Networking Toolbox

A MAC (Media Access Control) address is a unique 48-bit (6-byte) identifier assigned to network interface controllers (NICs) for communications on the physical network segment. It operates at Layer 2 (Data Link Layer) of the OSI model and is typically displayed as six groups of two hexadecimal digits (e.g., 00:1A:2B:3C:4D:5E).

• OUI (Organizationally Unique Identifier): First 24 bits (3 bytes) assigned by IEEE to manufacturers. Identifies who made the network interface.
• NIC Specific (Device ID): Last 24 bits (3 bytes) assigned by the manufacturer to uniquely identify the specific device.
• I/G bit (Individual/Group): Bit 0 of first octet: 0 = Unicast (single destination), 1 = Multicast/Broadcast (multiple destinations).
• U/L bit (Universal/Local): Bit 1 of first octet: 0 = Universally administered (manufacturer-assigned), 1 = Locally administered (software-assigned).

Example: 3C:22:FB:A1:B2:C3
• OUI: 3C:22:FB (Apple, Inc.)
• Device ID: A1:B2:C3
• First octet binary: 00111100 (I/G=0, U/L=0) → Universal Unicast

• Universal Unicast: Standard manufacturer-assigned addresses. Most common type for physical network cards.
• Locally Administered Unicast: Software-assigned addresses used in virtual machines, VPNs, and software-defined networking. Second hex digit is 2, 3, 6, 7, A, B, E, or F.
• Multicast: Used for one-to-many communication. First octet has LSB set to 1 (e.g., 01:00:5E:xx:xx:xx for IPv4 multicast).
• Broadcast: FF:FF:FF:FF:FF:FF - Reaches all devices on the local network segment.

• Colon notation: 00:1A:2B:3C:4D:5E - Standard on Linux, BSD, macOS
• Hyphen notation: 00-1A-2B-3C-4D-5E - Common on Windows systems
• Cisco/Dot notation: 001A.2B3C.4D5E - Used in Cisco IOS and NX-OS
• Bare format: 001A2B3C4D5E - Common in databases and APIs
• EUI-64: 02:1A:2B:FF:FE:3C:4D:5E - Extended format used for IPv6 interface IDs (inserts FFFE and flips U/L bit)

The IEEE Registration Authority manages OUI assignments. There are different block sizes:

• MA-L (Large): 24-bit prefix, provides 16,777,216 addresses. Standard OUI assignment for large manufacturers.
• MA-M (Medium): 28-bit prefix, provides 1,048,576 addresses. For medium-sized organizations.
• MA-S (Small): 36-bit prefix, provides 4,096 addresses. For smaller organizations or specific products.
• CID (Company ID): Special identifier for company-specific uses.

OUI lookups query the IEEE database to identify the manufacturer and registration details associated with a given MAC address prefix.

• Broadcast: FF:FF:FF:FF:FF:FF - All devices on local segment
• IPv4 Multicast: 01:00:5E:xx:xx:xx - Maps to IPv4 multicast addresses (224.0.0.0/4)
• IPv6 Multicast: 33:33:xx:xx:xx:xx - Maps to IPv6 multicast addresses (FF00::/8)
• IANA Reserved: 00:00:5E:xx:xx:xx - IANA-managed reserved addresses
• Link-local: Various - Vendor-specific link-local addresses for protocols like LLDP, STP, VRRP
• Privacy MAC: xx:x2-F:xx:xx:xx:xx - Randomized addresses (U/L bit set) used by modern devices to prevent tracking

• Network Troubleshooting: Identify devices on the network, track down rogue devices, or diagnose connectivity issues
• Security and Access Control: MAC filtering for wireless networks, port security on switches, device whitelisting
• Asset Management: Inventory network devices by manufacturer, track hardware deployments
• Virtualization: Assign locally administered MACs to virtual machines and containers
• Format Conversion: Convert between different notations for different systems and tools
• Privacy Analysis: Identify if devices are using randomized MACs for privacy protection

• MAC addresses are only unique within a local network segment; routing between networks uses IP addresses
• The second character of a MAC address reveals important info: Even = Universal, Odd = Multicast, 2/3/6/7/A/B/E/F = Locally administered
• Virtual machines and modern smartphones often use locally administered (randomized) MACs for privacy
• Not all 48-bit combinations are valid - some ranges are reserved for special purposes
• MAC spoofing can change a device's MAC address in software, but doesn't change the hardware address
• For IPv6 SLAAC, MAC addresses are converted to EUI-64 by inserting FFFE in the middle and flipping the U/L bit