MAC Address: What It Is and How It Works

MAC Address

A MAC address is the unique physical identifier built into every network interface card. Unlike an IP address that can change depending on which network you connect to, a MAC address identifies your specific hardware and remains constant, making it fundamental to how local networks deliver data to the right device.

What Is a MAC Address

MAC stands for Media Access Control. A MAC address is a 48-bit hardware identifier assigned by the manufacturer to a network interface, which is the physical component that connects a device to a network. Every Wi-Fi card, Ethernet port, and Bluetooth adapter ships from the factory with a MAC address embedded in its firmware. This address operates at Layer 2 of the network model, the data link layer, and is used to deliver frames between devices on the same local network segment.

While IP addresses work at the internet level and allow packets to be routed across the globe, MAC addresses work at the local network level. When your laptop sends data to your router, or your router delivers a response back to your laptop, it is the MAC address that tells the network hardware exactly which device on the local segment should receive the frame. Beyond that local boundary, MAC addresses are stripped from packets and replaced by IP addresses, making them invisible to the wider internet.

00:1A:2B:3C:4D:5E

MAC Address Structure

A MAC address is 48 bits long and is divided into two equal halves of 24 bits each. Each half serves a distinct purpose in identifying both the manufacturer and the specific device.

The combination of the 24-bit OUI and the 24-bit device identifier theoretically allows for over 281 trillion unique MAC addresses, which is sufficient to assign a distinct address to every network interface ever manufactured. In practice, manufacturers recycle address blocks over time, which is one reason MAC spoofing can create conflicts.

How ARP Connects MAC and IP Addresses

When a device on your local network wants to send data to another device, it knows the destination's IP address but needs the corresponding MAC address to deliver the frame at the hardware level. The Address Resolution Protocol (ARP) bridges this gap.

The sending device broadcasts an ARP request to all devices on the local network asking "Who has IP address 192.168.1.50? Tell 192.168.1.10 your MAC address." The device with that IP address responds with its MAC address. The sender caches this IP-to-MAC mapping in its ARP table for future use and sends the frame directly to the hardware address. You can view the ARP table on your device by running arp -a in a terminal or command prompt.

arp -a

# Example output:
# Interface: 192.168.1.10
#   192.168.1.1     00-1a-2b-3c-4d-5e   dynamic
#   192.168.1.50    a4-c3-f0-85-ac-12   dynamic

MAC Address vs IP Address

How to Find Your MAC Address

Every operating system provides a way to display the MAC addresses of its network interfaces. A device typically has multiple MAC addresses if it has more than one network interface, such as separate addresses for its Wi-Fi card and its Ethernet port.

ip link show

# Example output:
# 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP>
#     link/ether a4:c3:f0:85:ac:12 brd ff:ff:ff:ff:ff:ff
# 3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP>
#     link/ether 00:1a:2b:3c:4d:5e brd ff:ff:ff:ff:ff:ff

Why MAC Addresses Matter

• Local frame delivery: Your router and network switches use MAC addresses to deliver frames to the exact device on your local network. Without MAC addresses, switches would have no way to direct traffic to the correct port.
• ARP resolution: The Address Resolution Protocol maps IP addresses to MAC addresses on the local network, allowing the transport layer and the data link layer to work together seamlessly.
• DHCP reservations: Routers can be configured to always assign the same private IP address to a specific device by associating that IP with the device's MAC address. This gives a device a stable local IP without requiring manual static configuration.
• MAC filtering: Some routers allow administrators to create an allowlist of MAC addresses that are permitted to connect to the Wi-Fi network, blocking any device not on the list. This provides a basic layer of network access control, though it is not a strong security measure on its own because MAC addresses can be spoofed.
• Device tracking prevention: Because MAC addresses are persistent hardware identifiers, they can be used to track a specific device across different networks. Modern mobile operating systems including iOS 14 and Android 10 randomise the MAC address used when scanning for or connecting to networks, replacing the real hardware address with a temporary random one to prevent this tracking.

MAC Address Spoofing

Although a MAC address is burned into hardware by the manufacturer, operating systems allow it to be overridden in software, a practice called MAC spoofing. The hardware address remains unchanged, but the operating system presents a different address to the network. This can be done for privacy, to bypass MAC-based access controls, or to troubleshoot network issues.

# Bring the interface down
sudo ip link set dev eth0 down

# Set a new MAC address
sudo ip link set dev eth0 address 02:00:00:00:00:01

# Bring the interface back up
sudo ip link set dev eth0 up

MAC spoofing creates risks if two devices on the same network end up with the same address, causing a MAC conflict where neither device can communicate reliably. It is also used by attackers to impersonate trusted devices on networks that rely on MAC filtering for access control, which is one reason MAC filtering alone is not considered a strong security measure.

Frequently Asked Questions

1. Can two devices have the same MAC address?
   In theory, no. Manufacturers are assigned unique OUI blocks by the IEEE and are responsible for ensuring the device-specific portion of the address is unique within their block. In practice, MAC addresses can be duplicated through spoofing, manufacturing errors, or reuse of address blocks. When two devices on the same local network share a MAC address, both experience communication failures because switches and routers cannot determine which physical port should receive frames addressed to that MAC.
2. Is my MAC address visible on the internet?
   No. MAC addresses are a local network concept and never travel beyond the boundaries of a single network segment. When your router forwards traffic from your local network to the internet, it strips the MAC address from the frame and encapsulates the packet with its own public IP address. Remote servers see only the public IP address of your router, never the MAC addresses of any devices on your home network.
3. What is MAC address randomisation?
   Modern smartphones and laptops use randomised MAC addresses when scanning for available Wi-Fi networks and, in many cases, when connecting to networks. Instead of broadcasting the device's real hardware MAC address, the operating system generates a random address for each network or scanning session. This prevents Wi-Fi hotspots, shops, and other network operators from tracking your device's movement across different locations based on a persistent hardware identifier. iOS, Android, and Windows all support this feature and enable it by default in recent versions.
4. What is the difference between a MAC address and a Physical Address?
   They are the same thing. Windows refers to the MAC address as the Physical Address in the output of ipconfig /all. Both terms describe the 48-bit hardware identifier assigned to a network interface. Other operating systems and documentation may refer to it as a hardware address, Ethernet address, or link-layer address, all of which mean the same thing as MAC address.
5. Can MAC filtering effectively secure a Wi-Fi network?
   MAC filtering provides only a weak layer of access control and should not be relied upon as a primary security measure. An attacker who wants to bypass MAC filtering can use a network scanner to identify the MAC addresses of devices already connected to the network and then spoof one of those approved addresses on their own device. The filter will then allow the attacker through because it sees an authorised MAC address. Strong Wi-Fi security relies on robust encryption protocols such as WPA3 and strong unique passwords rather than MAC-based access lists.

Conclusion

A MAC address is the hardware identity of a network interface, permanently assigned by the manufacturer and used exclusively within local networks to deliver frames to the correct device. It operates at the data link layer, below the IP addressing system that routes traffic across the internet, and is stripped from packets before they travel beyond the local network. Understanding MAC addresses helps with configuring DHCP reservations, diagnosing local network problems with ARP, and understanding why tools like MAC filtering provide limited security compared to strong encryption. Continue with IP addresses, public vs private IPs, and how routing works to build a complete understanding of network addressing.