View Source: MAC - Waikato Linux Users Group

Edit PageHistory Diff Info LikePages
[Acronym] for __M__edia __A__ccess __C__ontrol.

The term __MAC Address__ is used to refer to the hardware address of an Ethernet card. These are usually hard-coded in an __Address [ROM]__ on the network interface card.

This is the LinkLayer; an [Ethernet] frame header contains the both the source and destination [Ethernet] MAC addresses and a [Protocol] (or Length) field.
| from hardware address
| to hardware address
| protocol field
| <data>


A MAC address is 6 bytes (48) bits long, and is commonly represented as a colon-delimited sequence of 12 hex digits:"ab:cd:ef:gh:ij:kl".

The first 3 bytes (the "ab:cd:ef") identify the manufacturer of the network card, as overseen by the [IEEE] and [IANA]. See [http://standards.ieee.org/regauth/oui/oui.txt] for more information.

A MAC address should be globally unique - no two network cards should ever have the same MAC address, although some low-quality hardware manufacturers have been known
to distribute [NIC]s with identical MAC addresses before. Some cards (notably, those used with Solaris machines, but also some cards supported under Linux) may be software-reprogrammable.

Since everyone's network card is (in theory) unique, this is often used as
a unique identifier for a machine (even though a machine may have multiple
network cards, or not have one at all).

The low nybble of the first byte (the "b") contains a lot of information, the lowest bit of this means that the traffic is multiple destination (ie, multicast or broadcast).
This is because on the wire each byte is sent low bit first.




You can find out the MAC address of your network cards using the ifconfig(8) utility. For example in Linux:
 $ /sbin/ifconfig
 eth0      Link encap:Ethernet  HWaddr __00:07:A9:11:40:A8__
 ...

It may look different in other [Unix] variants, [OpenBSD] shows the following:
 $ /sbin/ifconfig -a
 rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
         address: __00:05:1d:9b:f1:10__


----
Recognising various mac addresses:
* http://cert.uni-stuttgart.de/archive/intrusions/2004/01/msg00058.html

Some common mac addresses you'll see (And get confused about):

|1:0:c:cc:cc:cc|Cisco discovery Protocol (CDP)
|1:0:c:0:0:0|Spanning Tree Protocol (STP)
|1:0:c:0:0:0|Cisco Interswitch Link
|1:0:5e:x:x:x|IP Multicast (RFC:1112)

----
CategoryNetworking
15 pages link to MAC:
Last edited on Tuesday, October 12, 2004 2:04:11 pm by JohnMcPherson
Edit PageHistory Diff Info LikePages