What is a MAC address and how is it structured?
Show the answer
Say this first
A MAC address is a 48-bit layer 2 address written as 12 hex digits. The first 24 bits are the OUI, assigned to the manufacturer by the IEEE; the last 24 bits are assigned by that vendor. Two bits in the first byte carry meaning: the least significant bit is I/G (1 means group, so multicast or broadcast), and the next is U/L (1 means locally administered). It only matters on the local segment; routers replace it at every hop.
Go deeper
Formats you will see
- Cisco:
0050.56a1.2b3c - Linux and most others:
00:50:56:a1:2b:3c - Windows:
00-50-56-A1-2B-3C
Special addresses
| Address | Meaning |
|---|---|
ff:ff:ff:ff:ff:ff | Broadcast |
01:00:5e:xx:xx:xx | IPv4 multicast (low 23 bits of the group address) |
33:33:xx:xx:xx:xx | IPv6 multicast (low 32 bits of the group address) |
01:80:c2:00:00:00 | IEEE STP BPDUs |
00:00:0c:07:ac:xx | HSRP version 1 virtual MAC (xx is the group) |
Locally administered addresses
Phones and laptops now randomize their MAC per Wi-Fi network for privacy. Those addresses have the U/L bit set, so the second hex digit is 2, 6, A or E. This breaks MAC-based tracking, some MAB setups and DHCP reservations.
They will ask next
Why does mapping IPv4 multicast to MAC cause overlap?
Only 23 bits of the 28-bit group ID fit into
01:00:5e, so 32 IPv4 groups share each MAC. For example224.1.1.1and225.1.1.1map to the same MAC01:00:5e:01:01:01. Hosts filter the rest in software.Can two devices have the same MAC?
It happens with cloned VMs, bad hardware and random addresses that collide. On one VLAN it causes MAC flapping between ports and intermittent loss. Across different VLANs or subnets it does not matter.
Traps
- Saying the MAC is used end to end. It is replaced at every router.