What Is a MAC Address?
Table of Contents
What a MAC Address Is
A MAC (Media Access Control) address is a 6-byte (48-bit) identifier assigned to every network interface. It is written as six pairs of hexadecimal digits separated by colons or hyphens: AA:BB:CC:DD:EE:FF. Every Ethernet port, WiFi adapter, and Bluetooth radio has one.
MAC addresses operate at Layer 2 of the networking stack. They are used to deliver frames within a single network segment - from one device to the next hop. IP addresses handle routing across networks; MAC addresses handle delivery on the local wire or wireless channel.
Unlike IP addresses, which are assigned by software and can change, MAC addresses are typically burned into the hardware by the manufacturer. They are sometimes called hardware addresses, physical addresses, or burned-in addresses (BIA) for this reason.
The Structure: OUI and Device ID
The 6 bytes of a MAC address are split into two halves:
First 3 bytes: OUI (Organizationally Unique Identifier) - assigned by the IEEE to the manufacturer. Apple, Intel, Samsung, Espressif, and every other hardware manufacturer each have their own OUI prefixes. The OUI tells you who made the network interface.
Last 3 bytes: Device Identifier - assigned by the manufacturer to each individual interface. This makes every MAC address globally unique (in theory - collisions are statistically possible but extremely rare).
For example, Espressif Systems (the company that makes the ESP32 chip used in the BLEShark Nano) has OUI prefixes including 24:0A:C4, 30:AE:A4, and AC:67:B2. Any WiFi or BLE device with a MAC starting with one of these is running an Espressif chip.
The first byte also contains two special bits. The least significant bit of the first byte indicates unicast (0) vs multicast (1). The second least significant bit indicates globally unique (0) vs locally administered (1). Randomized MAC addresses set the locally administered bit to indicate they are not manufacturer-assigned.
graph LR
subgraph "MAC Address Structure (6 bytes)"
OUI["First 3 bytes
OUI
(Manufacturer)"] --> DID["Last 3 bytes
Device ID
(Unique per device)"]
end
OUI -.->|"Example"| EX1["24:0A:C4 = Espressif"]
OUI -.->|"Example"| EX2["A4:83:E7 = Apple"]
OUI -.->|"Example"| EX3["00:1A:2B = Intel"]
How MAC Addresses Are Used in Frames
Every Ethernet frame begins with a destination MAC address (6 bytes) followed by a source MAC address (6 bytes). The switch uses the destination MAC to determine which port to forward the frame to. The source MAC is how the switch learns which device is on which port (building its MAC address table).
Special MAC addresses have reserved functions:
- FF:FF:FF:FF:FF:FF - broadcast. The frame is delivered to every device on the segment. Used by ARP, DHCP, and other protocols that need to reach all devices.
- 01:00:5E:xx:xx:xx - IPv4 multicast. Delivered to devices that have joined the corresponding multicast group.
- 33:33:xx:xx:xx:xx - IPv6 multicast.
A switch maintains a table mapping MAC addresses to physical ports. When it receives a frame, it checks the source MAC and records which port it arrived on. When it needs to forward a frame, it looks up the destination MAC in the table to find the correct output port. If the destination is unknown, the switch floods the frame out all ports except the one it arrived on.
MAC Addresses in WiFi
WiFi frames can contain up to four MAC addresses (compared to Ethernet's two) because wireless frames may be relayed through access points. The four address fields are:
- Receiver Address - the device that should process this frame on the radio link
- Transmitter Address - the device that transmitted this frame on the radio link
- Destination Address - the final intended recipient
- Source Address - the original sender
In infrastructure mode (the common setup with an access point), the receiver/transmitter addresses identify the AP, while the source/destination addresses identify the communicating clients. In ad-hoc mode, receiver equals destination and transmitter equals source.
Management frames (beacons, probe requests, deauthentication) also contain MAC addresses. A beacon frame's source address is the AP's MAC (the BSSID). A probe request's source address is the client's MAC - which is why probe requests are a privacy concern.
MAC Spoofing
Despite being "burned in," MAC addresses are trivially easy to change in software. Every major operating system allows it. On Linux, a single command changes the MAC of any interface. On Windows, it is a registry edit or adapter property change. On macOS, the ifconfig command handles it.
MAC spoofing has both legitimate and malicious uses:
- Privacy - changing your MAC prevents tracking across WiFi networks
- Bypassing MAC filters - networks that use MAC address whitelists as access control can be bypassed by spoofing an authorized device's MAC
- Impersonation - appearing as a different device on the network
- Evading bans - if a network has blocked your MAC, changing it gives you a fresh identity
MAC filtering (allowing only specific MACs to connect) is widely used but provides minimal security. It is a speed bump, not a barrier. An attacker who can observe the network's traffic can see which MAC addresses are authorized and spoof one.
MAC Randomization
Modern devices (iOS 14+, Android 10+, Windows 10+) randomize their MAC address when scanning for WiFi networks and when connecting to networks. This is a privacy measure to prevent stores, airports, and other venues from tracking device movement using the consistent MAC in probe requests.
Randomized MACs use the locally administered bit (the second bit of the first byte is set to 1), which distinguishes them from manufacturer-assigned MACs. The randomization happens per-network on most implementations - a device uses a consistent random MAC for a specific saved network but a different random MAC for each new network.
This has implications for network administration. MAC-based device identification and access control become unreliable when clients randomize. Enterprise networks increasingly rely on 802.1X certificate-based authentication instead of MAC filtering.
Why This Matters for Security
MAC addresses are the primary identifiers the BLEShark Nano works with during WiFi and BLE scanning. When the Nano runs a WiFi scan, it reports the MAC address (BSSID) of every access point and the MAC of every client it observes. When it runs a BLE scan, it reports the MAC address in each BLE advertisement.
The OUI lookup is one of the first things a security researcher does with captured MACs. Knowing the manufacturer narrows down what type of device you are looking at. An Espressif OUI suggests an IoT device or development board. An Apple OUI suggests an iPhone, iPad, or Mac. An Intel OUI suggests a laptop. This information feeds into the network inventory that informs the rest of an assessment.