MAC Address Technical Blog
· Jondy
For twenty years, enterprise Network Access Control (NAC) quietly rested on one unwritten premise: a device's MAC addres…
MAC randomisation
NAC
Captive Portal
DHCP exhaustion
RFC 9797
IEEE 802.11bh
Passpoint
OpenRoaming
zero trust
Persistent-Device-Id
· Jondy
On premises, the story is straightforward: VMware uses 00:50:56, Hyper-V 00:15:5D, Xen 00:16:3E, and a lookup on the que…
AWS EC2
Azure VM
GCP Compute Engine
ENI
Nitro
IMDS
VirtIO
gVNIC
OUI
cloud MAC
cloud snapshot
· Jondy
In a design review or a procurement meeting, you will almost certainly hear this line: "A MAC address is just a hardware…
MAC address
GDPR
personal data
identifiability
pseudonymisation
CJEU
ICO
online identifier
data minimisation
log retention
· Jondy
In the enterprise, a MAC address is almost the whole of layer 2: switches build their forwarding tables from it, flood u…
VXLAN
EVPN
VTEP
MAC-in-UDP
BGP EVPN
MAC/IP advertisement route
route type 2
MAC mobility
VNI
BUM
flood and learn
· Jondy
MACsec (IEEE 802.1AE) is the Ethernet link-layer encryption standard. Enterprise deployment has accelerated noticeably i…
MACsec
802.1AE
SecTAG
SCI
MKA
EAPOL
CAK
SAK
ARP spoofing
link-layer encryption
MAC address
· Jondy
The headline feature of Wi-Fi 7 (IEEE 802.11be) is Multi-Link Operation (MLO). Marketing says it lets one device use 2.4…
Wi-Fi 7
802.11be
MLO
MLD MAC
per-link MAC
eMLSR
STR
Multi-Link Element
ARP
DHCP
· Jondy
MAC randomization has been the most important client-side privacy defense in mobile networking over the past decade. iOS…
MAC randomization
machine learning
DBSCAN
Probe Request
HT Capabilities
IFAT
RSSI
Wi-Fi privacy
de-randomization
· Jondy
Over the past few years Apple has pushed client-side MAC randomization aggressively: random probe requests since iOS 8, …
macOS 27
local interface MAC
02:00:00:00:00:00
topology-observation
restricted entitlement
AVB
ATDECC
sysctl
privacy hardening
· Kai
A log message says MACFLAP, MAC move, or that one MAC address is moving between two ports. It is natural to think “Layer…
MAC address flapping
MAC move
switch
Layer 2 loop
EtherChannel
wireless roaming
troubleshooting
· Lin
Capture traffic on a switch uplink and Wireshark suddenly adds a line called 802.1Q Virtual LAN. The obvious question is…
802.1Q
VLAN tag
packet capture
Wireshark
TPID
PCP
VID
Ethernet frame
· Kai
This mismatch comes up on a support shift: the controller says a phone is associated and authenticated, and the gateway …
Wi-Fi client
MAC address table
access point
wireless controller
tunnel forwarding
local bridging
troubleshooting
· Lin
The first time you inspect a Wi-Fi capture in monitor mode, it is tempting to read Address 1 as the destination and Addr…
802.11
Wi-Fi capture
MAC addresses
To DS
From DS
BSSID
Wireshark
· Jondy
For two decades, enterprise network access control operated on an unspoken assumption: a device's MAC address does not c…
MAC randomization
NAC
RADIUS
Persistent-Device-Id
802.1X
MAB
device identity
GUID
· Jondy
After upgrading to iOS 18, the toggle labeled "Private Wi-Fi Address" in Wi-Fi settings got renamed, and three options a…
iOS 18
MAC randomization
private Wi-Fi address
rotating Wi-Fi address
locally administered address
iPhone privacy
· Kai
You enter a MAC address and get "not found", or the vendor that comes back bears no relation to the device in your hand.…
lookup failed
no vendor found
locally administered address
unassigned OUI
contract manufacturer
stale data
· Jondy
A MAC address looks like an ideal asset identifier: globally unique, independent of IP changes, and collectable without …
asset inventory
device register
MAC address
CMDB
auto discovery
LLDP
vendor identification
· Kai
Every virtual adapter in a virtualised environment needs a MAC address. Each platform uses its own registered OUI prefix…
virtual machine MAC
VMware
KVM
VirtualBox
Hyper-V
Docker
container networking
bridge
· Kai
Bluetooth devices also carry a 48-bit address in exactly the same format as a WiFi MAC, with the first 24 bits again an …
Bluetooth address
BD_ADDR
WiFi MAC
BLE
random address
resolvable private address
device tracking
· Kai
Filtering by MAC address is the most common layer 2 troubleshooting operation. Wireshark has two syntaxes that are easy …
Wireshark
tcpdump
MAC filter
display filter
capture filter
BPF
packet analysis
· Kai
A MAC address is burned into the adapter at manufacture, but drivers accept a software-supplied value, so it can be chan…
