MAC addresses

Ethernet began as a memo. On 22 May 1973, in twelve pages written at Xerox PARC, Robert Metcalfe named the concept "The Ether Network" — after the luminiferous aether that nineteenth-century physics supposed carried electromagnetic waves, a name chosen to stress that the scheme could run over any medium at all. The network he and David Boggs built between Alto computers first ran on 11 November 1973, at 2.94 Mbit/s.

Commercialisation fixed the address format. Metcalfe, Gordon Bell and David Liddle argued for standardising Ethernet rather than keeping it a Xerox product, and brought Digital Equipment Corporation and Intel together with Xerox on a common specification: the DIX standard, published on 30 September 1980 as the Ethernet Blue Book, with version 2 following in November 1982. The 48-bit address it carried was wide enough that every interface ever manufactured could be given a unique number at the factory, with no configuration step and no server to consult at boot — and it was adopted wholesale by the later IEEE 802 standards, Wi-Fi included, as well as by FDDI. IEEE Project 802 formed an 802.3 subcommittee in June 1981, approved its CSMA/CD standard in December 1982, and published it as a standard in 1985.

Two bits of the first octet carry flags rather than identity. The least significant distinguishes an individual address from a group, or multicast, one. The next marks the address as locally administered — assigned by software or by an administrator, overriding whatever was burned into the hardware. That bit is what makes a page like this one safe to use.

Two widely repeated claims deserve qualifying. A MAC address is not fixed: many interfaces allow it to be changed, and operating systems now change it routinely for privacy. And the first three octets do not always identify one manufacturer. Alongside the 24-bit blocks it issues outright, the IEEE Registration Authority runs smaller registries that append extra IEEE-supplied bits to a prefix it keeps for itself, so that one 24-bit value is divided among many holders — 00:50:C2 was used this way from 2007 until September 2012, and 40:D8:55 after it.

Key properties

• An EUI-48 address, which is what "MAC address" normally means, is 48 bits written as six hexadecimal octets, giving 2^48 = 281,474,976,710,656 possible values.
• The least significant bit of the first octet is the I/G bit: 0 for an individual (unicast) address, 1 for a group (multicast) one. The broadcast address ff:ff:ff:ff:ff:ff has every bit set, that one included, so broadcast is a special case of multicast.
• The second-least-significant bit of the first octet is the U/L bit: when it is set the address is locally administered rather than an IEEE assignment. In 06-00-00-00-00-00 the first octet is binary 00000110, so that bit is 1.
• A locally administered unicast address therefore always has 2, 6, A or E as its second hex digit, and a locally administered group address has 3, 7, B or F.
• Only 2^46 = 70,368,744,177,664 of the 2^48 addresses are universally administered unicast addresses, since both flag bits must be clear.
• The IEEE 802 format for printing an EUI-48 is six groups of two hexadecimal digits separated by hyphens, in transmission order; six groups separated by colons, and three groups of four separated by dots, are the other common conventions.
• IPv6 stateless address autoconfiguration derives a 64-bit interface identifier from a MAC address by inserting the octets 0xFF and 0xFE in the middle and inverting the U/L bit, per RFC 4291 Appendix A — in the modified EUI-64 that results, a set bit means universally unique, the opposite sense to an EUI-48.
• Multicast MAC addresses are mapped down from the network layer: RFC 1112 places the low 23 bits of an IPv4 multicast group into 01-00-5E-00-00-00, and RFC 2464 prefixes 3333 hexadecimal to the last four octets of an IPv6 multicast address.

Where they turn up

• A switch learns which port each MAC address sits behind; when it does not know the port for a destination it forwards the frame to every other port instead, an action known as a unicast flood.
• Wake-on-LAN uses a "magic packet" — a frame carrying six 0xFF bytes followed by sixteen repetitions of the target’s 48-bit MAC address, 102 bytes in all — which the network interface watches for while the rest of the machine is powered down.
• Apple began randomising the address iOS devices present while scanning for networks, and the practice spread: Android from version 6.0, Windows 10, Linux 3.18, with per-network locally administered addresses arriving in iOS 14 and Android 10. Edward Snowden’s disclosure of an NSA system that tracked devices around a city by their MAC addresses is the usually cited motivation.
• A randomised MAC address is recognisable precisely because the locally administered bit is set — the same bit this page sets.
• Hypervisors manage dynamic MAC addresses inside their own registered OUI, and administrators often prefer to assign one from the locally administered range instead, exactly to keep it clear of vendor space.
• Captive portals and network access control allow or block devices by MAC. Since many interfaces let software change the address, this is a convenience mechanism rather than a security control.