MAC Addressing

Network-layer and data-link addresses

Network communication uses an address at the network layer and an address at the data-link layer. A router uses an IP address to select the next network, while an Ethernet interface uses a MAC address to deliver a frame on the local link.

These addresses have different functions:

• Logical address, such as an IP address: It is configured at the network layer. The address prefix identifies the network, and routers use it when forwarding a packet between networks.
• Physical address, or MAC address: It identifies a data-link interface. It can come from a manufacturer assignment or local configuration. It is used to deliver a frame within a local link or segment.

MAC addresses in EUI-48 format identify interfaces in local Ethernet and Wi-Fi communication. The I/G bit distinguishes individual and group addresses, while U/L indicates universal or local administration. The broadcast address designates all stations on the local network.

What is a MAC address?

A MAC address, short for Media Access Control, is an identifier assigned to a network interface card (NIC). For an address stored in interface memory, the terms burned-in address (BIA), hardware address, and physical address are used. These names do not mean that every MAC address is immutable.

MAC address characteristics

• Size and format: A typical Ethernet address has 48 bits ($6\text{-byte}$ value). Hexadecimal notation writes six bytes separated by colons or hyphens, for example 00:1A:2B:3C:4D:5E or 00-1A-2B-3C-4D-5E.
• Assignment: IEEE Registration Authority assigns EUI-48 identifier blocks to organizations. The block owner assigns values to interfaces and must keep them unique within its scope. A locally administered address requires separate collision control. The IEEE manages the registries used by IEEE standards. Address uniqueness matters on a segment where switches use it to recognize an interface.
• Value source: An address can be stored in interface memory, set by the operating system, or generated for a virtual interface. Software can replace a factory value, which is described as MAC spoofing. The IP address and MAC address can change independently.
• Operating layer: MAC addresses operate at Layer 2, the data-link layer, of the OSI model. The address is used on a local segment. A router can read the MAC address of a received frame, but it creates a frame with next-link addresses when forwarding the packet to another network.

MAC address structure

In a typical MA-L assignment, an EUI-48 address contains a 24-bit prefix assigned to an organization and 24 bits available to the block owner. Other IEEE block sizes, such as MA-M and MA-S, use longer prefixes, so the two equal halves mainly describe MA-L.

I/G and U/L bits and address types

The two lowest-order bits of the first octet determine how the address is interpreted. They are the I/G bit and the U/L bit.

Individual/group bit (I/G)

The lowest-order bit of the first octet is the I/G bit. A value of 0 denotes an individual address, while 1 denotes a group address.

• 0 (individual): It denotes a unicast. A frame with this destination address is intended for one interface. Individual addresses are used for one-to-one communication and appear in the source MAC field of Ethernet frames.
• 1 (group): It denotes a group address. A frame sent to a multicast address is intended for a group of receivers, and a switch can forward it to ports belonging to that group.

Universal/local bit (U/L)

The next-lowest-order bit of the first octet is the U/L bit. A value of 0 indicates a universal assignment, while 1 indicates an address set within a local scope.

• 0 (universal): It denotes a Universally Administered Address (UAA). The value comes from a universal IEEE identifier assignment or from the owner's range within such an assignment.
• 1 (local): It denotes a Locally Administered Address (LAA). It indicates a locally selected range. Such addresses occur in virtual interfaces, Wi-Fi address randomization, and software replacement of a factory value.