What Is a MAC Address? Hardware Addresses Explained

Last Updated: October 2026

Every device that connects to a network — your laptop, phone, smart TV, printer, gaming console, or even your refrigerator — has a unique identifier burned into its network hardware. This identifier is called a MAC address (Media Access Control address), and it is fundamental to how local networks deliver data to the correct device. While IP addresses get all the attention, MAC addresses do the heavy lifting at the physical and data link layers.

In this guide, we will explain what a MAC address is, break down its format and structure, show you how to find it on every major platform, compare MAC and IP addresses, explore how switches use MAC address tables, cover MAC filtering and its limitations, discuss MAC spoofing and randomization, and explain the relationship between MAC addresses, ARP, and IPv6.

What Is a MAC Address?

A MAC address is a 48-bit (6-byte) hardware identifier assigned to a network interface controller (NIC). Every Ethernet adapter, Wi-Fi card, Bluetooth radio, and virtual network interface has one. The MAC address operates at Layer 2 (Data Link Layer) of the OSI model and is used to identify the source and destination of frames on a local network segment.

Unlike an IP address, which is a logical address assigned by the network and can change, a MAC address is typically burned into the hardware by the manufacturer during production. It is meant to be globally unique — no two devices in the world should have the same MAC address (though exceptions exist with spoofing and randomization, discussed below).

When your computer sends data to another device on the same local network, it wraps the data in an Ethernet frame with the destination device's MAC address in the header. The network switch reads this MAC address and delivers the frame to the correct port. Without MAC addresses, the switch would have no way to know which physical port the destination device is connected to.

MAC Address Format and Notation

A MAC address consists of 6 bytes (48 bits) written as 12 hexadecimal digits. There are three common notation styles:

• Colon notation: 00:1A:2B:3C:4D:5E — used by Linux, macOS, and most documentation.
• Dash notation: 00-1A-2B-3C-4D-5E — used by Windows (ipconfig /all output).
• Dot notation: 001A.2B3C.4D5E — used by Cisco IOS and some enterprise equipment (groups of 4 hex digits separated by dots).

All three notations represent the same 48-bit value. The case of the hex letters does not matter — 00:1a:2b:3c:4d:5e and 00:1A:2B:3C:4D:5E are identical.

Structure: OUI + Device Identifier

The 48 bits of a MAC address are divided into two halves:

• First 3 bytes (24 bits) — OUI (Organizationally Unique Identifier): This portion is assigned to the manufacturer by the IEEE (Institute of Electrical and Electronics Engineers). Each manufacturer registers one or more OUIs. For example, 00:1A:2B might belong to Ayecom Technology Co., while AC:DE:48 belongs to Apple.
• Last 3 bytes (24 bits) — Device Identifier: This portion is assigned by the manufacturer to uniquely identify each device they produce. With 24 bits, a single OUI can cover approximately 16.7 million unique devices.

You can look up any MAC address's manufacturer by searching the OUI in the IEEE's public database or using an online OUI lookup tool. This is useful for identifying unknown devices on your network — if you see a device with an Apple OUI, it is likely an iPhone, iPad, or Mac.

Special Bits in the First Byte

The first byte of a MAC address contains two special bits:

• Bit 0 (least significant bit) — Unicast/Multicast: If 0, the address is unicast (a single device). If 1, it is a multicast address (a group of devices). The broadcast address FF:FF:FF:FF:FF:FF is a special multicast that targets all devices on the segment.
• Bit 1 — Universally/Locally Administered: If 0, the address is universally administered (assigned by the manufacturer, globally unique). If 1, it is locally administered (overridden by software, such as a VM hypervisor or MAC randomization). Locally administered MACs are common in virtualized environments and privacy-focused devices.

How to Find Your MAC Address

Windows

There are several ways to find your MAC address on Windows:

• Command Prompt — ipconfig /all: Open Command Prompt and run ipconfig /all. Look for “Physical Address” under each network adapter. It will be displayed in dash notation (e.g., 00-1A-2B-3C-4D-5E).
• Command Prompt — getmac: Run getmac for a concise list of all MAC addresses and their associated transport names.
• PowerShell — Get-NetAdapter: Run Get-NetAdapter | Select-Object Name, MacAddress for a clean table of adapter names and MACs.
• Settings: Go to Settings → Network & Internet → Ethernet (or Wi-Fi) → click your connection → scroll down to “Physical address (MAC).”

macOS

• Terminal — ifconfig: Open Terminal and run ifconfig en0 (Wi-Fi) or ifconfig en1 (Ethernet). Look for the ether line — that is your MAC address in colon notation.
• System Settings: Go to System Settings → Network → select your connection → Details → Hardware. The MAC address is displayed as “MAC Address.”
• Option-click the Wi-Fi icon in the menu bar to see a quick summary that includes the MAC address (labeled “Address”).

