Acronym for Media Access Control.
The term MAC Address is used to refer to the hardware address of an Ethernet card. These are usually hard-coded in an Address ROM on the network interface card.
This is the LinkLayer?; an Ethernet frame header contains the both the source and destination Ethernet MAC addresses and a Protocol (or Length) field. | from hardware address | to hardware address | protocol field | <data>
A MAC address is 6 bytes (48) bits long, and is commonly represented as a colon-delimited sequence of 12 hex digits:"ab:cd:ef:gh:ij:kl".
The first 3 bytes (the "ab:cd:ef") identify the manufacturer of the network card, as overseen by the IEEE and IANA. See http://standards.ieee.org/regauth/oui/oui.txt for more information.
A MAC address should be globally unique - no two network cards should ever have the same MAC address, although some low-quality hardware manufacturers have been known to distribute NICs with identical MAC addresses before. Some cards (notably, those used with Solaris machines, but also some cards supported under Linux) may be software-reprogrammable.
Since everyone's network card is (in theory) unique, this is often used as a unique identifier for a machine (even though a machine may have multiple network cards, or not have one at all).
The low nybble of the first byte (the "b") contains a lot of information, the lowest bit of this means that the traffic is multiple destination (ie, multicast or broadcast). This is because on the wire each byte is sent low bit first.
$ /sbin/ifconfig -a rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
address: 00:05:1d:9b:f1:10
Recognising various mac addresses:
Some common mac addresses you'll see (And get confused about):
|1:0:c:cc:cc:cc|Cisco discovery Protocol (CDP) |1:0:c:0:0:0|Spanning Tree Protocol (STP) |1:0:c:0:0:0|Cisco Interswitch Link |1:0:5e:x:x:x|IP Multicast (RFC:1112)