Overview
Different OSI layers use different kinds of addresses to deliver data to the right place. Confusing these address types is a classic beginner error. This lesson clarifies which address lives at which layer and what each is for.
Learning objectives
- Identify the addressing used at the Data Link, Network, and Transport layers.
- Explain the difference between physical and logical addresses.
- Understand how the address types work together to deliver data.
Core concept
Three address types operate at three layers:
- Layer 2 (Data Link): MAC address — a hardware ("physical") address burned into a network interface, used for delivery within a local network segment. Example format:
00:1A:2B:3C:4D:5E. - Layer 3 (Network): IP address — a logical address used to route data across networks, end to end. Example:
192.168.1.10. - Layer 4 (Transport): port number — identifies the specific service/application on a host. Example:
443.
How it works
The three cooperate. The IP address determines the ultimate destination host across the internet (routing, Layer 3). At each hop, the MAC address delivers the frame to the next device on the local link (Layer 2). Once data reaches the destination host, the port hands it to the correct application (Layer 4). A helpful analogy: IP is the destination city and street, MAC is the specific handoff between local postal workers at each stage, and the port is the recipient's name at the address.
Practical example
You connect to a web server at 203.0.113.5:443. Your packet's IP destination is 203.0.113.5 (stays the same across the whole journey), guiding routers toward it. But the MAC address changes at every hop — first your router's MAC, then the next device's — because MAC only matters for the current local link. When the packet arrives, port 443 directs it to the web service. Three addresses, three jobs, working together.
Cybersecurity relevance
Address types matter in attacks and defenses: MAC addresses feature in local-network (Layer 2) attacks like ARP spoofing; IP addresses are used in filtering, geolocation, and access control; ports define exposed services. Reading a packet capture requires knowing which address is which.
Common mistakes
- Thinking MAC addresses route across the internet — they only deliver within a local segment; IP handles cross-network routing.
- Confusing IP (which host) with port (which service on it).
- Assuming the destination MAC stays constant — it changes at each hop while the destination IP does not.
Key takeaways
- MAC (L2) delivers within a local segment; IP (L3) routes end to end across networks; port (L4) identifies the application.
- MAC is a physical hardware address; IP is a logical, routable address.
- The destination IP stays fixed across the journey while the MAC changes at each hop.
Check your understanding
- Which address type changes at every hop, and which stays the same end to end?
- Match each to its job: MAC, IP, port → local delivery, application identification, cross-network routing.