MAC Addresses

MAC Addresses

A MAC address is a hardware-level network address used to identify a network interface on a local network.
MAC stands for Media Access Control.

When a computer, phone, printer, server, access point or other network device communicates over an Ethernet or Wi-Fi network,
its network interface normally has a MAC address associated with it.

MAC addresses operate primarily at Layer 2 — the Data Link Layer of the OSI model.
They are especially important to switches and other devices that make forwarding decisions within a local network.

1. What Does a MAC Address Do?

An IP address helps identify a device at the network layer and allows traffic to be routed between networks.
A MAC address identifies a network interface at the local data-link level.

For example, imagine a laptop communicating with a printer on the same local network.
The laptop may use the printer’s IP address to determine where the traffic should go,
while Ethernet or Wi-Fi frames use MAC addresses for local delivery.

This distinction is important in cybersecurity because network administrators may see both
IP addresses and MAC addresses in network records.

2. Traditional MAC Address Structure

A traditional Ethernet MAC address is normally 48 bits, which is equal to 6 bytes.
It is commonly represented as six groups of two hexadecimal characters.

Example:

00:1A:2B:3C:4D:5E

Each pair represents one byte.
Because hexadecimal uses values from 0–9 and A–F,
MAC addresses can be represented compactly.

Other common formats include:

00-1A-2B-3C-4D-5E

001A.2B3C.4D5E

The exact display format depends on the operating system or network equipment.

3. The OUI

The first 24 bits of a traditional MAC address are commonly associated with an
Organizationally Unique Identifier (OUI).
An OUI is allocated by the IEEE and can identify the organization associated with a MAC address block.

For example, in this simplified representation:

00:1A:2B:3C:4D:5E
|---------|---------|
   OUI       Device-specific portion

The remaining portion is used within the allocated address range.
The exact interpretation and assignment model can vary with address type and technology,
so security analysts should not assume that every MAC address always maps directly to a specific physical device.

4. Unicast MAC Addresses

A unicast MAC address is associated with communication intended for a particular network interface.

For example, a computer may send a frame to a specific printer’s MAC address on the local network.

Computer
   |
   | Ethernet/Wi-Fi frame
   v
Printer's MAC Address

Switches can use their MAC address tables to determine which interface should receive a unicast frame.

5. Broadcast MAC Address

A broadcast frame is intended for all devices on the relevant local Layer 2 broadcast domain.
The commonly used Ethernet broadcast MAC address is:

FF:FF:FF:FF:FF:FF

This address is significant in several networking processes.
For example, some ARP requests use an Ethernet broadcast because the sender does not yet know
which interface owns the target IPv4 address.

6. Multicast MAC Addresses

A multicast transmission is intended for a group of devices rather than one specific device or every device.
Certain multicast IP traffic can be mapped to multicast MAC addresses.

Multicast is useful for applications and protocols that need to communicate with multiple interested receivers.

7. MAC Address vs IP Address

A device can therefore have both a MAC address and one or more IP addresses.
They serve different purposes.

8. MAC Addresses and ARP

For IPv4 networks, ARP (Address Resolution Protocol) helps a device discover
the MAC address associated with an IPv4 address on the local network.

Suppose a computer wants to communicate with:

192.168.1.20

The computer may need to determine which MAC address belongs to that IP address.
An ARP request can be used to ask the local network.

A simplified process looks like this:

1. The computer knows the destination IPv4 address.
2. The computer checks its ARP/neighbor cache.
3. If the mapping is not available, it can send an ARP request.
4. The device owning the address responds with its MAC address.
5. The sender can then construct the appropriate local network frame.

This relationship is important in security monitoring because unusual ARP activity can sometimes
provide useful investigation clues.

9. How Switches Learn MAC Addresses

A network switch maintains a forwarding database commonly referred to as a
MAC address table or CAM table.

When a switch receives a frame, it can learn the source MAC address and associate it with
the interface on which the frame arrived.

Example:

When the switch needs to forward a frame to one of these MAC addresses,
it can use the table to determine the appropriate port.

10. Why MAC Tables Matter in Cyber Security

MAC address tables can help network administrators understand which interfaces
are active on a switch and where those interfaces are connected.

Security teams may use related information to investigate:

• Unknown devices connected to a network.
• Unexpected devices appearing on sensitive switch ports.
• Changes in device locations.
• Network segmentation problems.
• Potential rogue access points.
• Unexpected changes in DHCP and switch records.
• Suspicious network access events.

A MAC address should not be treated as a permanent identity by itself.
It is one piece of evidence that should be correlated with IP addresses,
DHCP records, authentication logs, switch-port information and other security telemetry.

11. MAC Address Spoofing

MAC spoofing is the process of configuring a device to present a different
MAC address to the network than its original hardware address.

There can be legitimate reasons for changing or randomizing a MAC address.
For example, modern mobile operating systems may use MAC randomization to improve privacy
when connecting to wireless networks.

However, attackers may also attempt to change a MAC address to bypass poorly designed
network controls or make device identification more difficult.

Security professionals should therefore avoid assuming that a MAC address alone proves
the identity of a person or physical device.

12. MAC Address Filtering

Some wireless networks and network devices support MAC filtering.
An administrator can create an allow-list or deny-list of MAC addresses.

For example:

Allowed:
00:1A:2B:3C:4D:5E
18:65:90:AA:10:22

However, MAC filtering should not be treated as a complete security mechanism.
Because MAC addresses can potentially be changed or spoofed,
an attacker who can observe permitted addresses may attempt to imitate one.

