What a MAC address is
A MAC address (Media Access Control address) is a 48-bit number that identifies one network interface on a local network. Every Ethernet port and Wi-Fi adapter has one (Bluetooth radios use a similar 48-bit address). It looks like this: 00:00:5e:00:53:2a.
The manufacturer stores it in the interface when it is made, which is why it is also called the burned-in address or physical address. However, software can replace it, and many devices now use a random MAC address instead (see below). A laptop with an Ethernet port and Wi-Fi has two MAC addresses, one for each interface.
💡 In simple terms: if an IP address is your postal address (it changes when you move house), a MAC address is more like your name: it usually stays with you, and it identifies you to the people standing right next to you.
Why it exists alongside the IP address
A common beginner question is this: if every device has an IP address, why does it also need a MAC address? The answer is that the two addresses do different jobs at different layers:
- The IP address says where the data is finally going, across many networks. It is used for the whole journey.
- The MAC address says which device on this link should receive the frame next. It is used for one hop at a time.
| MAC address | IP address | |
|---|---|---|
| Layer | Layer 2 (Data Link) | Layer 3 (Network) |
| Size | 48 bits, written as 12 hex digits | 32 bits (IPv4) or 128 bits (IPv6) |
| Who sets it | The manufacturer (or the OS, for random MACs) | An administrator or a DHCP server |
| Does it change when you move? | Usually not, unless the device uses a random MAC per network | Yes: it depends on the network you join |
| How far it is used | Only on the local link, up to the next router | End to end, across the internet |
| Structure | Flat: shows who made it, not where it is | Hierarchical: network part + host part |
Ethernet existed before IP was everywhere, and it can carry many kinds of traffic, so it has its own addressing. A switch only looks at MAC addresses; it does not need to understand IP at all. The link between the two is ARP (Address Resolution Protocol), which finds the MAC address that belongs to an IP address on the local network.
- 1. On the LAN: the frame goes from the laptop's MAC address (02:00:00:00:00:aa) to the router's MAC address (02:00:00:00:00:01). The IP packet inside is addressed to 203.0.113.10.
- 2. Past the router: the router builds a new frame with its own WAN MAC address as the source. The laptop's MAC address never leaves the home network, but the destination IP address 203.0.113.10 is unchanged.
Where MAC addresses are used
- In every Ethernet and Wi-Fi frame: the destination and source fields of the Ethernet frame.
- In a switch's MAC address table: so the switch knows which port leads to which device (see How a switch learns MAC addresses).
- In every computer's ARP cache: a list of “this IP address is at this MAC address” for devices on the local network.
- In DHCP: the server recognises a client by its MAC address, which is how address reservations work (see DHCP).
- In Wi-Fi and security rules: MAC filtering, guest portals and network access control.
How a MAC address is built
48 bits are too many to read in binary, so the address is written as 12 hexadecimal digits, in 6 pairs. Each pair is one byte (8 bits). Hexadecimal uses the digits 0–9 and a–f, and each digit stands for 4 bits. The address has two halves:
- Bit 0, I/G: 0 = individual (unicast), 1 = group (multicast/broadcast)
- Bit 1, U/L: 0 = universally administered (burned in), 1 = locally administered (set by software)
First 24 bits: the OUI
The Organizationally Unique Identifier. The IEEE assigns blocks of addresses to manufacturers (for a fee), and each block has its own OUI. If you look up the OUI, you can see who made the interface.00:00:5e belongs to IANA.
Last 24 bits: the device part
Chosen by the manufacturer, with a different value for every interface it makes. 24 bits give about 16.7 million addresses per OUI, so large manufacturers own many OUIs.
💡 The example 00:00:5e:00:53:2a comes from a block that RFC 7042 reserves for documentation, so it will never belong to a real device. This course also uses addresses such as 02:00:00:00:00:aa; you will see below why those are also safe to use.
