A MAC address, short for Media Access Control address, is a worldwide unique identifier assigned to a network interface controller. It’s also called a hardware address or physical address, and it’s what allows communication within a local network segment. Most IEEE 802 network technologies, including Ethernet, Wi-Fi, and Bluetooth, rely on MAC addresses for this purpose. This guide covers exactly how MAC addresses are structured, the different ways they’re formatted across platforms, and how to actually find one on your own device.
What a MAC Address Actually Is
It is a 48-bit binary value, expressed for readability as 12 hexadecimal digits. Hexadecimal is a base-16 number system, using the digits 0 through 9 and the letters A through F, where A=10, B=11, C=12, D=13, E=14, and F=15. Representing a 48-bit value in hex rather than binary is purely a readability convenience; a MAC address written as 12 hex digits represents exactly the same 48 bits it would as a 48-character string of 1s and 0s, just far easier for a human to read and type correctly.
Why MAC Addresses Exist
On an Ethernet LAN, every device connects to a shared medium, historically at least, meaning every node could potentially receive every frame transmitted on that segment. MAC identify the actual source and destination of each frame, so devices can efficiently determine whether a given frame is meant for them without processing every single frame’s payload. This addressing scheme also provides reliable device identification more broadly, which switches rely on for building their MAC address tables and making forwarding decisions, a process most engineers never think about directly but that runs continuously on every switch in a network.
MAC Address Structure
Vendors manufacturing Ethernet devices and NICs must register with the IEEE. Once registered, IEEE assigns the vendor a 3-byte (24-bit) code called an Organizationally Unique Identifier, or OUI. Every MAC address a vendor assigns to its devices must combine that vendor’s OUI with a unique 24-bit serial number, giving the full 48-bit address.
The leftmost 24 bits (6 hex digits) are the OUI, identifying the manufacturer. A single manufacturer often holds multiple OUIs across its different product lines, rather than being limited to just one. The rightmost 24 bits are the device-specific portion, a unique identifier the manufacturer assigns within its own OUI block, ensuring no two devices sharing that OUI ever get the same full MAC address.
IEEE requires vendors to follow two rules to keep this system working:
- Every MAC address assigned to a device must use that vendor’s own registered OUI as the first 3 bytes.
- Every MAC address sharing the same OUI must have a unique value in the remaining 3 bytes.
MAC Address Notation
You’ll see MAC addresses written differently depending on the platform, but they all represent the same underlying 48-bit value:
- MM:MM:MM:SS:SS:SS — colon-separated, common on Linux and macOS.
- MM-MM-MM-SS-SS-SS — hyphen-separated, the standard Windows notation.
- MMMM.MMMM.MMMM — dot-separated in groups of four hex digits, the standard Cisco IOS notation (for example, 0019.AA2F.03AE).
Where “M” represents an OUI digit and “S” represents a device-specific digit in the colon and hyphen formats. Regardless of which notation you’re looking at, it’s still the same 12 hex digits, just grouped and separated differently by convention.
Duplicate MAC Addresses
Duplicate MAC shouldn’t happen given the IEEE’s registration rules, but they do occur in practice, most commonly from a manufacturing defect, virtual machine cloning where a manually assigned MAC wasn’t changed after cloning, or a manual configuration mistake. When it happens, it can cause genuinely confusing intermittent connectivity issues, since a switch’s MAC address table can only associate one port with a given MAC address at a time, and traffic can flap between the wrong ports as the conflict is detected repeatedly.
Resolution usually means identifying and correcting the duplicate directly, replacing a defective NIC, or reconfiguring a manually assigned address, and it’s worth being aware that MAC spoofing, deliberately configuring a device with another device’s MAC address, is a real security technique attackers use, distinct from an accidental duplicate.
How to Find a MAC Address
Windows
- Press the Windows key, or click Start.
- Type
cmdand press Enter to open Command Prompt. - Type
ipconfig /alland press Enter. - Look for “Physical Address” under your network adapter’s listing; it’s displayed in the format XX-XX-XX-XX-XX-XX, for example 34-E6-D7-10-4C-8B.
Each network adapter on the system, wired and wireless, will show its own separate Physical Address entry.
macOS and Linux
Open a terminal and use one of the following, depending on your system:
- macOS:
ifconfig | grep ether - Linux (older systems):
ifconfig, looking for theHWaddrfield - Linux (newer systems):
ip link, looking for thelink/etherfield
Cisco Devices
On Cisco routers and switches, MAC addresses display in the dotted format described above, XXXX.XXXX.XXXX, rather than the colon or hyphen notation you’d see on an end-user operating system. Commands like show interfaces or show mac address-table will display MAC addresses in this format.
MAC Addresses vs. IP Addresses
It’s worth being clear about how a MAC address differs from an IP address, since the two are easy to conflate. A MAC address is a Layer 2, hardware-level identifier, assigned by the manufacturer and effectively permanent, though it can be spoofed or manually overridden in software. An IP address is a Layer 3, logical identifier, assigned by an administrator or DHCP server and expected to change depending on which network a device joins.
A single device typically keeps the same MAC address for life, while its IP address might change every time it connects to a different network, which is exactly the kind of practical distinction that trips people up when they’re first learning how addressing works across the different OSI layers.
