A MAC address, commonly called a Media Access Control address, is a link-layer identifier associated with a network interface in technologies such as Ethernet and Wi-Fi. A traditional MAC address is 48 bits long and is commonly written as six hexadecimal octets, for example 00:1A:2B:3C:4D:5E. MAC addresses operate at the data-link layer rather than the Internet layer, so they serve a different purpose from IP addresses.
On a typical Ethernet or Wi-Fi network, a device uses MAC addresses to identify local-link senders and receivers within frames. Routers generally do not forward the original Ethernet MAC addresses across the entire Internet; they remove and recreate link-layer framing as packets move between networks. MAC addresses are therefore fundamentally local-network identifiers rather than global Internet addresses.
Traditional 48-bit MAC addresses are often structured into an organisationally significant portion and an interface-specific portion. The first 24 bits can form an organisationally unique identifier, commonly associated with a manufacturer or other organisation assigned an identifier by the IEEE registration system. The remaining bits can then be used according to the organisation's allocation scheme.
This structure is not a guarantee that a particular physical manufacturer can always be inferred from every observed address because modern systems can use locally administered or randomised addresses. The second-least-significant bit of the first octet indicates whether an address is universally or locally administered, while the least-significant bit indicates whether the address represents an individual unicast destination or a group. Consequently, interpreting a MAC address solely as a permanent manufacturer's serial number is inaccurate.
MAC addresses are used by local networking protocols to deliver frames on a shared or switched link. On Ethernet, a switch learns which MAC addresses are reachable through which physical or logical ports by examining source addresses in incoming frames. It can then forward unicast frames only towards the relevant port rather than transmitting every frame everywhere. Broadcast and multicast traffic use different forwarding behaviour.
In IPv4 Ethernet networks, ARP can discover the MAC address corresponding to a local IPv4 address, allowing an IP packet to be encapsulated inside an Ethernet frame addressed to the appropriate interface. IPv6 uses Neighbor Discovery instead of ARP. Once a packet reaches a router, the link-layer frame is removed and a new frame appropriate for the next link is created. The destination MAC address therefore changes at every routed hop, unlike the end-to-end IP destination address.
MAC addresses are closely associated with Ethernet but the term is also used for link-layer addressing in Wi-Fi and other IEEE 802 networking technologies. Wireless networks use MAC addresses in association and frame-management procedures, while access points can use them to identify client interfaces at the local wireless link. A device can have multiple network interfaces, such as Ethernet, Wi-Fi and Bluetooth-related interfaces, and each can have its own link-layer address or addressing scheme. Virtual machines, containers and software-defined networking systems can also have virtual interfaces with MAC addresses. Consequently, a single computer does not necessarily have one MAC address. The number and nature of its addresses depend on its hardware, virtual interfaces, operating system and networking configuration.
Modern operating systems can use locally administered and randomised MAC addresses for privacy and network-management reasons. Wi-Fi clients in particular may randomise the MAC address presented when scanning for networks or connecting to particular networks, reducing the usefulness of passive tracking based solely on a stable hardware address. Administrators can also deliberately configure a locally administered address for virtualisation, testing or network-management purposes.
This means that a MAC address observed on a network should not automatically be treated as a permanent identifier of the physical device. It can be changed in software, replaced after hardware changes, generated for virtual interfaces or deliberately randomised. Network access-control systems that rely on MAC addresses therefore have limitations because MAC addresses are generally not cryptographic credentials and can often be modified or spoofed.
A MAC address differs fundamentally from an IP address. An IP address provides network-layer addressing that allows routers to move packets between networks, whereas a MAC address supports delivery across a local data link. A hostname provides a human-readable network name, while DNS can map names to IP addresses. A port identifies a transport-layer service such as HTTPS on TCP port 443.
These layers work together: DNS can provide an IP address, routing determines the next network hop, and the local network uses a destination MAC address to deliver the relevant frame to the next device. A router may therefore receive an Ethernet frame addressed to its own MAC address, extract an IP packet, determine the next hop and transmit that packet in a newly constructed frame with different source and destination MAC addresses.
MAC addresses have security and operational uses but should not be treated as inherently trustworthy identity mechanisms. Network switches can use MAC address tables for forwarding and administrators can use MAC-based controls for device policies, inventory or troubleshooting. Wireless networks can use MAC addresses as part of association and access-control processes. However, because addresses can be spoofed or randomised, MAC filtering alone is not a strong authentication mechanism.
Higher-assurance network access commonly relies on cryptographic authentication such as WPA2-Enterprise or WPA3-Enterprise mechanisms, 802.1X and certificate-based systems, depending on the environment. Network monitoring can still find MAC addresses useful because they describe local-link participants and can help correlate traffic with switch ports or access-point associations, but their evidential meaning depends on the network architecture and configuration.
The MAC concept arose from the need to identify stations and interfaces within local networking systems, particularly Ethernet and other IEEE 802 technologies. The term is associated with the Media Access Control sublayer of the data-link layer, which handles functions related to access to the physical transmission medium and frame addressing. The familiar 48-bit address format became widespread through Ethernet and IEEE standardisation.
As networking evolved, virtualisation, wireless privacy features, cloud infrastructure and software-defined networks made the idea of a permanently hardware-bound address less absolute. MAC addresses nevertheless remain fundamental to local-network operation. Their defining characteristic is their role in link-layer frame delivery, making them complementary to rather than interchangeable with IP addresses.