Linux

• ip link: Run ip link show. Each interface lists its MAC address after link/ether (e.g., link/ether 00:1a:2b:3c:4d:5e).
• ifconfig: Run ifconfig (may require net-tools package). The MAC is displayed as ether or HWaddr.
• cat /sys/class/net/eth0/address: Directly reads the MAC address of a specific interface from the filesystem.

iPhone / iPad (iOS)

Go to Settings → General → About. Look for “Wi-Fi Address” — this is your MAC address. Note that iOS uses private Wi-Fi addresses (MAC randomization) by default, so the MAC shown here may be a randomized address specific to the connected network, not the hardware MAC.

Android

Go to Settings → About phone (or About device) → Status → “Wi-Fi MAC address.” On newer Android versions (10+), the default is a randomized MAC per network. To see the actual hardware MAC, you may need to check “Device Wi-Fi MAC address” in the same menu.

MAC Address vs. IP Address

MAC addresses and IP addresses serve different purposes at different layers of the network. Both are essential for communication, but they work in fundamentally different ways:

Think of it like a postal analogy: the IP address is like a street address — it tells the postal system how to route the letter across cities and states to the right neighborhood. The MAC address is like the name on the mailbox — once the letter arrives at the local post office (the subnet), the carrier uses it to deliver to the exact recipient. At every router hop along the way, the MAC addresses in the frame header change (they are rewritten to the next-hop router's MAC and the source becomes the current router's MAC), but the IP addresses remain the same from source to destination.

MAC Address Tables and Network Switches

A network switch uses a MAC address table (also called a CAM table — Content Addressable Memory) to learn which MAC addresses are reachable through which ports. When a frame arrives on a port, the switch records the source MAC address and the port number. Over time, the switch builds a complete table mapping every MAC address on the network to a physical port.

When a frame arrives with a destination MAC the switch has in its table, it forwards the frame only to the correct port — this is called unicast forwarding. If the destination MAC is unknown (not yet in the table), the switch floods the frame to all ports (except the source port) so the destination device will receive it and respond, allowing the switch to learn its location.

MAC table entries have a timeout (typically 300 seconds / 5 minutes). If no traffic is seen from a MAC address within this period, the entry is removed. This ensures the table stays current as devices connect and disconnect.

On managed switches, you can view the MAC address table to see exactly which devices are connected to which ports. This is invaluable for network troubleshooting — if a device is not reachable, check whether its MAC appears in the table and on the expected port.

MAC Address Filtering

MAC filtering (also called MAC access control) is a feature on routers and access points that allows or denies network access based on a device's MAC address. You create a whitelist of allowed MAC addresses, and any device not on the list is blocked from connecting — even if it knows the Wi-Fi password.

How to Set Up MAC Filtering

1. Log in to your router's admin panel.
2. Navigate to Wireless Security, Access Control, or MAC Filtering.
3. Enable the feature and set the mode to Allow (whitelist) or Deny (blacklist).
4. Add the MAC addresses of your authorized devices.
5. Save and apply the settings.

Why MAC Filtering Is Not Real Security

While MAC filtering adds a layer of inconvenience for casual unauthorized users, it provides almost no real security against a knowledgeable attacker. Here is why:

• MAC addresses are transmitted in plaintext. An attacker monitoring wireless traffic can see the MAC addresses of every connected device using freely available tools like Wireshark or airodump-ng.
• MAC addresses are trivially spoofed. Once an attacker knows a legitimate MAC, they can change their own device's MAC to match in seconds (see MAC spoofing below).
• MAC randomization breaks filtering. Modern devices randomize their MAC address by default. Your own devices may be blocked by your own filter if their MAC changes.

Recommendation: Use MAC filtering as an additional convenience layer (e.g., to keep a specific device off the network), but always rely on WPA3/WPA2 encryption with a strong password as your primary security measure.

MAC Spoofing

MAC spoofing is the act of changing a device's MAC address to a different value through software. Despite the MAC being a “hardware” address, virtually every operating system allows it to be overridden at the driver level.

