What Is a MAC Address? Everything You Need to Know

Every network-capable device in the world, from your smartphone to your smart refrigerator, has a unique identifier burned into its hardware: the MAC address. While IP addresses handle communication across the global internet, MAC addresses handle communication on the local network level. Understanding what MAC addresses are, how they work, and how they relate to IP addresses is essential for anyone who wants to truly understand networking.

This guide covers everything you need to know about MAC addresses: what they are, how they are assigned, how to find yours, the privacy implications, and how they interact with the rest of the networking stack.

What Exactly Is a MAC Address?

MAC stands for Media Access Control. A MAC address is a 48-bit (6-byte) hardware identifier assigned to every network interface controller (NIC). This includes wired Ethernet adapters, WiFi adapters, Bluetooth radios, and any other networking hardware.

MAC Address Format

A MAC address is typically written as six pairs of hexadecimal digits separated by colons or hyphens:

00:1A:2B:3C:4D:5E
00-1A-2B-3C-4D-5E
001A.2B3C.4D5E    (Cisco notation)

Each hexadecimal digit represents 4 bits, so six pairs of two hex digits equals 48 bits total, yielding 2^48 (approximately 281 trillion) possible addresses.

Structure of a MAC Address

A MAC address is split into two halves:

For example, in the MAC address 00:1A:2B:3C:4D:5E:

• 00:1A:2B is the OUI, identifying the manufacturer
• 3C:4D:5E is the unique device identifier assigned by that manufacturer

The IEEE (Institute of Electrical and Electronics Engineers) manages OUI assignments. When a company like Apple, Dell, or Intel wants to manufacture network hardware, they purchase one or more OUIs from the IEEE, giving them a block of 16.7 million unique addresses per OUI.

You can identify the manufacturer of any network device using our MAC Lookup tool, which queries the IEEE OUI database to match the first three bytes to a company.

MAC Address vs. IP Address

One of the most common points of confusion is the difference between MAC addresses and IP addresses. They operate at different layers of the networking stack and serve fundamentally different purposes:

How They Work Together

When your computer sends data to a website, both addresses are used:

1. Your computer knows the destination IP address (e.g., 93.184.216.34 for example.com).
2. If the destination is on a different network, the data must first go to your default gateway (router). Your computer uses ARP (Address Resolution Protocol) to find the router's MAC address.
3. The Ethernet frame is addressed to the router's MAC address, but the IP packet inside is addressed to the destination IP.
4. The router receives the frame, strips the Ethernet header, reads the IP destination, determines the next hop, and creates a new Ethernet frame addressed to the next router's MAC address.
5. This process repeats at each hop until the data reaches the destination.

The key insight is that MAC addresses change at every hop (the Ethernet frame is rewritten by each router), while IP addresses remain the same from source to destination. MAC addresses are for "last-mile" delivery; IP addresses are for global routing.

You can see your current public IP address using our My IP tool, and look up details about any IP using our IP Lookup tool.

How to Find Your MAC Address

Windows

Open Command Prompt and run:

ipconfig /all

Look for "Physical Address" under your active network adapter. You will see a MAC address in the format 00-1A-2B-3C-4D-5E.

Alternatively, go to Settings > Network & Internet > select your connection > Hardware properties.

macOS

Open Terminal and run:

ifconfig en0 | grep ether

Use en0 for your primary Ethernet or WiFi interface. Or go to System Settings > Network > select your connection > Details > Hardware.

Linux

Open a terminal and run:

ip link show

Or the older command:

ifconfig -a

Look for "ether" or "HWaddr" followed by the MAC address.

iOS (iPhone/iPad)

Go to Settings > General > About. Look for "Wi-Fi Address."

Android

Go to Settings > About Phone > Status > Wi-Fi MAC Address. Note that modern Android versions (10+) use a randomized MAC address by default, so the address shown may differ from the hardware address.

Router Admin Panel

Log into your router's admin interface (usually at 192.168.1.1 or 192.168.0.1) to see the MAC addresses of all connected devices. This is useful for identifying unknown devices on your network.

The ARP Table: Mapping MAC to IP

ARP (Address Resolution Protocol) is the protocol that bridges the gap between IP addresses and MAC addresses on a local network. Every device maintains an ARP table (also called an ARP cache) that maps IP addresses to MAC addresses.

