How is a MAC address structured?

A MAC address (Media Access Control) is a unique 48-bit network interface identifier, used at the data link layer (L2) in Ethernet and Wi-Fi.

Its structure is strictly defined by the IEEE 802 standard.

---

#The structure of a MAC address

A MAC address consists of 6 bytes (48 bits) and is divided into two logical parts:

Example MAC address:

00:1A:2B:3C:4D:5E

• 00:1A:2B: the OUI, indicating the manufacturer
• 3C:4D:5E: the unique network card number

---

#1. OUI: the first 3 bytes (24 bits)

This is an organization identifier, issued by IEEE as the manufacturer's prefix.

Examples of OUIs of well-known companies:

• Cisco: 00:1A:A2
• Intel: 00:1B:21
• Apple: F0:18:98
• Xiaomi: 70:11:24

The OUI lets you determine:

• who made the network card,
• which manufacturer produces this line of devices.

---

#2. The unique device identifier: the last 3 bytes (24 bits)

These 24 bits are assigned by the manufacturer and must be unique for every interface within its OUI range. This ensures the uniqueness of all MAC addresses in the world.

---

#A MAC address at the bit level: important flags

The first byte of a MAC address has two important bits:

#1. I/G (Individual/Group): determines the address type

• 0 = Unicast address (individual)
• 1 = Multicast address

For example:

• 01:00:5E:xx:xx:xx: IPv4 multicast
• FF:FF:FF:FF:FF:FF: broadcast (all bits = 1)

---

#2. U/L (Universal/Local): determines whether it is "factory" or "locally assigned"

• 0 = globally unique (universal) → assigned by the manufacturer
• 1 = locally assigned (locally administered) → set by the user or the system

Example of a locally assigned MAC:

---

#A full example of parsing a MAC address

Let's take the address:

3C:5A:B4:7E:12:90

Breaking it down:

• OUI: 3C:5A:B4 → belongs to Apple (example)
• NIC: 7E:12:90 → unique number
• First byte: 3C = 00111100₂
  • I/G = 0 → unicast
  • U/L = 0 → factory-set, globally unique

---

#Features of MAC addresses

#Unique within an L2 segment

Two machines with the same MAC on one network: a conflict.

#Built into the network interface (but can be changed)

Systems allow MAC spoofing:

• Linux: ip link set dev eth0 address …
• Windows: through adapter properties
• MacOS: through ifconfig

#Used by switches

A switch creates a MAC table to send frames to the correct port.

#Used by ARP to link IP ↔ MAC

IP → ARP → MAC → Ethernet frame.