How to Spoof a MAC Address

• Windows: Open Device Manager → expand Network Adapters → right-click your adapter → Properties → Advanced → look for “Network Address” or “Locally Administered Address” → enter the new MAC without separators. Alternatively: Set-NetAdapter -Name "Ethernet" -MacAddress "00-11-22-33-44-55" in PowerShell.
• macOS: sudo ifconfig en0 ether 00:11:22:33:44:55 (temporary, reverts on reboot).
• Linux: sudo ip link set dev eth0 address 00:11:22:33:44:55 or use macchanger for more options.

Legitimate Uses of MAC Spoofing

• Privacy: Changing your MAC to avoid tracking in public Wi-Fi environments.
• ISP restrictions: Some ISPs or networks lock connections to a specific MAC. Spoofing the old device's MAC onto a new device avoids re-registration.
• Testing: Network administrators spoof MACs to test MAC filtering rules, DHCP reservations, and access control policies.
• Virtual machines: Hypervisors automatically generate locally administered MAC addresses for VM network interfaces.

Malicious Uses

• Bypassing MAC filters: An attacker spoofs a whitelisted MAC to gain unauthorized network access.
• ARP spoofing / man-in-the-middle: An attacker spoofs the MAC of the gateway to intercept traffic from other devices (see ARP section below).
• Evading network bans: A banned device changes its MAC to appear as a new device.

MAC Address Randomization (Privacy)

As awareness of wireless tracking grew, operating system vendors introduced MAC address randomization to protect user privacy. When enabled, the device uses a randomly generated MAC address instead of its real hardware MAC when scanning for and connecting to Wi-Fi networks. This prevents stores, airports, advertising networks, and other entities from tracking your movements by monitoring your MAC address.

Platform Support

• iOS (iPhone/iPad): Called “Private Wi-Fi Address.” Enabled by default since iOS 14. Each Wi-Fi network gets a unique random MAC. You can toggle it per network in Settings → Wi-Fi → tap the (i) icon.
• Android: Called “Randomized MAC.” Enabled by default since Android 10. Each network gets a unique random MAC. Find it in Settings → Wi-Fi → network details → Privacy.
• Windows: Called “Random hardware addresses.” Available since Windows 10. Enable per network or globally in Settings → Network & Internet → Wi-Fi → Random hardware addresses.
• macOS: Introduced private Wi-Fi addressing in macOS Sequoia (15) and later. Enabled by default for new networks.

Impact on DHCP Reservations and MAC Filtering

MAC randomization can break DHCP reservations and MAC filtering because the device no longer presents its real hardware MAC. If you have a DHCP reservation based on a device's MAC, the reservation will not match when the device uses a random MAC. Solutions include:

• Disabling MAC randomization for your home network (usually a per-network setting on the device).
• Using the randomized MAC in your DHCP reservation (this is stable per-network on most platforms).
• Relying on other identification methods where possible.

MAC Addresses and ARP

ARP (Address Resolution Protocol) is the bridge between IP addresses (Layer 3) and MAC addresses (Layer 2). When a device needs to send data to another device on the same local subnet, it knows the destination IP but needs the destination MAC to create the Ethernet frame. ARP solves this.

How ARP Works

1. Device A wants to send data to 192.168.1.50 but does not know its MAC address.
2. Device A broadcasts an ARP Request to FF:FF:FF:FF:FF:FF: “Who has 192.168.1.50? Tell 192.168.1.10.”
3. Every device on the subnet receives the broadcast. The device at 192.168.1.50 responds with an ARP Reply: “192.168.1.50 is at 00:1A:2B:3C:4D:5E.”
4. Device A caches this mapping in its ARP table and uses the MAC to send the Ethernet frame directly.

You can view the ARP table on your device using arp -a (Windows, macOS) or ip neigh show (Linux). This shows all known IP-to-MAC mappings and is a useful diagnostic tool — if an entry is wrong or missing, it can explain connectivity issues on the local network.

ARP Spoofing Attacks

ARP spoofing (or ARP poisoning) is an attack where an attacker sends forged ARP replies to associate their own MAC address with another device's IP address (usually the default gateway). Affected devices then send all their traffic to the attacker instead of the real gateway, enabling a man-in-the-middle attack. Defenses include static ARP entries, Dynamic ARP Inspection (DAI) on managed switches, and VPN usage.

