MAC Addresses Explained: The Hardware Identity of Network Devices

A MAC address (Media Access Control address) is a unique hardware identifier permanently assigned to every network interface card (NIC) by the manufacturer. Think of it like a serial number burned into the hardware at the factory.

While IP addresses can change (you get a different one when you connect to a different network), your MAC address stays the same. It's hardcoded into your network adapter's ROM (read-only memory).

Format: MAC addresses are 48 bits (6 bytes) long, typically written as six pairs of hexadecimal digits separated by colons or hyphens:

This address operates at the Data Link Layer (Layer 2) of the OSI model, making it fundamental to how local networks actually deliver data between devices.

A MAC address has two parts:

OUI: The Manufacturer ID

The first half (24 bits) is assigned by IEEE to manufacturers. Each company gets their own unique OUI prefix. This tells you who made the network adapter.

Examples:

• 00:50:56 - VMware virtual adapters
• 00:0C:29 - VMware (another range)
• 3C:22:FB - Apple devices
• 00:1B:63 - Cisco equipment
• 00:E0:4C - Realtek NICs

You can look up any OUI at maclookup.app to see the manufacturer.

NIC Specific: The Device Serial

The last 24 bits are assigned by the manufacturer to each individual device. This is essentially the serial number. With 2^24 (16,777,216) possible combinations, each manufacturer can produce millions of unique devices under their OUI.

Theoretically unique worldwide: With 24 bits for OUI and 24 bits for device ID, there are 2^48 (281 trillion) possible MAC addresses. In practice, no two devices should ever have the same MAC address.

MAC vs IP: Different Jobs

Both MAC and IP addresses identify devices, but they work at different layers and serve different purposes:

How Data Gets Delivered Using MAC Addresses

When you send data on a local network, here's what happens:

1. 1. You want to send data to 192.168.1.50 (an IP address on your local network)
2. 2. Your computer checks its ARP cache to see if it knows the MAC address for that IP
3. 3. If not cached, it sends an ARP broadcast: "Who has 192.168.1.50? Tell me your MAC address!"
4. 4. The device at 192.168.1.50 replies: "I'm 192.168.1.50, my MAC is AA:BB:CC:DD:EE:FF"
5. 5. Your computer creates an Ethernet frame with the destination MAC address
6. 6. The switch reads the MAC address and forwards the frame ONLY to the port where that MAC is connected
7. 7. The destination device receives the frame because its NIC recognizes its own MAC address

Key point: Within a local network, switches use MAC addresses to deliver frames. IP addresses tell you WHO to send to, MAC addresses tell the hardware HOW to physically deliver it.

Broadcast Address

FF:FF:FF:FF:FF:FF

This is the broadcast MAC address. When you send to this address, EVERY device on the local network receives the frame. Used for ARP requests, DHCP discovery, and other protocols that need to reach all devices.

Multicast Addresses

MAC addresses starting with 01:00:5E are IPv4 multicast addresses. These are used to send data to multiple specific devices (a group) rather than broadcasting to everyone.

Example: Video streaming services use multicast to send one stream that multiple receivers can pick up, instead of sending individual streams to each viewer.

Locally Administered Addresses

The second hex digit tells you if the MAC is universally administered (by manufacturer) or locally administered (manually set by admin):

• Universally Administered: Second digit is even (0, 2, 4, 6, 8, A, C, E)
• Locally Administered: Second digit is odd (1, 3, 5, 7, 9, B, D, F)

Example: 02:XX:XX:XX:XX:XX is locally administered (2 is even but the second bit is set, making it local in binary).

Windows

Method 1: Command Prompt

Look for "Physical Address" under each network adapter. That's the MAC address.

Method 2: getmac command

Shows MAC addresses and which adapter they belong to in a clean format.

