MAClens

MAC address lookup

What is a MAC address and what is it used for?

A MAC address is the identity number of a network interface: the Ethernet card, the Wi-Fi chip or the Bluetooth module of a device. Its job is to deliver data to the right machine inside a single local network.

Six bytes, nothing more

A MAC address is 48 bits long — six bytes written in hexadecimal: 28:6F:B9:12:34:56. Separators vary between vendors and operating systems: colons, hyphens (28-6F-B9-12-34-56) or Cisco-style groups of four digits (286f.b912.3456). All three are the same value written differently.

The first three bytes identify the organisation that obtained the block from the IEEE; the last three are assigned freely by that organisation to each of its interfaces. That split is what makes it possible to find a vendor from an address.

What it actually does

On a local network, every Ethernet or Wi-Fi frame carries two MAC addresses: the sender’s and the recipient’s. A switch reads the destination address and forwards the frame only to the port where that device sits. Without MAC addresses, every message would have to be flooded to everyone.

The same address appears in DHCP leases (to always reserve the same IP address for a device), in Wi-Fi access filters, in asset inventories and in most network equipment logs.

MAC address and IP address: two different jobs

An IP address is what crosses the Internet: it changes when the device joins another network, and routers use it to forward packets hop by hop. A MAC address only travels across one network segment: at each hop the router replaces the frame’s MAC addresses, while the IP addresses stay the same from source to destination.

In other words, the IP address says “where to go”, the MAC address says “which machine to hand the message to, here and now”. ARP links the two in IPv4, and neighbour discovery does it in IPv6.

Is it really unique and permanent?

In theory a factory-burned address is unique worldwide, because each vendor only hands out numbers taken from the block reserved for it. In practice an address can be changed in software, randomised by a phone, or invented by virtualisation software.

A MAC address is therefore a reliable clue about hardware, but not proof of identity: it can be copied or changed. The details are in the local addresses and privacy page.

Two bits that change everything

The first byte carries two flags defined by the IEEE 802 standard. The least significant bit says whether the address targets a single device (unicast) or a group (multicast). The next bit says whether the address was assigned by a vendor or set locally.

MAClens reads both bits for you and translates them into plain language: enter an address to see the result.

Read next