change MAC address
MAC spoofing
ip link
networksetup
registry
locally administered address
· Kai
An unfamiliar MAC address in a log, or a need to find which machine is saturating a link, both come down to tracing a MA…
locate device
MAC address
arp-scan
nmap
switch port
CAM table
network troubleshooting
· Kai
Two identical MAC addresses in one broadcast domain do not cause a clean outage. They cause intermittent failures that l…
duplicate MAC
MAC conflict
intermittent connectivity
MAC flapping
VM cloning
troubleshooting
· Jondy
ARP does not verify where a reply came from, and that design gap makes a local man-in-the-middle attack cheap enough to …
ARP spoofing
ARP poisoning
man in the middle
dynamic ARP inspection
port security
· Jondy
A MAC address contains no name and looks like nothing more than a string of hex digits. Yet for a long time it was a glo…
MAC address privacy
device tracking
WiFi probe
GDPR
personal data
footfall analytics
privacy protection
· Jondy
A decade ago a phone's WiFi adapter exposed the same MAC address everywhere it went. A shopping centre only had to scatt…
MAC randomisation
WiFi privacy
private address
iOS
Android
Windows
device tracking
· Jondy
Many router interfaces file MAC address filtering under a menu called Security, and that placement is misleading. What M…
MAC filtering
WiFi security
whitelist
WPA3
wireless security
address spoofing
· Jondy
802.1X is the IEEE standard for port-level access control: until a device authenticates, the switch port forwards no use…
802.1X
MAB
MAC authentication bypass
EAP
RADIUS
network access control
port authentication
· Lin
When DHCP leases an IP address to a client it needs an identifier to tell clients apart, so that a renewal returns the s…
DHCP
MAC address
static binding
address reservation
lease
client identifier
DHCP snooping
· Lin
To deliver a frame to a host on the same local network you need its MAC address, but the application layer usually hands…
ARP
address resolution protocol
ARP cache
gratuitous ARP
proxy ARP
broadcast
· Lin
What separates a switch from a hub is that it knows which port a frame should leave by, and that knowledge lives in a dy…
MAC address table
CAM table
switch
flooding
address learning
ageing time
MAC flooding attack
· Lin
IPv6 stateless address autoconfiguration originally derived its interface identifier from the MAC address. That design c…
EUI-64
IPv6
SLAAC
interface identifier
privacy extensions
RFC 7217
autoconfiguration
· Lin
Looking up a MAC address and getting a vendor name back depends on a public allocation registry maintained by the IEEE R…
OUI
IEEE
MA-L
MA-M
MA-S
MAC address allocation
vendor registry
CID
· Lin
For IP multicast to cross Ethernet it has to map onto a layer 2 multicast address, otherwise a switch has no idea what t…
multicast MAC
IPv4 multicast
IPv6 multicast
01:00:5E
33:33
IGMP snooping
address mapping
· Lin
FF:FF:FF:FF:FF:FF is the easiest MAC address to recognise, but Ethernet reserves a whole set of addresses for specific p…
broadcast address
FF:FF:FF:FF:FF:FF
reserved addresses
01:80:C2
LLDP
BPDU
broadcast storm
· Lin
Two flag bits live in the first byte of every MAC address. They determine whether the address was burned in by the manuf…
locally administered address
universal address
U/L bit
I/G bit
unicast
multicast
MAC address structure
· Lin
People new to networking often ask why IP addresses are needed at all if every device already has a unique MAC address. …
MAC address
IP address
layer 2
layer 3
data link layer
network layer
addressing
· Kai
A MAC address is the unique hardware identifier of a device's network card. You might need it to add a device to a route…
find MAC address
Windows MAC address
iPhone MAC address
Android MAC address
router
network devices
· Jondy
Modern phones and laptops constantly broadcast probe request frames while scanning for Wi-Fi. Early on, these frames car…
MAC randomization
machine learning
device fingerprinting
Wi-Fi privacy
probe request
tracking
OUI
· Lin
A MAC address (Media Access Control Address) is a unique hardware identifier assigned to a network interface at the data…
MAC address
OUI
data link layer
ARP
networking basics
· Jondy
MAC address spoofing is a technique where an attacker falsifies the MAC address of a network interface to impersonate a …
MAC spoofing
ARP spoofing
network security
MITM
switch security