Notation formats
Different systems write the same 48 bits in different ways. They all mean exactly the same address, and upper or lower case does not matter:
| Style | Same address |
|---|---|
| Colons (Linux, macOS, Wireshark) | 00:00:5e:00:53:2a |
| Hyphens (Windows) | 00-00-5E-00-53-2A |
| Dotted groups of four (Cisco) | 0000.5e00.532a |
| No separators (some apps and databases) | 00005E00532A |
The two special bits
Two bits in the first byte have a special meaning. In the diagram above, they are the last two bits of that byte:
| Bit | When 0 | When 1 |
|---|---|---|
| I/G (Individual/Group), the lowest bit | Unicast: one interface | Group: multicast or broadcast |
| U/L (Universal/Local), the next bit | Universally administered: assigned by the manufacturer from its OUI | Locally administered: set by software or by an administrator |
A quick way to read these bits is to look at the second hex digit of the address:
- Odd (1, 3, 5, 7, 9, b, d, f): the I/G bit is 1, so it is a group address.
- 2, 6, a or e: a locally administered unicast address.
- 0, 4, 8 or c: a normal manufacturer-assigned unicast address.
Unicast, broadcast and multicast MACs
| Type | Example | Who accepts it |
|---|---|---|
| Unicast | 02:00:00:00:00:bb | Only the interface with that address |
| Broadcast | ff:ff:ff:ff:ff:ff (Cisco: ffff.ffff.ffff) | Every device on the LAN |
| IPv4 multicast | 01:00:5e:xx:xx:xx | Devices that have joined that group |
| IPv6 multicast | 33:33:xx:xx:xx:xx | Devices that have joined that group |
The broadcast address is simply all 48 bits set to 1. Multicast addresses have the I/G bit set: 01 in binary is 00000001, so its lowest bit is 1. A source MAC address is never a group address, because a frame always comes from one interface.
- Bit 0, I/G: 0 = individual (unicast), 1 = group (multicast/broadcast)
- Bit 1, U/L: 0 = universally administered (burned in), 1 = locally administered (set by software)
This multicast address carries mDNS (multicast DNS), the protocol that printers and smart speakers use to announce themselves on a home network. The rules for building multicast MAC addresses have their own lesson.
Learn more: Unicast, Broadcast and Multicast
How a network card uses its MAC address
When a frame arrives, the network card makes a quick decision before the operating system sees it:
- Read the destination MAC address (the first 6 bytes of the frame header).
- Is it my own MAC address? Accept the frame.
- Is it ff:ff:ff:ff:ff:ff? Accept the frame: broadcasts are for every device.
- Is it a multicast group I have joined? Accept the frame.
- Anything else: ignore the frame.
A capture tool such as Wireshark can switch the card into promiscuous mode, where it accepts every frame. On a switched network, you still mostly see only your own, broadcast and some multicast traffic, because the switch sends unicast frames only to the right port.
Locally administered addresses and MAC randomisation
Software can replace the burned-in address with an address of its own. To avoid clashing with manufacturers' addresses, it sets the U/L bit to 1, making a locally administered address. The example 02:00:00:00:00:aa is one: 02 is 00000010 in binary, so U/L is 1 and I/G is 0.
- Bit 0, I/G: 0 = individual (unicast), 1 = group (multicast/broadcast)
- Bit 1, U/L: 0 = universally administered (burned in), 1 = locally administered (set by software)
You will see locally administered MAC addresses in three places:
📱 Phones and laptops
iOS (“Private Wi-Fi Address”), Android (“Randomised MAC”) and Windows (“Random hardware addresses”) can use a different random MAC address for each Wi-Fi network, so the device cannot easily be tracked from place to place.
🖥️ Virtual machines
A virtual machine has no physical network card, so the hypervisor or cloud provider generates a MAC address for each virtual interface.
🔧 Manual changes
An administrator can set a MAC address by hand, for example to keep the same address after replacing a network card.
⚠️ Because MAC addresses can be changed so easily, they are not a strong security control. MAC filtering on Wi-Fi stops casual visitors, but anyone can copy (“spoof”) an allowed address that they have captured from the air.
A real-world example: the hotel Wi-Fi
You join a hotel's Wi-Fi with your phone, accept the terms on a login page and start browsing. The next day, you come back and the login page appears again. Why? The hotel remembers devices by MAC address. Your phone used a new random MAC address for that network (after a reset, or simply after some time on some phones), so the hotel saw a “new” device. Turning off the private address for that one network makes the phone keep the same MAC address and stops the repeated logins.
