MAC Address

A MAC address is the Layer 2 identity of a network interface. While IP addresses route packets across the internet, MAC addresses deliver frames on the local network. Every Ethernet port, Wi-Fi chip, and virtual interface has one — assigned at manufacture and globally unique.

MAC address structure

A MAC address is 48 bits written as six pairs of hexadecimal digits separated by colons or hyphens: 3c:22:fb:4a:d1:09. The 48 bits are divided into two halves:

• OUI (Organizationally Unique Identifier) — the first 24 bits (3 octets, e.g. 3c:22:fb) identify the manufacturer. The IEEE assigns OUI blocks to vendors; tools like Wireshark and the IEEE public registry can look up which company made a NIC from its OUI alone.
• Device identifier — the last 24 bits are assigned by the manufacturer to uniquely identify the individual interface within their product line.

Two special bits in the first octet carry additional meaning. Bit 0 of the first octet (the least significant bit) is the multicast bit — if set to 1, the frame is addressed to a multicast or broadcast group rather than a single device. Bit 1 of the first octet is the locally administered bit — if set to 1, the address has been locally assigned (overriding the factory-burned globally unique address). Randomized MAC addresses generated by operating systems set this bit to 1, which is one way to detect that a device is using a randomized rather than hardware address.

How MAC addresses are used

MAC addresses in Ethernet and Wi-Fi

In Ethernet, every frame carries a destination MAC and a source MAC in its header. A network switch maintains a MAC address table (CAM table) that maps each MAC address to the physical port where that device is connected. When a frame arrives, the switch looks up the destination MAC and forwards it only to the correct port — this is what makes switches more efficient than hubs, which broadcast every frame to all ports. In Wi-Fi, the access point tracks each associated client station by its MAC address and uses it to schedule transmissions and manage authentication state.

ARP — bridging MAC and IP

IP routing delivers packets to a destination IP, but the final hop on a local network requires knowing the MAC address of the next device. ARP (Address Resolution Protocol) resolves this: when your device wants to reach 192.168.1.1, it broadcasts an ARP request ("who has 192.168.1.1?") and the router replies with its MAC address. Your device caches this mapping in its ARP table for future frames. The router does the same in reverse when forwarding traffic to your device.

MAC address randomization

iOS (since iOS 14), Android (since Android 10), and Windows (since Windows 10) randomize the MAC address per Wi-Fi network by default. Each time your device connects to a new SSID, it generates a random locally-administered MAC address rather than using the hardware-burned address. This prevents Wi-Fi access points and retail tracking systems from identifying your device as it moves between networks or locations. The randomized MAC is consistent for a given SSID (so you reconnect without issue) but different across SSIDs.

The practical consequence for home networks: if you configure a DHCP reservation on your router to give a phone a fixed IP address based on its MAC, MAC randomization will cause the reservation to stop working — the device presents a different MAC each time it connects to a new network or after the random MAC rotation period expires. The fix is to disable MAC randomization for your home network in the device's Wi-Fi settings, which most OSes allow on a per-network basis.

MAC spoofing

MAC spoofing is changing a network interface's MAC address in software to a value different from the factory-burned hardware address. It is trivially easy on all major operating systems:

• Linux: ip link set dev eth0 address XX:XX:XX:XX:XX:XX
• macOS: sudo ifconfig en0 ether XX:XX:XX:XX:XX:XX
• Windows: Network adapter properties → Advanced → Network Address

Common legitimate reasons include bypassing ISP equipment that locks a connection to a specific MAC, cloning a MAC to match a device the network expects, and privacy (though OS-level randomization has largely replaced manual spoofing for this purpose). Because spoofing is trivial, MAC filtering — allowing only specific MAC addresses on a Wi-Fi network — provides essentially no real security. An attacker who observes an allowed MAC address on the network can spoof it within seconds.

Where to find a device's MAC address

• Windows: ipconfig /all — look for "Physical Address" next to the adapter
• macOS: System Settings → Network → select interface → Details → Hardware Address
• Linux: ip link show — the address after "link/ether"
• iOS: Settings → Wi-Fi → tap the network → Wi-Fi Address
• Android: Settings → About phone → Status → Wi-Fi MAC address
• Router DHCP table: your router's admin panel lists all connected devices with their MAC addresses and assigned IPs — useful for identifying unknown devices on the network

Frequently Asked Questions

Is a MAC address the same as an IP address?

No. A MAC address is a hardware identifier that stays on the local network — it is never seen on the internet. An IP address is logical, assigned by the network, and used for routing across the internet. ARP bridges the two on each local segment.

Can a MAC address be changed?

The hardware address is permanent, but all modern operating systems let you override it with a software MAC (MAC spoofing). iOS and Android randomize MAC addresses per network by default for privacy.

How does my router use MAC addresses?

Your router keeps an ARP table mapping MAC addresses to local IP addresses. It can assign DHCP reservations (same IP every time) and allow or deny devices via MAC filtering — though spoofing makes filtering a weak control.