You can view your ARP table with:

# Windows
arp -a

# macOS/Linux
arp -a
# or
ip neigh show    # Linux modern syntax

The output shows which IP addresses on your local network correspond to which MAC addresses. ARP entries are cached temporarily and expire after a few minutes, after which the device sends a new ARP request to refresh the mapping.

MAC Address Filtering

Many routers support MAC address filtering as a security feature. With MAC filtering enabled, only devices whose MAC addresses are on an allow list can connect to the network.

How It Works

1. You log into your router's admin panel
2. You add the MAC addresses of your trusted devices to the allow list
3. The router rejects connection attempts from any device not on the list

Is MAC Filtering Effective?

MAC filtering provides a very thin layer of security. It will stop casual users from connecting to your WiFi, but it is trivially easy to bypass for anyone with basic technical knowledge because MAC addresses can be spoofed (changed in software). A determined attacker can:

1. Monitor WiFi traffic to see which MAC addresses are communicating with the access point
2. Clone an allowed MAC address on their own device
3. Connect to the network

MAC filtering should be considered a minor deterrent, not a real security measure. Proper WPA3 encryption with a strong password is far more effective.

MAC Spoofing

MAC spoofing is the practice of changing the MAC address that your device reports to the network. While the hardware address is burned into the NIC, the operating system can override it at the software level.

Legitimate Uses

• Privacy protection: Prevent tracking across different WiFi networks
• Network testing: Simulate multiple devices during development
• Bypassing restrictions: Connect when a MAC is blocked (on your own network)
• Replacing hardware: Configure a new NIC to use the same MAC as an old one for license or lease continuity

How to Spoof on Various Platforms

Windows (PowerShell):

Set-NetAdapter -Name "Wi-Fi" -MacAddress "00-11-22-33-44-55"

macOS:

sudo ifconfig en0 ether 00:11:22:33:44:55

Linux:

sudo ip link set dev eth0 address 00:11:22:33:44:55

Privacy Implications

Modern operating systems now randomize MAC addresses by default for WiFi connections. Apple introduced this in iOS 14, Android in version 10, and Windows 10 added the option (enabled by default in Windows 11). This prevents retailers, airports, and other locations from tracking your physical movements by monitoring your device's MAC address as it probes for WiFi networks.

MAC Addresses in Network Security

DHCP Reservations

System administrators commonly use MAC addresses to create DHCP reservations, ensuring a specific device always receives the same IP address. This is useful for servers, printers, and IoT devices that need consistent addresses without static configuration.

Network Access Control (NAC)

Enterprise networks use NAC systems that authenticate devices based on their MAC addresses as one factor (usually combined with user credentials and security posture checks). IEEE 802.1X is the standard protocol for port-based network access control.

Forensic Identification

In network forensics, MAC addresses in router logs, DHCP logs, and packet captures help identify which physical device was involved in an incident. However, because MAC addresses can be spoofed, they should not be treated as definitive evidence.

MAC Address and Geolocation

Some geolocation services use databases of WiFi access point MAC addresses (BSSIDs) to determine location. When your phone scans nearby WiFi networks, the MAC addresses of those access points can be cross-referenced with known locations. This is separate from your device's own MAC address and is how WiFi-based location services work alongside GPS.

You can explore how different geolocation methods work with our Find My Location and GPS Coordinates tools.

Key Takeaways

• A MAC address is a 48-bit hardware identifier unique to every network interface
• The first three bytes identify the manufacturer (OUI); the last three bytes are device-specific
• MAC addresses operate at Layer 2 (local network); IP addresses operate at Layer 3 (global routing)
• You can look up any MAC address manufacturer with our MAC Lookup tool
• Modern devices randomize MAC addresses on WiFi to prevent tracking
• MAC filtering is a weak security measure; proper encryption (WPA3) is essential
• MAC spoofing is straightforward and has both legitimate and malicious uses

Related Articles:

• IPv6 Adoption Guide: Why the Internet Is Running Out of Addresses
• Subnet Calculator Guide: Understanding CIDR Notation and Subnetting
• DNS Records Explained: A Complete Guide to A, AAAA, MX, NS, TXT, and CNAME