Troubleshooting MAC Address Issues
A device shows connectivity problems that seem to move between switch ports. This is a classic symptom of a duplicate MAC address, since the switch’s MAC address table can only point to one port for a given address at a time. Checking switch logs for MAC address flapping warnings usually confirms this quickly, and it’s a more reliable first step than assuming a cabling or port hardware fault.
A MAC address you expect to see isn’t showing up in a switch’s MAC address table. Confirm the device is actually sending traffic; switches only learn a MAC address after seeing a frame sourced from it, so a device that’s connected but silent, hasn’t sent any traffic yet, genuinely won’t appear in the table until it does.
A vendor lookup for an OUI returns an unexpected or unfamiliar manufacturer. This can indicate a spoofed MAC address, particularly on a security-sensitive network, since spoofing tools commonly let an attacker set an arbitrary MAC, including one matching a different vendor’s OUI. It’s also possible the device was manufactured by a company using a licensed or acquired OUI block, which is common enough not to immediately assume malicious intent, but worth investigating further if the context calls for it. Public OUI lookup databases, maintained by the IEEE itself among others, are the quickest way to check a vendor assignment against the authoritative registration record.
Unicast, Multicast, and Broadcast MAC Addresses
Not every MAC address represents a single destination device. There are actually three functional categories, and understanding the difference matters for network design and troubleshooting alike.
Unicast addresses represent a single, specific network interface, and the vast majority of everyday traffic, a web request, a file transfer, a video call, uses unicast addressing to reach exactly one destination device.
Multicast addresses represent a group of interested devices simultaneously, rather than one or all devices. A single frame sent to a multicast MAC address gets delivered to every device that’s registered interest in that particular multicast group, useful for applications like streaming video to multiple simultaneous viewers without sending a separate copy to each one, which would waste bandwidth unnecessarily on a large shared network.
Broadcast addresses, the special value FF:FF:FF:FF:FF:FF, represent every device on the local segment at once. A frame sent to the broadcast address gets delivered to and processed by every connected device, which is exactly how protocols like ARP work: a device broadcasts a request asking which MAC address owns a given IP address, and every device on the segment receives it, though only the device that actually owns that IP address replies.
You can tell a MAC address’s type from its first byte: if the least significant bit of the first octet is set to 1, the address is multicast (or broadcast, as a special case); if it’s 0, the address is unicast. This is a genuinely useful detail for anyone reading raw frame captures, since it lets you immediately classify a destination address without needing to cross-reference it against anything else.
Locally Administered vs. Universally Administered Addresses
There’s one more structural detail worth knowing: the second-least-significant bit of a MAC address’s first octet indicates whether the address is universally administered or locally administered. A universally administered address is the standard, factory-assigned MAC following the vendor OUI scheme described above. A locally administered address is one that’s been manually set by an administrator or software, overriding the factory default, commonly seen with virtual network adapters, certain VPN interfaces, and some privacy-focused MAC randomization features on mobile devices. Both bits, the multicast/unicast bit and the universal/local bit, live in that same first octet, which is why experienced network engineers can often tell a lot about an unfamiliar MAC address just from its first two hex digits.
Frequently Asked Questions
What is a MAC address used for?
It is uniquely identifies a network interface at the hardware level, letting devices on the same local network segment correctly send and receive frames intended specifically for them. It operates at Layer 2 of the OSI model, distinct from the Layer 3 IP addressing used for routing between different networks.
How many bits is a MAC address, and how is it structured?
It is a 48 bits total, split into a 24-bit Organizationally Unique Identifier assigned by the IEEE to a manufacturer, and a 24-bit device-specific portion the manufacturer assigns itself. Together these 48 bits are commonly written as 12 hexadecimal digits for readability.
Why do MAC addresses look different on Windows versus Cisco devices?
The underlying 48-bit value is identical; only the display notation differs by platform convention. Windows and most operating systems use hyphen or colon-separated pairs of hex digits, while Cisco IOS uses dot-separated groups of four hex digits instead.
Can two devices really have the same MAC address?
They shouldn’t under normal circumstances, since IEEE registration rules require every vendor to assign unique values within their OUI block, but duplicates do occur due to manufacturing defects, improperly cloned virtual machine configurations, or manual configuration errors. When it happens, it typically causes intermittent, confusing connectivity problems rather than an outright failure.
What’s the difference between a MAC address and an IP address?
It is a permanent, hardware-assigned Layer 2 identifier tied to a specific network interface, while an IP address is a Layer 3 logical identifier that’s typically assigned dynamically and can change depending on which network a device connects to. A device generally keeps one MAC address for its entire hardware lifespan but may have a different IP address on every network it joins.
Is it possible to change a device’s MAC address?
Yes, most operating systems and network interface drivers allow a MAC address to be manually overridden in software, a practice sometimes called MAC spoofing when done to impersonate another device or evade access controls. Legitimate use cases exist too, such as privacy-focused MAC randomization on mobile devices, which is distinct from malicious spoofing intended to bypass network security controls, and it’s worth keeping that distinction in mind when a security review flags a locally administered address.
