to learn which addresses are reachable through which switch ports. Later, this learning behavior is used by switches to build tables that map MAC addresses to ports.

The destination MAC address determines how switches and network interfaces handle the frame. If the destination is a unicast MAC that a switch recognizes in its table, the frame can be forwarded only to the specific port associated with that address. If it is a multicast or broadcast address, switches replicate the frame to multiple ports so that many devices can see it.

The presence of MAC addresses in every Ethernet frame is central to how Ethernet works as a layer 2 technology. Higher layer protocols such as IP sit above this and have their own addressing systems. When data is sent on Ethernet, the MAC addresses are used to move frames across the local link, while other types of addresses handle communication across larger networks.

MAC Addresses and Local Scope

MAC addresses operate only within the local network segment. Routers, which connect different IP networks, do not forward frames based on destination MAC addresses across separate Ethernet segments. Instead, routers use higher layer addresses to decide where to send traffic between networks, and each link uses its own pair of source and destination MAC addresses.

Because MAC addresses are concerned with the local segment only, they change hop by hop as traffic moves through a routed network. When a frame reaches a router, the router removes the original frame and creates a new one for the next segment. The new frame will carry new source and destination MAC addresses that are valid for that specific link.

This local nature is important. It means that no device on a remote network ever sees the MAC address of your computer directly. They only see IP addresses or higher layer identifiers. The MAC address stays relevant only to the devices that share the same Ethernet network or wireless link.

Viewing and Modifying MAC Addresses

On most operating systems, you can view the MAC address of each network interface using standard tools. The MAC address is often labeled as the hardware address, physical address, or similar term. These tools read the value that the network interface is currently using, which might be the burned in address from the vendor or a locally overridden one.

Administrators and some applications can change the MAC address that an interface presents to the network. This process is sometimes called MAC spoofing or changing the MAC. When this is done, the interface continues to function, but switches and other devices now see a different source MAC in the frames that it sends.

Changing MAC addresses affects how switches learn and forward frames, because they associate observed MAC addresses with specific ports. Rapid or frequent changes can create confusion in switching tables and may trigger security features in more advanced configurations. For basic understanding, it is enough to remember that the MAC address your interface uses can be different from the one stored permanently in hardware, and that the U/L bit indicates that situation in the address itself.

Special and Reserved MAC Address Ranges

Not all MAC addresses are available for general use. Some ranges are reserved for specific protocols or types of traffic. For example, there are dedicated multicast MAC ranges that map to certain higher layer multicast groups. Protocols that must reach multiple devices on the same Ethernet network can request addresses from these multicast ranges.

Some multicast MAC addresses are used by discovery and control protocols that operate within the network infrastructure. Switches and other devices listen on these addresses to receive control messages. Broadcast MAC, as already described, is a single special address that all devices recognize.

The OUI space itself is also managed. Vendors request OUIs from a central authority so that their assigned prefixes do not overlap. This organized allocation avoids accidental duplication of MAC addresses between different manufacturers. For ordinary users, the visible result is that MAC addresses from the same vendor often share the same first three hexadecimal pairs.

Understanding that reserved and structured ranges exist helps explain why some MAC addresses look predictable or share common prefixes among devices from the same maker. It also shows that the MAC address space has an internal order, and is not just a random collection of hexadecimal values.