MAC addresses are 48-bit identifiers assigned to network interfaces, typically represented as 6 octets (bytes) in hexadecimal. Understanding their structure is crucial for proper network configuration.
MAC Address Structure:
- Total length: 48 bits (6 bytes, 12 hex digits)
- First 24 bits (3 bytes): OUI (Organizationally Unique Identifier) - vendor/manufacturer
- Last 24 bits (3 bytes): NIC-specific identifier assigned by manufacturer
- Format examples:
- IEEE standard: 01:23:45:67:89:AB (colon-separated)
- Windows: 01-23-45-67-89-AB (hyphen-separated)
- Cisco: 0123.4567.89AB (dot-separated pairs)
- Raw: 0123456789AB (no separators)
First Octet Bits (Control Bits):
- Bit 0 (LSB of first octet): Unicast/Multicast (I/G bit)
- 0 = Unicast (individual device) - most common
- 1 = Multicast (group of devices)
- Example: 02:xx:xx:xx:xx:xx is unicast, 03:xx:xx:xx:xx:xx is multicast
- Bit 1 (second LSB): Universal/Local (U/L bit)
- 0 = Universally administered (assigned by manufacturer)
- 1 = Locally administered (set by network admin)
- Example: 00:xx:xx:xx:xx:xx is universal, 02:xx:xx:xx:xx:xx is local
OUI (Organizationally Unique Identifier):
- First 24 bits (3 octets) assigned by IEEE to manufacturers
- Example OUIs:
- 00:1A:2B - Cisco Systems
- 00:50:56 - VMware
- 08:00:27 - VirtualBox
- 52:54:00 - QEMU/KVM
- 00:15:5D - Microsoft Hyper-V
- Manufacturers must purchase OUI assignments from IEEE
Special MAC Addresses:
- Broadcast: FF:FF:FF:FF:FF:FF (all devices on local network)
- IPv4 multicast: 01:00:5E:xx:xx:xx (IANA range)
- IPv6 multicast: 33:33:xx:xx:xx:xx
- Cisco Discovery Protocol: 01:00:0C:CC:CC:CC
- Spanning Tree: 01:80:C2:00:00:00
Unicast vs Multicast:
- Unicast: Packet sent to single network interface
- First octet is even (02, 04, 06, etc.)
- Used for standard device-to-device communication
- Multicast: Packet sent to group of devices
- First octet is odd (01, 03, 05, etc.)
- Used for protocols like IGMP, mDNS, VRRP
Locally Administered Addresses:
- Used when you don't have a manufacturer-assigned OUI
- Common in virtual environments (VMs, containers)
- First octet examples: 02, 06, 0A, 0E (bit 1 set, bit 0 clear)
- Safe to use for testing without conflicting with real hardware
Virtual Machine MAC Addresses:
- VMware: Typically starts with 00:50:56 or 00:0C:29
- VirtualBox: 08:00:27:xx:xx:xx
- QEMU/KVM: 52:54:00:xx:xx:xx
- Hyper-V: 00:15:5D:xx:xx:xx
- Last 3 octets usually randomized per VM
MAC Address Collision:
- Occurs when two devices on same network have identical MAC addresses
- Can cause intermittent connectivity issues
- Common in cloned VMs or improperly configured containers
- Prevention: Always generate unique MACs for each VM/interface
IEEE Standards:
- IEEE 802: Family of LAN/MAN standards
- EUI-48: Extended Unique Identifier (48-bit), modern term for MAC-48
- EUI-64: 64-bit version used in IPv6 SLAAC and Fibre Channel
- IEEE Registration Authority: Manages OUI assignments
Best Practices:
- Always use unicast addresses for standard network interfaces
- Use locally administered bit when generating test addresses
- Avoid broadcast and well-known multicast addresses
- Keep records of generated MACs for VM management
- Use vendor OUI when simulating specific hardware
- Ensure uniqueness within your network environment
Common Errors to Avoid:
- Using multicast addresses (odd first octet) for NICs
- Reusing MACs across multiple VMs (causes conflicts)
- Using broadcast MAC (FF:FF:FF:FF:FF:FF) as interface address
- Forgetting to set locally administered bit for non-vendor MACs