A MAC (Media Access Control) address is a 48-bit hardware address burned into a network interface and used for delivery on the local network (Layer 2).
- Written as 12 hexadecimal digits:
00:1A:2B:3C:4D:5Eor00-1A-2B-3C-4D-5E. - The first 24 bits are the OUI (Organisationally Unique Identifier) assigned to the manufacturer; the last 24 bits identify the individual card.
FF:FF:FF:FF:FF:FFis the broadcast MAC address.- ARP (Address Resolution Protocol) discovers the MAC address that belongs to a known IP address on the same LAN.
Find your MAC address: Windows ipconfig /all (Physical Address); Linux ip link.
Why MAC addresses exist
An IP address can change (DHCP can give a laptop a new address tomorrow). A MAC address is tied to the network interface itself, so on a local network switches can deliver frames to the correct cable port even when IP addresses change. Layer 2 (switches, Wi-Fi access points) forwards using MACs; Layer 3 (routers) forwards using IP addresses. Both are needed, and ARP is the bridge between them.
OUI and uniqueness
The first three bytes (24 bits) are the OUI, assigned by the IEEE to a manufacturer (Cisco, Intel, Realtek and so on). The last three bytes are chosen by the manufacturer so that no two of their cards share the same full address. In theory every MAC in the world is unique. In practice, virtual machines and some tools can set a locally administered address, so uniqueness is not a security guarantee.
Broadcast and special addresses
| Address | Meaning |
|---|---|
FF:FF:FF:FF:FF:FF | Broadcast: every NIC on the LAN accepts the frame |
01:00:5E:... (typical) | Multicast Ethernet addresses (used with IP multicast) |
| Your own MAC | Unicast: only your NIC accepts the frame |
How ARP works, step by step
Suppose PC-A (192.168.1.10) wants to send an IP packet to PC-B (192.168.1.20) on the same subnet, but does not yet know B's MAC:
- A looks in its ARP cache. If B's MAC is already there and not expired, A uses it.
- If not, A broadcasts an ARP request: "Who has 192.168.1.20? Tell 192.168.1.10."
- Every host on the LAN receives the request. Only B recognises its own IP and replies with an ARP reply (unicast) containing B's MAC.
- A stores the mapping in its ARP cache and builds the Ethernet frame with B's MAC as the destination.
If B is on another subnet, A does not ARP for B. It ARPs for its default gateway and sends the frame to the router. The router then forwards the packet toward B. Getting this wrong (trying to ARP for a remote host) is a common misconception.
Everyday example: a switch is like a post office that sorts by street number (MAC). A router is like a post office that sorts by city (IP network). ARP is asking your neighbours "what is the street number for flat 20?"
Common mistake: treating a MAC as a password or as proof of identity. MACs can be spoofed. Switches may use MAC filtering as a weak extra control, but it is not real authentication.
Tip: on Windows, arp -a shows the cache; on Linux, ip neigh. Clearing a stale entry (arp -d or ip neigh flush) can fix "cannot reach host" after a device's IP or NIC has changed.
Remember
- A MAC address is a 48-bit Layer-2 hardware address; IP is Layer 3.
- ARP maps an IP address to a MAC address on the same LAN.
- To reach another subnet, hosts send frames to the gateway's MAC, not the remote host's MAC.