MAC Address
A MAC (Media Access Control) address is a unique 48-bit identifier burned into network interface controllers (NICs). MAC addresses operate at layer 2 (data link) of the osi-model and are used by protocols such as ARP to map layer-3 IP addresses to physical hardware.
Structure
MAC addresses are typically represented as six octets of two hexadecimal digits each. The first three octets designate the Organizationally Unique Identifier (OUI) — the network interface vendor. The last three octets constitute the device serial number (NIC ID).
| Component | Example |
|---|---|
| Full MAC (UNIX-style) | a4:c3:f0:85:ac:2d |
| Vendor ID (OUI) | a4:c3:f0 |
| NIC ID | 85:ac:2d |
| Windows-style | A4-C3-F0-85-AC-2D |
The IEEE Registration Authority maintains the public OUI registry. An OUI assignment (MA-L) includes the right to generate EUI-48 and EUI-64 identifiers. Smaller blocks (MA-M, MA-S) are also available for organizations with lower volume needs.
MAC address spoofing
Some network cards and operating systems allow MAC addresses to be overridden. This is used legitimately for privacy (e.g., wi-fi MAC randomization) and can be done explicitly on UNIX systems using tools such as macchanger. Spoofing is also used offensively to bypass MAC-based access controls or to impersonate devices on a local segment.
Sources
Related: arp, arp-scanning, tcp, wireshark