Quick Summary
- A MAC address is a 48-bit Layer-2 hardware address, written as 12 hex digits (e.g. 00:1A:2B:3C:4D:5E)
- The first 24 bits are the OUI assigned by the IEEE to the manufacturer; the last 24 bits identify the specific card
- FF:FF:FF:FF:FF:FF is the broadcast address, and switches learn MACs to forward frames on a LAN
The Factory Serial Number Analogy
Imagine you buy a new appliance. Somewhere on the back is a metal plate stamped with a unique serial number -- one that the factory pressed into it and that never changes, no matter whose house it ends up in. A MAC address works exactly like that serial number, except it lives on the network card inside your device.
Contrast that with an IP address, which behaves more like a mailing address. When you move to a new home, you get a new mailing address. When your laptop joins a new WiFi network, it usually gets a new IP address. But the MAC address stays the same wherever it goes, because it is tied to the hardware, not to the network.
A MAC (Media Access Control) address is a 48-bit Layer-2 hardware address. "Layer 2" means
it operates at the data-link layer -- the level that moves data between devices on the same local
network. We write those 48 bits as 12 hexadecimal digits, usually grouped in pairs and separated by colons
or hyphens, like 00:1A:2B:3C:4D:5E. Cisco gear often groups them into three sets of four and
uses dots: 001a.2b3c.4d5e. They all describe the same 48 bits.
Why does this matter? Because on a local network, devices do not actually deliver data to each other using IP addresses -- they use MAC addresses. A switch learns which MAC address lives on which port and uses that knowledge to forward each frame to exactly the right device. The IP address tells the network which building; the MAC address tells the local switch which exact device in the room.
The Anatomy of a MAC Address
Here is the MAC address 00:1A:2B:3C:4D:5E broken into its two halves. The first three bytes are the OUI (the manufacturer's ID), and the last three are assigned by that vendor to the individual card:
MAC Address Decoder
Type a MAC address in any common format -- colons, hyphens, or Cisco-style dots. The decoder normalizes it, splits the OUI from the device portion, and reads the two flag bits in the first octet.
Notice what the decoder reports for an ordinary card: unicast and
universally administered. That is because two specific bits inside the very first byte carry
flags. The least-significant bit is the I/G bit (Individual/Group): 0 means
the frame is for one NIC, 1 means it targets a group (multicast). The next bit over is the
U/L bit (Universal/Local): 0 means a globally unique, factory-assigned address,
while 1 means the address was set locally in software.
How a MAC Address Works, Step by Step
48 Bits, Written in Hexadecimal
A MAC address is 48 bits long. Rather than writing 48 ones and zeros, we group them into 6 bytes and
show each byte as two hexadecimal digits -- 12 hex digits in total. You will see them separated by colons
(00:1A:2B:3C:4D:5E), by hyphens (00-1A-2B-3C-4D-5E), or in Cisco's dotted
format (001a.2b3c.4d5e). The separators are just for human readability; the underlying
48 bits are identical.
OUI + Device ID
The 48 bits split cleanly in half. The first 24 bits are the OUI (Organizationally Unique Identifier), which the IEEE assigns to a manufacturer -- so the first three bytes identify who built the card. The last 24 bits are assigned by that vendor to the specific NIC, giving each card a unique tail. Together they make the full address globally unique when it is universally administered.
Two Flag Bits in the First Octet
Hidden in the first byte are two important flags. The I/G bit (least-significant bit)
distinguishes a unicast address (0, one card) from a multicast/group
address (1). The U/L bit (the next bit) marks whether the address is
universally administered (0, factory-unique) or
locally administered (1, overridden in software). The all-ones address
FF:FF:FF:FF:FF:FF is the special broadcast address.
Switches Learn, Routers Rewrite
A switch builds a MAC address table by noting the source MAC of every frame it sees and the port it arrived on, then forwards frames toward the matching port. A router works differently: at each hop it rewrites the source and destination MAC for the next link, while the IP address stays the same end to end. ARP is the protocol that maps a destination IP to its MAC on the local network so a frame can be addressed.
MAC Addresses in the Real World
You bump into MAC addresses far more often than you might expect. Here are three everyday encounters:
WiFi & the Switch Table
When your phone joins WiFi, the access point and switches learn its MAC address and record which port (or radio) it lives behind. That is how frames find your phone specifically rather than flooding the whole network. Reserved DHCP leases also often key on the MAC so a device always gets the same IP.
Broadcast & ARP
When your laptop needs the MAC behind an IP, it sends an ARP request to FF:FF:FF:FF:FF:FF --
the broadcast address every device hears. The owner of that IP replies with its MAC, and from then on
the laptop can address frames directly to that single device.
Random MACs for Privacy
Modern phones use MAC randomization, generating a locally administered address (U/L bit set to 1) per network so venues cannot track you across WiFi by your hardware address. It works precisely because the MAC can be overridden in software.
Common MAC Address Mistakes
A few misconceptions trip up almost every beginner. Keep these straight:
"MAC addresses can never change"
The factory burns in a universally administered address, but it is not immutable. Nearly every operating system lets you override it in software -- called MAC spoofing. When changed, the U/L bit is set to 1 to flag it as locally administered, so a "burned-in" address is best thought of as a strong default, not a permanent law.
Confusing MAC with IP
A MAC address is a Layer-2 hardware ID used for delivery within one local network and does not change as you roam. An IP address is a Layer-3 logical address that does change between networks and is what routes packets across the internet. They are not interchangeable -- ARP is what links one to the other.
Thinking MACs cross routers
A MAC address is only meaningful on the local segment. Each router rewrites the source and destination MAC for the next hop, so the destination MAC you started with is gone after the first router. Only the IP address survives end to end. Expecting to "see" a remote device's MAC across the internet is a classic beginner error.
Why Layer 2 Needs Its Own Address
It is fair to ask: if every device already has an IP address, why bother with a second one? The answer is that IP and MAC live at different layers and solve different problems. IP addresses are logical and hierarchical -- they are grouped into subnets so routers can make sensible forwarding decisions across the whole internet. MAC addresses are flat and local -- there is no structure a router could route on, but on a single LAN that flatness is exactly what a switch needs to drop a frame onto the one correct port.
So a packet's journey is a relay race. The IP source and destination stay fixed from start to finish, like the name on a parcel. But the MAC addresses are swapped at every hop: host to first router, router to next router, last router to the destination host. Each leg uses ARP (or its IPv6 cousin, Neighbor Discovery) to learn the MAC for the next device on that link.
The bottom line: a MAC address is the permanent, factory-stamped name of a network card -- 48 bits of OUI plus device ID, written in hex. It is how switches deliver frames on your local network, how ARP ties IPs to hardware, and (despite being "burned in") something software can override when it needs to.
Frequently asked questions about MAC addresses
What is a MAC address?
A MAC (Media Access Control) address is a 48-bit Layer-2 hardware address assigned to a network interface card. It is written as 12 hexadecimal digits, usually in pairs separated by colons or hyphens, such as 00:1A:2B:3C:4D:5E. Switches use MAC addresses to forward frames on a local network.
What is the difference between a MAC address and an IP address?
A MAC address is a 48-bit Layer-2 hardware address burned into the network card and used to deliver frames within a single local network. An IP address is a Layer-3 logical address that can change as a device moves between networks and is used to route packets across the internet. ARP maps an IP address to a MAC address on a LAN.
Can a MAC address be changed?
Yes. Although the manufacturer burns a universally administered address into the card, most operating systems let you override it in software, which is called MAC spoofing. A locally administered address is flagged by setting the second-least-significant bit (the U/L bit) of the first octet to 1, so the address is no longer guaranteed globally unique.
What is an OUI in a MAC address?
The OUI (Organizationally Unique Identifier) is the first 24 bits -- the first three bytes -- of a MAC address. The IEEE assigns each OUI to a hardware manufacturer, so it identifies who made the network interface. The remaining 24 bits are chosen by that vendor to make each card unique.
What does FF:FF:FF:FF:FF:FF mean?
FF:FF:FF:FF:FF:FF is the broadcast MAC address, made up of all 48 bits set to 1. A frame sent to this address is delivered to every device on the local network segment. Protocols like ARP use the broadcast address to ask every host on the LAN a question, such as which device owns a given IP address.
See MAC addresses in action
You just learned how a MAC address is structured and how switches use it. Now trace a ping between two hosts on a switch, read the MAC addresses on the frame in the Packet Inspector, and press Go Live to see the MACs of real Linux interfaces in ip addr and the ARP table.