What is a MAC Address?

A MAC address (Media Access Control address) is a permanent hardware identifier assigned to the network interface of every device capable of connecting to a network. Every Wi-Fi adapter, Ethernet port, and Bluetooth radio has its own MAC address, set during manufacturing and stored in the adapter’s firmware. While IP addresses handle communication across the internet, MAC addresses handle communication on the local network segment.

When your laptop sends data to your printer across the home Wi-Fi, the data packets carry MAC addresses to ensure they reach the right hardware. Your router uses MAC addresses internally to direct traffic to the correct device, even though IP addresses are what you see in network settings.

MAC Address Format

A MAC address follows a standardized format: six groups of two hexadecimal digits, separated by colons or hyphens. A typical MAC address looks like 00:1A:2B:3C:4D:5E or 00-1A-2B-3C-4D-5E. Some systems display it without separators: 001A2B3C4D5E.

The total length is 48 bits (6 bytes), providing a theoretical pool of over 281 trillion unique addresses. In practice, some of that space is reserved for special purposes like broadcast and multicast addresses.

The first three bytes (24 bits) are the OUI (Organizationally Unique Identifier). This portion identifies the manufacturer. For example, MAC addresses starting with 00:1A:2B belong to a specific vendor. The last three bytes (24 bits) are the NIC-specific portion, a serial number unique to that particular adapter.

The first byte contains two special bits. The least significant bit determines whether the address is unicast (0) or multicast (1). The second least significant bit indicates whether the address is globally unique, as assigned by the manufacturer (0), or locally administered, as set by software (1). A standard hardware MAC address has both bits set to 0.

The broadcast MAC address is FF:FF:FF:FF:FF:FF. Packets sent to this address are delivered to every device on the local network. Your router uses this broadcast address during ARP (Address Resolution Protocol) operations and DHCP discovery.

How to Find Your MAC Address

Finding your MAC address takes a few seconds on any operating system. The process varies slightly by platform.

Windows. Open Command Prompt and type ipconfig /all. Look for “Physical Address” under your active network adapter (Wi-Fi or Ethernet). Alternatively, open Settings, go to Network and Internet, select your connection, and look for Physical address (MAC).

macOS. Open Terminal and type ifconfig en0 for Wi-Fi or ifconfig en1 for Ethernet. The MAC address is listed on the “ether” line. You can also find it in System Settings under Network by selecting your active connection and viewing hardware details.

Linux. Open Terminal and type ip link show or ifconfig. The MAC address appears next to “link/ether” or “ether” for each interface.

iPhone. Open Settings, tap General, tap About, and look for “Wi-Fi Address.” Note that iOS uses private (randomized) MAC addresses by default on each network. The address shown in About is the device’s actual hardware MAC.

Android. Open Settings, tap About Phone, tap Status (or Network), and look for “Wi-Fi MAC address.” Like iOS, modern Android versions randomize the MAC address per network by default.

Your router’s admin panel also lists the MAC addresses of all connected devices. Log in to your default gateway (usually 192.168.1.1) and check the DHCP client list or connected devices section.

MAC Filtering

MAC filtering is a router feature that restricts network access based on MAC addresses. You create a whitelist (allow list) of approved MAC addresses, and the router only permits those devices to connect. Any device with a MAC address not on the list is denied access.

Setting up MAC filtering involves logging into your router’s admin panel, navigating to the wireless security or access control section, enabling MAC filtering, and entering the MAC addresses of all devices you want to allow. Some routers also support a blacklist mode that blocks specific MAC addresses while allowing all others.

The appeal of MAC filtering is straightforward: only your approved devices can join the network. In practice, the security benefit is minimal. MAC addresses are transmitted in plain text in every Wi-Fi frame. An attacker with a packet sniffer (freely available tools like Wireshark) can see every MAC address communicating on the network within seconds. They can then clone an approved MAC address onto their own device and bypass the filter entirely.

MAC filtering is better thought of as a casual access control measure rather than a security feature. It stops neighbours and guests from casually connecting if they know your Wi-Fi password, but it does not stop anyone with basic networking knowledge. Strong WPA3 or WPA2 encryption with a long, random password provides far better security than MAC filtering.

MAC Spoofing

MAC spoofing is the practice of changing a device’s reported MAC address to a different value. The physical hardware address remains unchanged, but the operating system sends the spoofed address in all network communications.

Legitimate uses of MAC spoofing include:

• Privacy. Randomizing your MAC address prevents stores, airports, and other venues from tracking your device across visits by recognizing its hardware address. Apple, Google, and Android have built MAC randomization into their operating systems for this reason.
• Network migration. When replacing a network adapter or router, spoofing the old MAC address can avoid needing to reconfigure DHCP reservations or access control lists.
• ISP requirements. Some ISPs register the MAC address of the first device connected and require you to call support to register a new one. Spoofing the old MAC on new hardware avoids the call.

MAC spoofing is also used maliciously. Attackers clone the MAC address of a trusted device to bypass MAC filtering, impersonate a device to intercept its traffic (ARP spoofing), or evade network bans based on MAC address.

On most operating systems, changing the MAC address is straightforward. Windows offers it through the adapter properties in Device Manager. macOS and Linux use command-line tools like ifconfig or ip link set. The change reverts when you restart the adapter unless configured to persist.

OUI Lookup

The OUI (Organizationally Unique Identifier) is the first three bytes of a MAC address, and it identifies the manufacturer of the network interface. The IEEE (Institute of Electrical and Electronics Engineers) maintains the public registry of OUI assignments.

Looking up an OUI tells you which company manufactured the network adapter. If you see a device connected to your router with MAC address DC:A6:32:xx:xx:xx, an OUI lookup reveals it is a Raspberry Pi Foundation device. An address starting with F0:18:98 belongs to Apple. One starting with B4:B5:2F belongs to a Hewlett Packard enterprise device.

OUI lookups are useful for identifying unknown devices on your network. When you check your router’s connected device list and see an unfamiliar entry, looking up its OUI narrows down what type of device it is. Smart home devices, IoT sensors, and guest devices that report unhelpful hostnames can often be identified by their manufacturer through the OUI.

Free OUI lookup tools are available online and through command-line utilities. The IEEE’s official database is publicly searchable. On macOS and Linux, the arp -a command lists MAC addresses of devices on your network, and tools like nmap can perform OUI resolution automatically.

Note that MAC randomization (used by modern phones and laptops for privacy) generates OUIs that do not correspond to real manufacturers, so OUI lookup will not identify these devices correctly. The randomly generated addresses use the locally administered bit to indicate they are not from a real manufacturer assignment.