MAC Addresses
48-bit link-layer identifiers. Unique-ish, local or universal, unicast or group.
Level: beginner
What is it?
A MAC address is a link-layer identifier used by technologies such as Ethernet and Wi-Fi to address interfaces within a local link context. Ethernet MAC addresses are commonly 48 bits, with bits that indicate unicast/multicast and universal/local administration.
Why does it matter?
MAC addressing lets link-layer devices deliver frames locally without using IP routing decisions. It is not a replacement for IP addressing, nor is it a reliable identity or authorization credential.
Mental model
IP identifies a network-layer destination and routing path; MAC identifies the next local link-layer recipient. For remote IP traffic, the frame destination is usually the gateway's MAC, not the remote server's MAC.
How it works
- A globally administered 48-bit address is conventionally allocated from a vendor's assigned identifier and interface-specific bits; local administration can override uniqueness assumptions.
- The least-significant bit of the first octet distinguishes individual versus group addressing in traditional Ethernet conventions.
- Switches learn source MAC-to-port associations to forward frames efficiently.
- ARP resolves IPv4 next-hop addresses to MAC on Ethernet; IPv6 uses Neighbor Discovery.
- MAC addresses can be changed/spoofed by software, so they should not be treated as authentication secrets.
Steps
- A host selects a next-hop IP address using its routing table.
- It uses ARP or IPv6 Neighbor Discovery to resolve a local link-layer address.
- The frame is sent to that MAC address on the local segment.
- Switches use the destination MAC and VLAN context to forward it toward the next port.
Real-world usage
- Diagnosing ARP cache and switch-forwarding issues.
- Explaining the relationship between local Ethernet delivery and IP routing.
Common mistakes
- Trying to ARP for a destination on a remote subnet instead of resolving the gateway.
- Treating a MAC address as a secret or strong identity signal.
- Confusing MAC address, IP address, and TCP/UDP port.
Interview questions
Does a MAC address normally identify the final internet server on every hop?
No. On a routed path, each link frame usually targets the next-hop device; the end-to-end IP destination remains the server.
Can a device spoof its MAC address?
Often yes, because software or hardware configuration can change the address; MAC filtering alone is not strong authentication.