Overview
A MAC (Media Access Control) address is the hardware address that identifies a network interface on a local network. It is the Layer 2 counterpart to the Layer 3 IP address. This lesson explains what MAC addresses are, how they are structured, and their security implications.
Learning objectives
- Define a MAC address and its format.
- Distinguish MAC addresses from IP addresses.
- Understand MAC address uniqueness and its limits.
Core concept
A MAC address is a 48-bit identifier usually written as six pairs of hexadecimal digits, e.g. 00:1A:2B:3C:4D:5E. It is assigned to a network interface (like a Wi-Fi or Ethernet adapter), typically by the manufacturer. The first half often identifies the manufacturer (the OUI, Organizationally Unique Identifier), and the second half is unique to the device.
MAC addresses are meant to be globally unique per interface, but they can be changed in software ("MAC spoofing"), so they are not a trustworthy identity on their own.
How it works
MAC addresses enable delivery within a local segment (Layer 2). Whereas IP addresses are logical and route across networks, MAC addresses are physical/hardware addresses that matter only on the local link. A device compares a frame's destination MAC to its own; if they match (or it is a broadcast), it processes the frame. The mapping between a host's IP and its MAC is discovered by ARP (next lessons).
Practical example
Two laptops on the same Wi-Fi communicate using each other's MAC addresses at Layer 2. But when either talks to a server on the internet, it uses the router's MAC locally while the destination IP remains the far server. Checking your device's network settings, you can see its MAC address (per interface) alongside its IP — two different addresses for two different layers and purposes.
Cybersecurity relevance
Because MAC addresses can be spoofed, controls that rely on them (like MAC-based access filtering) are weak on their own. MAC addresses also enable device tracking, which is why modern phones use MAC randomization on Wi-Fi to protect privacy. And MAC spoofing is a component of local attacks like ARP poisoning.
Common mistakes
- Trusting a MAC address as a firm identity — it is easily spoofed in software.
- Confusing MAC (local, hardware, L2) with IP (routable, logical, L3).
- Relying on MAC filtering as strong security — it deters casual access at best.
Key takeaways
- A MAC address is a 48-bit hardware identifier for a network interface, used for local (Layer 2) delivery.
- It differs from an IP address: MAC is physical and local; IP is logical and routable.
- MAC addresses can be spoofed, so they are not a reliable identity and MAC-based controls are weak.
Check your understanding
- Give two differences between a MAC address and an IP address.
- Why is MAC-address filtering considered weak security?