Stronger controls such as authentication, encryption, network segmentation,
device management and monitoring should be used where appropriate.

13. MAC Randomization

Many modern phones, tablets and computers can use randomized MAC addresses,
especially when scanning for or connecting to wireless networks.

This feature can reduce the ability of observers to use a persistent hardware address
to track a device across different wireless environments.

For cybersecurity students, this is an important reminder:
a MAC address is useful network information, but it is not necessarily a permanent identity.

14. Finding Your MAC Address on Windows

On an authorized Windows computer, open Command Prompt and run:

ipconfig /all

Look for the network adapter and its:

Physical Address

Windows also provides:

getmac

These commands are useful when troubleshooting or documenting an authorized computer.

15. Finding Your MAC Address on Linux

On Linux, the following command can display network interfaces:

ip link

You can also inspect a specific interface, for example:

ip link show eth0

For Wi-Fi, the interface may have a name such as:

wlan0

Modern Linux systems may use predictable interface names such as:

enp0s3
wlp2s0

16. Viewing Neighbor Information

Linux systems can display neighbor information using:

ip neigh

On Windows, an administrator can inspect the ARP cache using:

arp -a

These commands can help students understand the relationship between logical IP addressing
and local hardware addressing.

17. Validating a MAC Address with PHP

A simple PHP regular expression can be used to validate a commonly formatted
six-byte MAC address.

<?php

$mac = '00:1A:2B:3C:4D:5E';

$pattern = '/^([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$/';

if ( preg_match( $pattern, $mac ) ) {
    echo 'Valid MAC address format.';
} else {
    echo 'Invalid MAC address format.';
}

This example validates the format only.
It does not prove that the address actually belongs to a particular device or vendor.

18. Security Investigation Example

Imagine that an administrator notices an unfamiliar device on an internal network.
The investigation may contain information such as:

The analyst should correlate the available evidence rather than immediately concluding
that the device is malicious.

The analyst could check whether the device is authorized, identify its owner,
review the relevant switch port, examine DHCP records and inspect authentication events.

19. MAC Addresses in Security Logs

MAC addresses may appear in network management systems, DHCP systems,
wireless controllers, endpoint tools and other infrastructure.

Useful investigation questions include:

• When was this MAC address first observed?
• Which IP address was associated with it?
• Which switch or access point observed it?
• Which port or wireless network was involved?
• Was the device authenticated?
• Has the MAC address appeared in multiple locations?
• Does the associated device match the expected inventory?

These questions help transform a raw MAC address into useful security context.

20. Practical Cyber Security Exercise

Exercise: Inspect the network information on your own authorized computer.

1. Run ipconfig /all on Windows or ip link on Linux.
2. Identify the MAC address of your active network interface.
3. Record the corresponding IPv4 address if available.
4. Run arp -a or ip neigh.
5. Identify at least two IP-to-MAC mappings if your system has them available.
6. Explain why the MAC address and IP address are different types of addresses.
7. Explain how a switch could use a MAC address table.

Important: Perform this exercise only on systems and networks that you own
or have explicit permission to inspect.

21. Cyber Security Scenario

A company discovers that a device with an unfamiliar MAC address has appeared on an internal network.
The device received an IP address from the company’s DHCP server.

A security analyst should not automatically classify the device as an attack.
Instead, the analyst can investigate:

• DHCP lease information.
• Switch MAC address tables.
• Wireless controller records.
• Device inventory.
• Authentication logs.
• Physical switch-port location.
• Endpoint management records.

This demonstrates an important cybersecurity principle:
individual indicators become more useful when they are correlated with other evidence.

22. Key Takeaways

• A MAC address is a Layer 2 network interface address.
• Traditional Ethernet MAC addresses are 48 bits long.
• MAC addresses are commonly represented using hexadecimal notation.
• The first 24 bits commonly correspond to an OUI allocation.
• Unicast, multicast and broadcast addresses serve different communication purposes.
• FF:FF:FF:FF:FF:FF is the Ethernet broadcast MAC address.
• Switches use MAC address tables to make local forwarding decisions.
• ARP helps IPv4 devices associate local IP addresses with MAC addresses.
• MAC addresses can be spoofed or randomized.
• MAC filtering alone should not be considered strong security.
• MAC information is more useful when correlated with other security records.
• Security testing and network inspection must be performed only with proper authorization.

23. Final Review Questions

1. What does MAC stand for?
2. At which OSI layer does a MAC address primarily operate?
3. How many bits are in a traditional Ethernet MAC address?
4. What is the purpose of an OUI?
5. What is the Ethernet broadcast MAC address?
6. What is the difference between a MAC address and an IP address?
7. How does a switch use a MAC address table?
8. What role does ARP play in IPv4 networking?
9. What is MAC address spoofing?
10. Why is MAC filtering not a complete security solution?
11. What is MAC randomization?
12. Which Windows command can display a network adapter’s physical address?
13. Which Linux command can display network interface information?
14. Why should MAC addresses be correlated with other security evidence?

Lesson conclusion:
Understanding MAC addresses gives cybersecurity professionals a stronger foundation for
network monitoring, troubleshooting, incident investigation and defensive security.
MAC addresses are important identifiers at the local network level, but they should always
be interpreted in the wider context of IP addressing, authentication, DHCP, switching,
wireless infrastructure and security logs.