MAC Address Structure: OUI and Device Identifier
A MAC address is 48 bits (6 bytes), written as six colon-separated hexadecimal pairs such as 3c:22:fb:12:34:56. The address is split into two halves with distinct roles. The first three octets (24 bits) form the Organizationally Unique Identifier (OUI) — a vendor identifier assigned by the IEEE. The last three octets (24 bits) are assigned by the manufacturer to identify the specific interface. Together they form a globally unique identifier for each network interface card manufactured.
The IEEE maintains the public OUI database at regauth.ieee.org. Entering the first three octets of any MAC address there returns the registered organization. For example, 3c:22:fb resolves to an Apple OUI block. Network administrators use this to identify unknown devices on a switch. Online OUI lookup tools make the process fast without needing to query the IEEE directly.
The Two Special Bits in the First Octet
The first octet of a MAC address contains two control bits that have specific meaning:
- Bit 0 (least significant bit): the Individual/Group bit. When this bit is 0, the frame is addressed to a single interface (unicast). When it is 1, the frame is a multicast or broadcast — the address identifies a group rather than a specific device. The all-ones broadcast address
ff:ff:ff:ff:ff:ffhas this bit set. - Bit 1: the Globally/Locally administered bit. When 0, the address is globally unique as assigned by the manufacturer. When 1, the address is locally administered — it was assigned by software rather than by the hardware manufacturer. Locally administered addresses appear in virtual machines, VPN interfaces, and randomized addresses.
MAC Address vs IP Address
A MAC address belongs to the link layer. It identifies a network interface on the local network segment. An IP address belongs to the internet layer and is used for routing between networks. When your laptop sends traffic to the router, it needs the router's MAC address for local delivery and the destination IP address for end-to-end routing. MAC addresses never appear in routed IP packets — they are stripped and rewritten at each hop.
How ARP Maps IP Addresses to MAC Addresses
In IPv4 networks, ARP (Address Resolution Protocol) maps local IP addresses to MAC addresses. When your device wants to send a packet to 192.168.1.1 but does not know its MAC address, it broadcasts an ARP request: "Who has 192.168.1.1? Tell me at my MAC address." The device owning that IP replies with its MAC. Your device caches this mapping in its ARP table and can then place the packet inside a frame addressed to that MAC. ARP entries expire after a timeout and are refreshed as needed. IPv6 uses Neighbor Discovery Protocol (NDP) for the same function.
Where MAC Addresses Appear
| Place | What uses it | Why it matters |
|---|---|---|
| Ethernet switches | CAM table maps MAC to port | Frames go to the right wired device |
| Wi-Fi | Clients and access points identify each other | Association, roaming, and filtering |
| Router admin pages | Device lists show MAC addresses | Identify unknown devices on the LAN |
| DHCP reservations | Router ties an IP to a MAC | Keep one device at the same LAN IP |
| ARP/NDP tables | OS maps IP to MAC for local delivery | Packet encapsulation for next-hop delivery |
MAC Address Randomization
Traditional MAC addresses are stable hardware identifiers, which made tracking straightforward — a coffee shop's network, a shopping center's Wi-Fi analytics system, or any passive observer could track a device across visits by its MAC. Modern iOS (since iOS 14) and Android (since Android 10) use per-network MAC randomization: each Wi-Fi SSID gets a different randomized MAC, and the locally administered bit is set so it is distinguishable from a hardware address. The generated address is stable for a given SSID unless the user explicitly forgets the network, so the device does not get a new IP on every reconnect to the same network — but different networks see different MACs.
This creates practical complications for network administrators. MAC-based DHCP reservations break for randomizing devices. Parental control systems that rely on MAC-based device identification lose accuracy. Some routers now offer the ability to match a device by the combination of hostname and a stable random address for known networks. For trusted home networks, iOS and Android both allow disabling randomization on a per-network basis to restore a stable identifier for DHCP reservations.
How to Find a Device's MAC Address
- Linux:
ip link showlists all interfaces and their MAC addresses under thelink/etherfield. - macOS:
ifconfig en0shows the MAC asether. System Preferences > Network > Advanced > Hardware also displays it. - Windows:
ipconfig /alllists Physical Address for each adapter.getmac /vgives a cleaner listing. - Android: Settings > About Phone > Status > Wi-Fi MAC address (hardware) or Settings > Network > Wi-Fi > tap the network > Advanced.
- iOS: Settings > General > About > Wi-Fi Address shows the hardware MAC. Per-network addresses appear in the Wi-Fi settings for each network.
MAC Spoofing
Operating systems allow software to override the hardware MAC address of a network interface — a technique called MAC spoofing. On Linux, ip link set dev eth0 address xx:xx:xx:xx:xx:xx changes the MAC immediately. On Windows and macOS, adapter properties or tools like Technitium MAC Address Changer do the same. Legitimate uses include privacy (presenting a locally administered address), bypassing per-device trial limitations on captive portal networks, or testing network equipment behavior. MAC spoofing is why MAC filtering on routers is not a meaningful security control — any attacker who can observe a legitimate MAC address can impersonate it.
Frequently Asked Questions
What is a MAC address used for?
A MAC address is used on local networks to identify a network interface and deliver Ethernet or Wi-Fi frames to the correct device.
Is a MAC address the same as an IP address?
No. A MAC address works on the local link. An IP address is used for routing between networks. ARP helps IPv4 devices map local IP addresses to MAC addresses.
Can a MAC address change?
Yes. Many modern devices use randomized MAC addresses for Wi-Fi privacy, and operating systems can often spoof or change the MAC address used by an interface.