MAC Address

What is a MAC address?

A MAC address (Media Access Control address) is a 48-bit identifier of a network interface that devices use to address each other within the same local network at layer 2 (the data link layer) of the OSI model. Every Ethernet port, Wi-Fi chip and Bluetooth module has at least one. Manufacturers burn the address in during production, but software can override it. In both IT and OT networks, the MAC address is the foundation for forwarding frames, assigning IP addresses and recognising devices.

🧠 How is a MAC address structured?

A MAC address consists of 6 bytes (48 bits), called an EUI-48 in IEEE terminology. It is written as 12 hexadecimal digits in one of three common notations: 00-1A-2B-3C-4D-5E (IEEE and Windows), 00:1A:2B:3C:4D:5E (Linux and most PLC tools) or 001a.2b3c.4d5e (Cisco).

The address splits into two parts:

• Manufacturer part - a block that the IEEE Registration Authority assigns to an organisation. The best known is the 24-bit OUI (Organizationally Unique Identifier), the first 3 bytes.
• Device part - the remaining bits, which the manufacturer hands out per interface itself.

Not every manufacturer receives a full OUI. The IEEE offers three block sizes:

Two bits in the first byte have a fixed meaning:

• I/G bit (least significant bit) - 0 means an individual address (unicast), 1 a group address (multicast). The address FF-FF-FF-FF-FF-FF is the broadcast to all devices in the segment.
• U/L bit (second bit) - 0 means a globally unique address assigned by the manufacturer, 1 a locally administered address chosen by software or an administrator. A second hexadecimal digit of 2, 6, A or E gives away a locally administered unicast address.

🔧 How do networks use the MAC address?

Every Ethernet frame starts with the destination MAC address followed by the source MAC address. A switch learns from the source address which port a device sits on and stores that in its MAC address table (CAM table). Frames for a known address go only to that one port; unknown addresses and broadcasts go to all ports in the same VLAN. An entry ages out after 300 seconds without traffic by default.

Other protocols build on it:

• ARP maps an IPv4 address to a MAC address, so a device knows which layer-2 address a packet must go to.
• DHCP and BOOTP recognise the requester by its MAC address and can use it to hand out a fixed address (reservation).
• A router replaces the MAC addresses in the frame at every hop, while the IP address stays the same. A MAC address is therefore only visible within its own broadcast domain.
• IPv6 used to derive the interface ID from the MAC address (modified EUI-64: FFFE inserted in the middle, U/L bit flipped). Because that makes devices traceable worldwide, the RFCs now recommend random or stable interface IDs that are not derived from the MAC address.

🔄 What is the difference between a MAC address and an IP address?

🏭 How are MAC addresses used in industrial networks?

In OT, the MAC address is often the first identity of a new device. A PLC, I/O station or variable frequency drive arrives from the factory without an IP address and with only its MAC address on the rating plate.

• Commissioning - IP devices are often given an IP address by a BOOTP/DHCP server tool based on their MAC address. With PROFINET, the engineering software finds devices by their MAC address via the DCP protocol and assigns them a device name and IP address.
• Multiple addresses per device - a PROFINET device has one MAC address for the interface plus one per port. LLDP uses the port addresses to detect neighbours and the network topology.
• Fixed addresses - with BOOTP or DHCP reservations, a device keeps the same IP address even after the server is replaced.
• Asset inventory - asset discovery and passive monitoring tools read MAC addresses from the traffic. From the OUI they derive the manufacturer, which forms the basis of an asset inventory.
• Monitoring - management tools read the MAC tables of switches via SNMP, so you can see which device sits on which port. Changes go via Syslog to a SIEM.
• Wireless networks - on Wi-Fi and in a guest network, the MAC address is used for registration and temporary access.

When a faulty device is replaced, the MAC address changes. If you tie IP addresses strictly to MAC addresses, include that step in the maintenance procedure. Otherwise the new device receives no address or the wrong one.

🔐 How secure is identification based on a MAC address?

