A MAC address (media access control address) is the link-layer identifier of a network interface, used to deliver frames between devices on the same local network. In networking fundamentals, it belongs to layer 2 of the OSI model, where Ethernet, Wi-Fi and similar technologies address frames, while IP addresses at layer 3 handle delivery across networks.
Most MAC addresses are 48 bits long, written as six pairs of hexadecimal digits such as 3C:22:FB:4A:91:0E. The IEEE manages the numbering space, which it calls EUI-48, and a longer 64-bit form, EUI-64, is used in some technologies. The address is often described as burned in, but most modern devices can change or randomize the address they actually use.
Structure of a MAC address
A 48-bit MAC address has two halves. The first 24 bits usually form the Organizationally Unique Identifier (OUI), which the IEEE assigns to a manufacturer, and the last 24 bits are a device-specific value chosen by that manufacturer. One OUI therefore covers about 16.7 million interfaces.
Two flag bits in the first byte carry special meaning. The table below explains them, because they decide how a switch and a host interpret the address.
| Bit | Value 0 means | Value 1 means |
|---|---|---|
| I/G bit (least significant) | Individual (unicast) address | Group (multicast or broadcast) address |
| U/L bit (second least significant) | Universally administered, assigned by the manufacturer | Locally administered, set by software or an administrator |
A quick way to spot a locally administered address is the second hexadecimal digit: if it is 2, 6, A or E, the U/L bit is set. Randomized addresses on phones and laptops always have this bit set.
The longer EUI-64 format appears in technologies such as Zigbee, FireWire and some industrial networks. Older IPv6 configurations also derived a 64-bit interface identifier from the 48-bit MAC address by inserting FF:FE in the middle and inverting the U/L bit. Because that method exposed the hardware address in every IPv6 address, modern systems use random or stable privacy identifiers instead.
Unicast, multicast and broadcast MAC addresses
Every Ethernet frame carries a destination and a source MAC address. The destination type determines which interfaces accept the frame, as the following table shows.
| Type | Example | Who receives the frame |
|---|---|---|
| Unicast | 3C:22:FB:4A:91:0E | One specific interface |
| Broadcast | FF:FF:FF:FF:FF:FF | Every interface in the broadcast domain |
| IPv4 multicast | 01:00:5E:xx:xx:xx | Interfaces that joined the multicast group |
| IPv6 multicast | 33:33:xx:xx:xx:xx | Interfaces listening to that IPv6 group |
| Spanning tree group | 01:80:C2:00:00:00 | Bridges running spanning tree |
The broadcast domain is the set of devices that receive a broadcast frame. It usually equals one LAN or one VLAN, and a router marks its boundary because routers do not forward layer 2 broadcasts.
How switches and hosts use MAC addresses
A network switch builds a MAC address table, sometimes called a CAM table, by reading the source address of every incoming frame and noting the port it arrived on. When a frame arrives for a known destination, the switch forwards it only to the matching port; for an unknown destination it floods the frame to all ports in the VLAN.
Entries expire after an aging time, commonly 300 seconds by default, so the table follows devices that move or disconnect. Hosts, for their part, must find the MAC address that belongs to an IP address before sending. IPv4 uses the Address Resolution Protocol (ARP) and IPv6 uses Neighbor Discovery, and both keep the results in a short-lived cache.
When a packet travels to another network, the destination MAC address in each frame is that of the next-hop router, usually the default gateway. The IP addresses stay the same end to end, while MAC addresses change at every hop.
MAC address compared with IP address and other identifiers
MAC addresses and IP addresses are often confused because both identify devices. The comparison below shows why networks need both.
| Property | MAC address | IP address |
|---|---|---|
| OSI layer | Layer 2, data link | Layer 3, network |
| Length | 48 bits (EUI-48) | 32 bits (IPv4) or 128 bits (IPv6) |
| Scope | One local segment or VLAN | End to end across networks |
| Structure | Flat; vendor prefix plus serial | Hierarchical; network prefix plus host |
| Assignment | Manufacturer, software or randomization | DHCP, SLAAC or manual configuration |
| Seen by remote servers | No | Yes, or a translated address |
Because MAC addresses are flat and carry no location information, they cannot be routed on a global scale. That is precisely why the Internet relies on hierarchical IP addressing, while MAC addresses remain local.
MAC randomization, security and common misconceptions
Because a fixed MAC address can identify a device wherever it connects, current mobile and desktop operating systems use MAC address randomization for Wi-Fi. Devices use a random address while scanning, and many use a separate private address per network, sometimes rotated over time.
- MAC addresses are not a security credential. They are easy to spoof, so MAC filtering on Wi-Fi gives little real protection.
- MAC addresses do not leave the local network. A website cannot see a visitor’s MAC address.
- Randomization can break network rules that rely on fixed addresses, such as DHCP reservations, parental controls or captive portals.
- Port security and 802.1X are the proper tools for controlling which devices may connect to switch ports.
Duplicate MAC addresses on one segment are rare but serious: the switch keeps moving the entry between ports, which causes intermittent loss of connectivity for both devices. Cloned virtual machines are a common cause.
The idea in brief
A MAC address is like the name tag on a network card. Inside one local network, such as a home or an office floor, devices use these tags to pass messages to each other.
An IP address works more like a postal address that is used across the whole Internet. The MAC address only matters for the last short step inside the local network, much like a name on an apartment door. Many phones now wear a different name tag on each network, so they are harder to track from place to place.
A practical scenario
An office network administrator receives complaints that a file server becomes unreachable several times a day. The switch log shows the server’s MAC address flapping between two ports, which means two interfaces are using the same address.
The investigation finds that a test virtual machine was cloned from the server’s image with a manually fixed MAC address, so the copy kept the original value. The administrator assigns the clone a new locally administered address, clears the switch table, and the file server becomes stable. The team then adds a check for duplicate MAC addresses to its virtual machine cloning procedure.