MAC Addresses and Wi-Fi

In Wi-Fi (802.11) networks, MAC addresses play an even more prominent role than in wired Ethernet:

• Association: When a device connects to a Wi-Fi network, it sends its MAC address in the association request. The access point uses this MAC to track the client and manage the connection.
• Probe requests: Before connecting, devices send probe requests to discover available networks. These probes contain the device's MAC address, which is why MAC randomization during scanning is important for privacy.
• 802.11 frame headers: Wi-Fi frames can contain up to four MAC address fields (source, destination, transmitter, and receiver), depending on the frame type and direction. This is more complex than Ethernet's two-address format because frames may be relayed by access points.
• Roaming: When a device moves between access points in the same network, the new AP learns the device's MAC and updates its tables. Fast roaming protocols (802.11r) use the MAC as a key identifier during the handoff process.

EUI-64 and IPv6

IPv6 addresses are 128 bits long, split into a 64-bit network prefix (provided by the router) and a 64-bit interface identifier (unique to the device). The EUI-64 (Extended Unique Identifier 64-bit) process generates the interface identifier from the device's 48-bit MAC address.

How EUI-64 Works

1. Take the 48-bit MAC address: 00:1A:2B:3C:4D:5E
2. Split it in half: 00:1A:2B | 3C:4D:5E
3. Insert FF:FE in the middle: 00:1A:2B:FF:FE:3C:4D:5E
4. Flip the 7th bit (U/L bit) of the first byte: 00 → 02
5. Result: 02:1A:2B:FF:FE:3C:4D:5E = interface identifier 021A:2BFF:FE3C:4D5E
6. Combine with the network prefix (e.g., 2001:db8:1::): 2001:db8:1::021A:2BFF:FE3C:4D5E

Privacy Concerns with EUI-64

Because EUI-64 embeds the real MAC address into the IPv6 address, anyone who sees the IPv6 address can extract the MAC and identify the device (and its manufacturer). This is a significant privacy concern — your device can be tracked across different networks by its IPv6 address.

To address this, RFC 4941 introduced IPv6 Privacy Extensions, which generate a random interface identifier instead of using EUI-64. Most modern operating systems enable privacy extensions by default, so the EUI-64 address exists but is not used for outgoing connections. The device uses a temporary, randomly generated address for communication and rotates it periodically.

For more about IP addressing, see our What Is an IP Address guide.

Frequently Asked Questions

What is a MAC address?

A MAC (Media Access Control) address is a unique 48-bit hardware identifier assigned to every network interface — wired Ethernet, Wi-Fi, Bluetooth, and more. It is written as six pairs of hexadecimal digits (e.g., 00:1A:2B:3C:4D:5E) and is used at Layer 2 to identify devices on a local network segment.

How do I find my MAC address on Windows?

Open Command Prompt and run ipconfig /all — look for “Physical Address” under your network adapter. Alternatively, run getmac for a quick list. In Settings, go to Network & Internet → select your connection → scroll to “Physical address (MAC).”

What is the difference between a MAC address and an IP address?

A MAC address is a hardware identifier that works at Layer 2 (local network only) and does not change as the device moves between networks. An IP address is a logical address assigned by the network (Layer 3) that can change depending on the network. Devices need both: MAC for local delivery, IP for routing across networks.

What is an OUI in a MAC address?

The OUI (Organizationally Unique Identifier) is the first three bytes of a MAC address. It identifies the manufacturer that produced the network interface. The remaining three bytes are a unique serial assigned by the manufacturer. You can look up the OUI to identify the vendor of an unknown device on your network.

What is MAC address randomization?

MAC randomization is a privacy feature where a device uses a randomly generated MAC instead of its real hardware MAC when connecting to Wi-Fi networks. This prevents tracking by retailers, advertisers, and network operators. iOS, Android, Windows, and macOS all support it, and most enable it by default.

Is MAC address filtering effective for Wi-Fi security?

MAC filtering provides only minimal security. While it creates a whitelist of allowed devices, an attacker can easily observe legitimate MAC addresses in wireless traffic (sent in plaintext) and spoof their own MAC to match. Always use WPA3/WPA2 encryption with a strong password as your primary defense.

What is MAC spoofing?

MAC spoofing is changing a device's MAC address to a different value through software. Legitimate uses include privacy protection, bypassing ISP restrictions (with authorization), and testing. Malicious uses include impersonating devices, man-in-the-middle attacks via ARP spoofing, and evading network bans.

What is EUI-64 and how does it relate to IPv6?

EUI-64 generates a 64-bit interface identifier for IPv6 from a 48-bit MAC address by splitting the MAC in half, inserting FF:FE in the middle, and flipping the 7th bit. The result is combined with the network prefix to form a full IPv6 address. Modern systems use random interface identifiers instead of EUI-64 for privacy reasons.