How to find your MAC address
Windows
C:\>ipconfig /all Ethernet adapter Ethernet: Connection-specific DNS Suffix . : home.arpa Description . . . . . . . . . . . : Intel(R) Ethernet Connection I219-V Physical Address. . . . . . . . . : 00-00-5E-00-53-2A DHCP Enabled. . . . . . . . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.1.10(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.1.1 Wireless LAN adapter Wi-Fi: Media State . . . . . . . . . . . : Media disconnected Description . . . . . . . . . . . : Intel(R) Wi-Fi 6 AX201 160MHz Physical Address. . . . . . . . . : 02-00-00-00-00-BB
02, so it is locally administered (random). getmac /v gives a shorter list.Linux
$ ip link show 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000 link/ether 00:00:5e:00:53:2a brd ff:ff:ff:ff:ff:ff 3: wlp2s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DORMANT group default qlen 1000 link/ether 02:00:00:00:00:bb brd ff:ff:ff:ff:ff:ff permaddr 00:00:5e:00:53:2b
link/ether is the MAC address in use, and brd is the broadcast address. On the Wi-Fi card, permaddr shows the burned-in address behind the random one.macOS
$ ifconfig en0 | grep ether ether 02:00:00:00:00:cc
ether line is the MAC address currently in use. en0 is usually the Wi-Fi interface on a laptop. You can also find the address in System Settings → Wi-Fi → Details. Phones show it in the Wi-Fi settings for the current network.Other devices' MAC addresses: the ARP cache
C:\>arp -a Interface: 192.168.1.10 --- 0x7 Internet Address Physical Address Type 192.168.1.1 02-00-00-00-00-01 dynamic 192.168.1.20 00-00-5e-00-53-40 dynamic 192.168.1.255 ff-ff-ff-ff-ff-ff static 224.0.0.251 01-00-5e-00-00-fb static
When MAC addressing goes wrong
| Symptom | Possible cause | What to check |
|---|---|---|
| Two devices keep dropping off the network in turn | Duplicate MAC address (often a cloned virtual machine) | Compare the ip link or ipconfig /all output; give the clone a new MAC address |
| A device gets a different IP address every time it joins Wi-Fi | A random MAC address that changes, so DHCP sees a new client | Turn off the private address for that network if you need a reservation |
| Wi-Fi refuses a device that used to work | MAC filtering, with the old burned-in MAC address on the list | Add the device's current (random) MAC address, or disable randomisation for that network |
| A device can reach some local hosts but not the gateway | Wrong or stale ARP entry for the gateway | arp -a; clear it with arp -d * (Windows, as admin) |
Common mistakes
- Thinking the MAC address travels across the internet. It is only used on the local link. The first router builds a new frame with new MAC addresses.
- Treating MAC filtering as strong security. MAC addresses are sent unencrypted in every frame and are easy to copy.
- Thinking different formats are different addresses.
0000.5e00.532aand00-00-5E-00-53-2Aare the same address, written in Cisco and Windows style. - Thinking a device has only one MAC address. Each interface has its own, and Wi-Fi may use a different one on each network.
- Assuming the OUI always identifies the manufacturer. A locally administered (random) address has no real manufacturer behind it.
- A MAC address is a 48-bit Layer 2 address, written as 12 hex digits.
- The first 24 bits are the OUI (manufacturer); the last 24 bits identify the interface.
- MAC addresses deliver frames on the local link; IP addresses get packets to their final destination.
ff:ff:ff:ff:ff:ffis broadcast; an odd first byte (I/G bit = 1) means a group address.- Locally administered (random) MAC addresses have 2, 6, a or e as the second hex digit.
- Find yours with
ipconfig /all,ip link showorifconfig.
Check yourself
You find an unknown device in a switch's MAC address table. What can the first half (24 bits) of its burned-in MAC address tell you?
You see four MAC addresses in a packet capture. Which one is a locally administered unicast address?
You browse to a website. Which of your addresses can the web server see?
A PC sends an ARP request. The frame's destination MAC address is ff:ff:ff:ff:ff:ff. Which devices on the LAN accept it?
Where to go next
Next, see how switches collect these addresses, how a PC finds a neighbour's MAC address, and what the frame that carries them looks like.
Learn more: How a Switch Learns MAC AddressesARP FundamentalsThe Ethernet Frame