MAC Addresses

The hardware-level identifier

Every network interface (Ethernet port, Wi-Fi radio) has a MAC address (Media Access Control). It's a 48-bit identifier in hex, written like aa:bb:cc:dd:ee:ff. While IP addresses live at the network layer (Layer 3) and can change as you move between networks, the MAC lives at the data link layer (Layer 2) and is generally burned into the hardware at the factory.

Anatomy of a MAC

A MAC has two halves:

First 3 bytes — OUI (Organizationally Unique Identifier). Assigned to the manufacturer. a4:83:e7 = Apple, 00:50:56 = VMware, b8:27:eb = Raspberry Pi Foundation. You can look up an OUI to identify an unknown device on your LAN.
Last 3 bytes — Unique to the specific device.

ARP — bridging IP and MAC

ARP (Address Resolution Protocol) is how your machine learns the MAC for a given IP on the local subnet. When your laptop wants to send a packet to 192.168.1.1 (the gateway), it broadcasts "Who has 192.168.1.1?" to every device on the LAN. The owner replies with its MAC. Your laptop caches that mapping in the ARP table for next time.

Crucially, ARP only works within a subnet. To reach an IP off your LAN, your machine ARPs for the gateway's MAC and hands the packet to the gateway — which then routes it onward. Beyond your gateway, you never see foreign MACs.

# Your interface's MAC (macOS Wi-Fi) ifconfig en0 | grep ether # Linux ip link show # ARP table — every IP↔MAC mapping the kernel currently knows arp -a # Force ARP to populate by pinging ping -c 1 192.168.1.1 arp -a | grep 192.168.1.1

Exercise

Run arp -a and walk down the list. For each MAC, identify the manufacturer using the OUI lookup link above. You should be able to tell which devices are Apple, which are your router, which are IoT junk. This is the same exercise you'd do if a strange MAC showed up — being able to recognize "normal" is the first step to spotting "weird."

The hardware-level identifier

Anatomy of a MAC

ARP — bridging IP and MAC

Code

External links

Exercise

Progress

Comments 0