A MAC address is not a secret and not proof of identity. Anyone in the same segment can see it and imitate it with a single command. Therefore:

• MAC spoofing - an attacker takes over the MAC address of a trusted device and bypasses filters that way. With ARP spoofing, the attacker links their own MAC address to another device’s IP address to intercept traffic.
• Port Security - limit the number of permitted MAC addresses per switch port (often one) and choose what happens on a violation: drop the traffic, raise an alert or shut the port down. MAC Binding fixes the association.
• MAC Filtering - an ACL on a switch or access point admits only known addresses. A Firewall usually filters at layers 3 and 4 and only sees MAC addresses within its own segment.
• Stronger authentication - combine filtering with 802.1X. For devices without 802.1X support, such as many PLCs, a NAC solution falls back on MAC Authentication Bypass. That is weaker and needs to be backed up by monitoring.
• Layer-2 protection - DHCP Snooping and Dynamic ARP Inspection block rogue DHCP servers and forged ARP messages.
• Small broadcast domains - VLANs and network segmentation limit how far broadcast traffic such as ARP and BOOTP reaches. This fits the zones of IEC 62443 and strengthens overall network security.

🧱 What should you know about MAC randomisation and privacy?

Smartphones and laptops increasingly use a random MAC address. iOS has used a private address per Wi-Fi network since version 14, Android has used a randomised address per network by default since version 10, and Windows offers a similar option. These addresses have the U/L bit set to 1.

For administrators this means:

• DHCP reservations and MAC filters on guest networks no longer work reliably.
• An asset inventory sometimes counts one phone as several devices.
• For fixed OT equipment this hardly matters: PLCs, HMIs and switches use their burned-in address.

MAC addresses can also be personal data under the GDPR, known in the Netherlands as the AVG. In 2021 the Dutch Data Protection Authority fined the municipality of Enschede 600,000 euros for Wi-Fi tracking in the city centre, in which the MAC addresses of passing phones were captured. The district court annulled the fine in 2024 and the Council of State upheld that in July 2026, because, when imposing the fine, the regulator had not sufficiently shown that the captured data could in practice be traced back to individuals. The authority’s position remains that a MAC address combined with time and location can be traced back to a person.

❓ Frequently asked questions

Is a MAC address always unique?

A manufacturer-assigned MAC address is meant to be globally unique, because the IEEE assigns each address block to only one organisation. In practice, duplicate MAC addresses still occur, for example with cloned virtual machines or cheap hardware. Locally administered and random addresses are only unique within their own network.

Can I change a MAC address?

Yes, most operating systems and network cards let you override the MAC address in software. The burned-in address remains on the hardware, but the device then uses the new address in its frames. That is why a MAC address is not a reliable form of authentication.

How do I find the MAC address of a device?

On Windows, ipconfig /all or getmac shows the MAC address; on Linux, ip link does. For a PLC, the MAC address is usually printed on the rating plate and visible in the engineering software. On the network, you find it via the switch’s MAC table, the ARP table or a capture in Wireshark.

Can a MAC address tell me which manufacturer made the device?

Yes, the manufacturer part of a MAC address is listed in the public register of the IEEE Registration Authority. Network tools and asset inventory tools look up that prefix automatically. This does not work for a locally administered or random MAC address, because its prefix was not assigned by the IEEE.

Does a MAC address travel across the internet?

No, a MAC address stays within the local broadcast domain. Every router replaces the MAC addresses in the frame with those of its own outgoing interface and the next device. Only the IP address stays the same from source to destination.

Is MAC filtering enough to secure an OT network?

No, MAC filtering only keeps out accidental or unaware users, because an attacker can easily imitate a permitted MAC address. Use MAC filtering and port security as one layer alongside 802.1X, network segmentation and monitoring. That way it fits a defence-in-depth approach.

📌 In summary

A MAC address is the 48-bit layer-2 address of a network interface: it acts as a serial number for delivery within the local network, but it is neither secret nor always unique. In industrial networks it is indispensable for commissioning, addressing and asset inventory. For access management and access control, it is only useful in combination with port security, 802.1X and monitoring.