MAC Address
A MAC (Media Access Control) address is a unique identifier permanently assigned to every network adapter: the hardware in your device that connects it to a network.
While an IP address can change and identifies your device on the wider network, a MAC address is fixed at the hardware level and identifies your device on the local network. Every Wi-Fi adapter, Ethernet port, and Bluetooth chip has its own unique MAC address.
MAC Address, explained at three levels
At home
A MAC address is a unique code built into every piece of network hardware in your devices: your laptop's Wi-Fi adapter, your phone's wireless chip, and your desktop's Ethernet port each have one. It looks like six pairs of letters and numbers separated by colons, like A4:5E:60:B3:2C:01. Your router uses MAC addresses to tell your devices apart on the local network, even if their IP addresses change.
At work
MAC addresses are used in business networking for device identification and access control. IT teams can configure networks to allow or deny access based on MAC address (MAC filtering), ensuring only authorized devices can connect. MAC addresses also appear in network logs and monitoring tools, helping administrators identify which physical device is generating traffic or causing issues. When troubleshooting local network problems, the MAC address helps pinpoint the exact device involved.
At home
A MAC address is a 48-bit identifier, typically displayed as six hexadecimal pairs (e.g., 00:1A:2B:3C:4D:5E). The first three pairs identify the manufacturer (the OUI, Organizationally Unique Identifier), and the last three are assigned by the manufacturer to uniquely identify the device. MAC addresses operate at Layer 2 (the data link layer) of the OSI model, while IP addresses operate at Layer 3 (the network layer). On a local Ethernet or Wi-Fi network, devices use the ARP (Address Resolution Protocol) to map IP addresses to MAC addresses for actual frame delivery.
At work
In enterprise networks, Network Access Control (NAC) systems use MAC addresses as one factor in determining whether a device should be granted network access and what level of access it receives. However, MAC-based security has limitations: MAC addresses can be spoofed (changed in software), so MAC filtering alone is not a reliable security measure. 802.1X port-based authentication provides much stronger device and user authentication. DHCP servers in enterprise environments often log the MAC-to-IP mapping, which is useful for audit trails and forensic investigation.
At home
Modern mobile operating systems (iOS, Android) and some desktop OSes (Windows, macOS) implement MAC address randomization, generating temporary random MAC addresses when scanning for Wi-Fi networks to prevent tracking. This privacy feature can complicate enterprise network management, as a device may present different MAC addresses each time it connects. Organizations that rely on MAC-based identification need to account for this: either by configuring client devices to use their real MAC on trusted networks or by adopting identity-based (802.1X) authentication that does not depend on MAC addresses.
At work
At scale, MAC address tables in network switches (CAM tables: Content Addressable Memory) map MAC addresses to physical switch ports, enabling the switch to forward frames only to the correct port rather than flooding all ports. CAM table overflow attacks exploit the fixed size of these tables to force a switch into hub-like behaviour, broadcasting all traffic to all ports where it can be sniffed. Port security features limit the number of MAC addresses per port, and dynamic ARP inspection (DAI) prevents ARP spoofing attacks that manipulate MAC-to-IP mappings. In virtualized environments, virtual switches manage MAC addresses for virtual machines, and hypervisors typically assign MAC addresses from a locally administered range to avoid conflicts.
Real-world examples
At home
When Lena sets up parental controls on her home router, she uses the MAC address of her children's tablet to create a rule that limits internet access to certain hours. Even if the tablet's IP address changes (which it does every few days), the MAC address stays the same, so the rule continues to apply to the right device.
At work
When a security incident occurs at Carlos's company and the team needs to identify which device accessed a specific resource at a specific time, they cross-reference the DHCP logs (which map MAC addresses to IP addresses and timestamps) to trace the activity back to a particular laptop's network adapter, and from there to the employee it was assigned to.
Common confusions
- One common misunderstanding is that a MAC address and an IP address are the same thing. A MAC address identifies the physical hardware on a local network, while an IP address identifies the device on a broader network; they work at different layers.
- It's often assumed that MAC addresses are completely permanent and unchangeable. While they are burned into hardware, most operating systems allow the software-reported MAC to be changed, and modern devices randomize it for privacy.
- There's a widespread belief that MAC filtering makes a network secure. MAC addresses can be spoofed easily, so MAC filtering should be considered a convenience measure rather than a serious security control.
For analysts
If a project involves device-level access control or tracking, be aware that MAC addresses are useful but not infallible identifiers. MAC randomization on modern devices means you cannot always rely on a consistent MAC address for the same device. Discuss with the technical team whether the solution needs to handle randomized MACs and what alternative identification methods (certificates, 802.1X) should be used for robust security.
History & origin
MAC addresses were introduced as part of the Ethernet standard developed by Xerox, DEC, and Intel in the early 1980s. The IEEE (Institute of Electrical and Electronics Engineers) established the format and manages the allocation of address blocks to manufacturers, ensuring that every network adapter produced worldwide receives a globally unique identifier. The system has been in continuous use for over forty years.