Method 3: Network Settings GUI

1. 1. Open Settings → Network & Internet
2. 2. Click your connection (Wi-Fi or Ethernet)
3. 3. Click "Hardware properties"
4. 4. Physical address (MAC) is listed there

Linux

Look for "link/ether" - that's your MAC address.

macOS

Or: System Preferences → Network → Advanced → Hardware → MAC Address

Router Admin Page

Log into your router's admin interface (usually 192.168.1.1 or 192.168.0.1). Look for "Connected Devices," "DHCP Clients," or "Device List." You'll see every device's MAC address and IP.

1. Network Access Control (MAC Filtering)

Routers and enterprise Wi-Fi systems can restrict access based on MAC addresses. Only devices with approved MACs can connect.

Important: This is NOT real security. MAC addresses can be spoofed (changed) easily. It's just a basic access control layer, not actual encryption or authentication.

2. DHCP Reservations

You can configure your router to always assign the same IP address to a specific MAC address. This ensures your printer, server, or smart home device always gets the same IP, even though DHCP is dynamic.

3. Network Troubleshooting

When diagnosing network issues, MAC addresses help you identify:

• • Which physical device is causing problems
• • Whether duplicate MACs exist (major network issue)
• • What vendor made the problematic device (via OUI lookup)
• • If MAC address conflicts are causing connectivity issues

4. Switch MAC Address Tables

Network switches maintain a MAC address table (also called CAM table) that maps each MAC to a physical switch port. When a frame arrives, the switch looks up the destination MAC and forwards it ONLY to the correct port.

This is how switches are smarter than hubs—hubs broadcast everything to all ports. Switches use MAC addresses to forward intelligently.

Even though MAC addresses are "burned in" to hardware, the operating system can override them. This is called MAC spoofing or MAC cloning.

Why Would You Spoof a MAC?

Legitimate reasons:

• • Bypassing MAC filtering on your own network after changing NICs
• • Troubleshooting to test if a device with a specific MAC can connect
• • ISPs that lock service to a specific MAC (you replace the router but need the old MAC)

Security concerns:

• • Attackers can spoof MACs to bypass MAC filtering
• • Can impersonate another device on the network
• • Used in ARP spoofing attacks to intercept traffic

Duplicate MAC Address

Symptoms: Intermittent connectivity, devices randomly disconnecting, network conflicts.

Cause: Two devices have the same MAC (extremely rare but possible with cheap cloned NICs or virtual machines not configured properly).

How to find: Check your router's connected devices list. If you see the same MAC twice, you have a duplicate. Also check ARP cache on another device:

Fix: If it's a virtual machine, regenerate the MAC in VM settings. If it's hardware, replace the faulty NIC.

MAC Address Not Showing Up

Symptoms: ipconfig /all shows blank or 00-00-00-00-00-00 for physical address.

Possible causes:

• • Network adapter driver not installed or corrupted
• • Hardware failure of the NIC
• • Adapter disabled in Device Manager

Fix: Update/reinstall network adapter drivers, enable the adapter, or replace hardware if faulty.

Can't Connect Due to MAC Filtering

If you can't connect to a Wi-Fi network and you've verified the password is correct, MAC filtering might be blocking you.

Fix: Access the router admin panel and add your device's MAC address to the whitelist, or disable MAC filtering entirely.

• • MAC addresses are 48-bit hardware identifiers burned into NICs
• • Format: 6 pairs of hex digits (00:1A:2B:3C:4D:5E)
• • First 24 bits = OUI (manufacturer), last 24 bits = device serial
• • Operate at Layer 2 (Data Link Layer) of OSI model
• • Used by switches to forward frames to correct ports
• • Different from IP addresses—MAC is local, permanent hardware ID
• • Broadcast MAC: FF:FF:FF:FF:FF:FF (reaches all devices)
• • Can be spoofed in software despite being "permanent"
• • MAC filtering is NOT real security—use encryption (WPA2/WPA3)
• • Find MAC with ipconfig /all (Windows) or ip link (Linux)

Understanding MAC addresses is essential for network troubleshooting, switch configuration, and comprehending how local network communication actually works at the hardware level.