Networking for Beginners

MAC Addresses and ARP

Learn what MAC addresses are, how they differ from IP addresses, how ARP finds a MAC address, and how switches use MAC addresses to forward frames.

~21 min Beginner

What a MAC address is

A MAC address (Media Access Control address) identifies one network interface, such as a WiFi chip or an Ethernet port. The manufacturer assigns it, and it normally stays the same for the life of the hardware.

00:1A:2B:3C:4D:5E

A MAC address is 48 bits long and is written as six pairs of hexadecimal digits. The first half identifies the manufacturer and the second half is specific to that interface. A laptop has one MAC address for its WiFi chip and another for its Ethernet port.

MAC address or IP address

Both identify a device, but they work at different levels:

  • A MAC address is used inside one local network. It belongs to the hardware and usually does not change.
  • An IP address is used across networks. It depends on the network the device is connected to and changes when you move to another one.

A device uses the IP address to say where a packet is finally going, and the MAC address to say which device on the local link should receive the frame next.

What a frame looks like

On a local network, data travels in frames. A frame is the data from the layer above with a header and a trailer from the Data Link layer added around it:

Destination MAC | Source MAC | Type | Payload (the IP packet) | Check

A switch only reads the outer part. It looks at the destination MAC address, finds the right port and forwards the frame.

One destination is special: FF:FF:FF:FF:FF:FF means "every device on this network". It is called the broadcast address, and ARP uses it to ask its question.

To see the MAC address of your own interfaces:

ip link          # Linux
ipconfig /all    # Windows (look for Physical Address)

ARP: finding a MAC address

Your laptop wants to send data to the router at 192.168.1.1. It knows the IP address, but on a local network the frame needs a MAC address. The Address Resolution Protocol (ARP) is how the laptop finds it.

  1. The laptop broadcasts a question to everyone on the network: "Who has 192.168.1.1? Tell 192.168.1.23."
  2. Every device receives it, but only the router recognises its own address. It replies directly to the laptop: "192.168.1.1 is at AA:BB:CC:DD:EE:FF."
  3. The laptop stores that answer in its ARP cache so it does not have to ask again for a few minutes.
  4. The laptop sends the frame with that MAC address as the destination.

When the target is on another network

ARP only works on the local network. A laptop cannot ask for the MAC address of a server in another country, because the broadcast never leaves the local network. This is what actually happens when you visit a website:

  1. The laptop sees that the destination IP is not in its own subnet.
  2. It decides to send the packet to the default gateway.
  3. It uses ARP to find the gateway's MAC address.
  4. It sends a frame with the router's MAC address as the frame destination, while the packet inside still carries the real destination IP address.

At every hop after that, the MAC addresses change, because each link is a separate local network. The destination IP address stays the same all the way. So: MAC addresses are for the next hop, IP addresses are for the whole journey.

Look at the ARP cache

arp -a          # Windows, macOS and Linux
ip neigh        # modern Linux

Both commands list the IP addresses your computer has talked to recently, next to their MAC addresses:

? (192.168.1.1) at aa:bb:cc:dd:ee:ff [ether] on wlan0

If the list is empty, you probably have not talked to anyone on the network yet. Try ping 192.168.1.1 and run the command again.

How switches use MAC addresses

A switch connects wired devices in a LAN, and it learns MAC addresses by watching traffic.

When a frame arrives, the switch records which port the source MAC address came from. When a later frame is addressed to that MAC address, the switch sends it out of that one port only. If it has not seen the address yet, it sends the frame out of all other ports until it learns where the device is.

The older hub repeated every frame to every port. Switches replaced hubs because they are faster and more private.

MAC spoofing

A MAC address looks permanent, but it is only a setting. Anyone can change it in software, which is called MAC spoofing. Some phones also use a random MAC address for each WiFi network on purpose, to make tracking harder.

Because MAC addresses can be faked, filtering a network by MAC address alone is weak security. Use proper WiFi encryption such as WPA2 or WPA3 instead.

Quick recap

  • A MAC address names the hardware and is used on the local network.
  • An IP address names the network position and is used across networks.
  • ARP turns an IP address into a MAC address on the local network.
  • Switches learn MAC addresses and forward frames only where they need to go.
Sign up to track your progress Mark lessons as read and pick up where you left off Sign up free to unlock this practice Your first practice lesson is free to try. Create an account to unlock the rest and save your progress
Previous Subnetting Next TCP, UDP and Ports