MAC address (media access control)

Each network-com­pat­i­ble device has at least one unique hardware ID – the media access control address (in short: MAC address). What this is all about and how you can find or rewrite the MAC address is explained below.

Each device that is in­te­grat­ed into a computer network requires a network adaptor. This adapter receives a worldwide unique iden­ti­fi­ca­tion number from the man­u­fac­tur­er: the MAC address. This enables devices like desktop computers, tablets, or mobile phones to be iden­ti­fied in the network and addressed as required. If a device has several network adapters (for example, for several LAN con­nec­tions or different com­mu­ni­ca­tion standards like Ethernet, WiFi, FDDI, Bluetooth, or Token Ring), a different address is available for each standard.

Since MAC addresses are assigned directly by the hardware man­u­fac­tur­er, they are also referred to as hardware addresses. With Microsoft Windows, the MAC address is referred to as the physical address. Apple uses the terms Ethernet ID, Airport ID, or WiFi address, depending on the com­mu­ni­ca­tion standard. The term device address, on the other hand, is fuzzy, since a device can have several network adapters and therefore different MAC addresses.

Con­flict­ing MAC addresses are a basic re­quire­ment for error-free network com­mu­ni­ca­tion.

Data trans­mis­sion in computer networks is a complex com­mu­ni­ca­tion process in which different re­quire­ments including re­li­a­bil­i­ty, security, and ef­fi­cien­cy must be met. This can be il­lus­trat­ed using the OSI models (ab­bre­vi­a­tion for open systems in­ter­con­nec­tion) – a reference model developed by the ISO (In­ter­na­tion­al Or­ga­ni­za­tion for Stan­dard­iza­tion) that maps network com­mu­ni­ca­tion to 7 layers. During data trans­mis­sion, each layer of the OSI model is run through on both the sender and receiver sides.

MAC addresses are used on the backup layer (layer 2) of the OSI model – actually, the media access control sublayer in­tro­duced by the Institute of Elec­tri­cal and Elec­tron­ics Engineers (IEEE).

The backup layer is located between the bit transfer layer (layer 1) and the switching layer (layer 3). While the bit trans­mis­sion layer provides protocols and tools re­spon­si­ble for main­tain­ing the physical con­nec­tion, protocols on the backup layer control how different systems share the available trans­mis­sion medium. Secure system con­nec­tions are ab­stract­ed from the physical con­nec­tion. The actual trans­mis­sion of data packets takes place at the switching level via IP.

For example, if you want to send an IP packet over Ethernet, your computer transmits a data frame that is addressed to the target computer’s MAC address on the backup layer, according to the OSI model.

An Ethernet data frame contains in­for­ma­tion that is read out at different levels of the OSI model.

Data frames in IPv4 networks contain the following com­po­nents:

• Des­ti­na­tion address (des­ti­na­tion computer MAC address)
• Source address (sender’s MAC address)
• Control in­for­ma­tion for data flow control
• User data (the data packet that needs to be trans­mit­ted later on the switching layer)
• Checksums that ensure data integrity

A target computer that receives a data frame first reads it on the backup layer and compares the target address of the frame with its own MAC address. If the addresses match, the target computer starts in­ter­pret­ing the frame at the next higher level.

To link the address as­sign­ment on the backup layer with the address as­sign­ment on the switching layer, the address res­o­lu­tion protocol (ARP) is used in IPv4 networks. Each computer in the local network maintains an ARP table whereby IP addresses are assigned to MAC addresses.

The new internet protocol standard IPv6 uses the neighbor discovery protocol (NDP).

MAC addresses in LAN or WLAN networks consist of 6 bytes (48 bits) and are written in hexa­dec­i­mal notation. The use of sep­a­ra­tors such as hyphens or colons between two bytes increases read­abil­i­ty.

The following example shows the MAC address of a desktop computer in binary and hexa­dec­i­mal format:

The bit sequence of each MAC address is divided into 4 areas, each of which encodes different in­for­ma­tion.

• Bit 1 (receiver): The first bit of the MAC address specifies whether it is an in­di­vid­ual or group address. This bit is called I/G (short for in­di­vid­ual/group). If I/G = 0, it is a unicast address for a single network adapter. Multicast addresses are iden­ti­fied by I/G = 1 and are addressed to several receivers.
• Bit 2 (registry): The second bit of the MAC address indicates whether it is an address with global validity (universal) or whether the address has been assigned locally (local). The bit is called U/L. If U/L = 0, the address is valid worldwide as a uni­ver­sal­ly ad­min­is­tered address (UAA). Addresses that are only locally unique are called locally ad­min­is­tered address (LAA) and are marked with U/L = 1.
• Bit 3–24 (man­u­fac­tur­er iden­ti­fi­ca­tion): Bits 3 to 24 encode an iden­ti­fi­er (or­ga­ni­za­tion­al­ly unique iden­ti­fi­er, OUI), which is assigned ex­clu­sive­ly to hardware man­u­fac­tur­ers by IEEE. The as­sign­ment of OUIs is usually public and can be de­ter­mined via databases. A cor­re­spond­ing service is available, for example, on aruljohn.com.
• Bit 25-48 (network adapter iden­ti­fi­er): Bits 25 to 48 provide device man­u­fac­tur­ers with 24 bits for assigning a unique hardware iden­ti­fi­er (or­ga­ni­za­tion­al­ly unique address, OUA). This means that 2²⁴ (= 16.777.216) unique OUAs can be assigned per OUI.

Table: Subareas of an MAC address

MAC addresses can be queried through the terminal in all modern operating systems with little effort – both on the local system and remotely in the network. The following table shows the cor­re­spond­ing command line commands for the most common operating systems.

Table: MAC address read out

On mobile devices, you can display the MAC address in the settings.

Table: Get MAC addresses on mobile devices

Step 2: From Windows 2000 onwards you can use the command line utility ipconfig with the “/all” option to get the MAC address of all network adapters on your Windows computer.

Thanks to ARP, in IPv4 networks it is possible to determine other devices’ MAC addresses in the same local network. With Windows and most unixoid operating systems, use the command line “arp” with the option to display you system’s ARP table in the terminal.

You will receive a terminal output according to the following scheme:

If you just want to read the MAC address of a specific network adapter remotely, use the command “arp –a” in a com­bi­na­tion with the target adapter’s local IPv4 address.

MAC addresses are in­vari­ably assigned by device man­u­fac­tur­ers and are “burned” into the network adapter chip on the hardware side. However, numerous operating systems offer the option to overwrite hardware addresses on the software side. This is referred to as spoofing. In this case, a system does not send the addressed adapter’s real network hardware address in network com­mu­ni­ca­tion, but instead a user-defined MAC address.

Unix de­riv­a­tives such as Linux, macOS, Solaris, and the BSD operating systems support the as­sign­ment of MAC addresses through the terminal on the software side.

Table: Over­writ­ing a MAC address

We il­lus­trate the procedure using the most commonly used Unix de­riv­a­tive: Linux. If you want to change your network adapter’s MAC address, proceed as follows.

Step 1: Open the operating system terminal – for example, with the key com­bi­na­tion [CTRL]+[ALT]+[T].

Step 2: Determine the name and current MAC address of the desired network adapter. To do this, enter the following command in the command line:

Step 3: Turn off the network adapter by entering the following command in the command line:

Step 4: Overwrite the network address assigned by the man­u­fac­tur­er with one of the options specified in the table.

Step 5: Restart the network adapter. Use the following command line command: