A MAC address identifies a specific piece of network hardware. Every network interface ever manufactured has one, it is how a switch knows which port your laptop is on, and it is the value you will be asked for when someone provisions a phone, commissions a camera or registers a device on a corporate network.

It is also the source of a lot of confusion, because most explanations describe MAC addresses as permanent and unique. That stopped being true for phones and laptops in 2019, and the change quietly broke a number of things that businesses still rely on.

This guide covers what a MAC address actually is, how the format works, how to find one on any device, what randomization changed, and where MAC addresses genuinely matter when you are running an office network.

The short answer

A MAC address (Media Access Control address) is a 48-bit hardware identifier assigned to a network interface, written as 12 hexadecimal digits. The first 24 bits identify the manufacturer and the last 24 bits identify the specific interface. It operates at Layer 2 of the OSI model and is used to deliver data between devices on the same local network.

A typical MAC address looks like this:

00:1A:2B:3C:4D:5E

The same address may be written three ways depending on the vendor. All three mean exactly the same thing.

• Colon separated: 00:1A:2B:3C:4D:5E (Linux, macOS, most network equipment)
• Hyphen separated: 00-1A-2B-3C-4D-5E (Windows)
• Dot separated: 001a.2b3c.4d5e (Cisco)

One device usually has several MAC addresses, one per interface. A laptop with Ethernet, Wi-Fi and Bluetooth has three. That is normal and is the most common reason people think they have found the wrong one.

Anatomy of a MAC address

The 48 bits split into two halves that do completely different jobs.

Portion	Bits	Example	What it is
OUI (Organizationally Unique Identifier)	First 24	00:1A:2B	Identifies the manufacturer. Purchased from and registered with the IEEE.
Device identifier	Last 24	3C:4D:5E	Assigned by that manufacturer to the individual interface.

Because the OUI is registered publicly, you can look up any MAC address and find out who made the hardware. That is genuinely useful in practice. An unknown device on your network resolves to a manufacturer, and knowing it is a Hikvision camera rather than an unidentified laptop changes what you do next.

The IEEE publishes the full registry, and you can search it or download the complete list from the IEEE Registration Authority.

The two flag bits that most guides skip

Inside the very first octet sit two bits that tell you a lot about an address at a glance.

Bit	Value 0 means	Value 1 means
I/G (least significant bit of octet 1)	Unicast. Addressed to one interface.	Multicast or broadcast. Addressed to a group.
U/L (second least significant bit of octet 1)	Universally administered. A real manufacturer OUI.	Locally administered. Set by software, not burned in.

The practical shortcut worth memorising

You do not need to convert anything to binary. If the second hexadecimal digit of a MAC address is 2, 6, A or E, the address is locally administered and unicast. It was set by software rather than assigned by a manufacturer.

In 2026 that almost always means one of two things: it is a randomized address from a phone or laptop, or it is a deliberately spoofed address. Either way, it is not a factory identifier, and any system relying on it being stable will eventually break. This single check is the fastest way to work out why a device keeps appearing as a new arrival on your network.

For completeness: the digits 3, 7, B and F also indicate a locally administered address, but a multicast one. You will see those on protocol traffic rather than on a device, so 2, 6, A and E are the four to remember.

MAC address vs IP address

A MAC address identifies a physical network interface and does not change as data crosses the network. An IP address identifies a device’s position on a network and changes when the device moves to a different network. You need both, and they do different jobs at different layers.

	MAC address	IP address
OSI layer	2, data link	3, network
Assigned by	The manufacturer, or software	A network administrator or DHCP
Scope	The local network segment only	Routable across the internet
Format	48 bits, 12 hex digits	32 bits (IPv4) or 128 bits (IPv6)
Changes when the device moves?	No, it belongs to the hardware	Yes, it belongs to the network
Used by	Switches	Routers

Why data carries both

This is the part that confuses people, and it is worth getting right because it explains the whole system.

The IP address is the final destination. It stays the same for the entire journey, in the same way the address on a parcel does not change as the parcel moves between depots.

The MAC address is the next hop. It is rewritten at every single router along the path. When your laptop sends a packet to a web server, the packet leaves carrying your router’s MAC address as its destination, not the server’s. Your router strips that off, writes in the MAC address of the next device, and forwards it. This repeats at every hop until the packet reaches the destination network, where the final router writes in the server’s actual MAC address.

So the IP address answers “where is this ultimately going?” and the MAC address answers “who hands it over next?” Both are needed, because routers only know how to reach networks, and the physical delivery on each segment happens by MAC address.

The mechanism that connects the two is ARP, the Address Resolution Protocol. When a device knows an IP address on its local network but not the matching MAC address, it broadcasts a request asking who holds that IP. The device with that IP answers with its MAC address, and the sender caches the result. On Windows you can see this cache with arp -a.

How to find a MAC address on any device

Device	Where to look
Windows 10 and 11	Open Command Prompt and run ipconfig /all. The MAC address appears as “Physical Address” under each adapter. Or Settings, Network and Internet, then the adapter’s properties.
macOS	System Settings, Network, select the interface, then Details and Hardware. Or run ifconfig en0 in Terminal.
iPhone and iPad	Settings, General, About, Wi-Fi Address. Note this is the hardware address. The address your network actually sees is under Settings, Wi-Fi, the (i) beside the network, Private Wi-Fi Address.
Android	Settings, About phone, Status, or Settings, Network, Wi-Fi, then the gear icon beside the connected network. Wording varies by manufacturer.
Linux	ip link show or ifconfig -a. The value follows “link/ether”.
ChromeOS	Settings, Network, Wi-Fi, then the connected network’s details.
Printers	Print a network configuration page from the control panel. It is usually listed as “Hardware Address” or “MAC”.
IP cameras, phones, access points	Printed on a label on the device itself and on the box, often beside a QR code. Record it before installation, because the label faces the ceiling once mounted.
Any device, from the network side	Check the DHCP lease table on your router or firewall, or the MAC address table on a managed switch.

One field note that saves real time on site: photograph the MAC address labels of every access point, camera and door reader before they go up. Once a unit is mounted on a ceiling or inside a housing, reading that label means getting the ladder back out.

MAC address randomization: why “permanent” is no longer true

Most explanations still describe MAC addresses as fixed hardware identifiers. For servers, switches, printers, cameras and anything wired, that remains accurate. For phones and laptops on Wi-Fi, it has not been true for years.

Every major platform now generates a randomized, locally administered MAC address for Wi-Fi by default, so that a device cannot be tracked across networks by its hardware identifier.

Platform	Since	Default behaviour
Android	Android 10, 2019	A different randomized address per saved network, persistent for that network.
iOS and iPadOS	iOS 14, 2020	Per-network randomization. iOS 18 added Off, Fixed and Rotating modes, defaulting to Fixed on WPA2 or stronger networks and Rotating on open or weak ones.
Windows	Windows 10, 2020	Supported per network, and can be configured to rotate on each connection.

What this breaks

These are not hypothetical. They come up constantly on business networks.

• MAC filtering allow-lists. A device approved once appears as a stranger the next time and is refused.
• DHCP reservations. A phone pinned to a fixed IP by MAC address stops receiving it.
• Captive portals and guest Wi-Fi. Users are forced to re-accept terms repeatedly because the portal no longer recognises them.
• Network access control and RADIUS. Policies keyed to MAC address stop matching, and one phone can appear as several devices in a day.
• Device counts and analytics. Occupancy and visitor figures inflate, sometimes dramatically.
• Licence enforcement. Anything tied to a MAC address may deactivate without warning.

How to handle it

• Stop using MAC address as an identity. It was never a strong one and it is now not even a stable one.
• Use 802.1X with certificates or credentials for staff devices. This identifies the user or the device properly and is unaffected by randomization.
• Accept randomization on guest networks and design the portal so a returning-user experience does not depend on recognising the hardware.
• Keep MAC-based configuration for wired and fixed devices only. Cameras, access points, printers, door controllers and desk phones do not randomize, so DHCP reservations and port security still work correctly for them.
• If a specific device must be recognised, instruct the user to turn off the private address for that network. On iPhone this is under Wi-Fi, the (i) icon, Private Wi-Fi Address. Treat it as an exception, not a policy.

Where MAC addresses actually matter in a business network

Beyond the definition, these are the places a MAC address does real work in a commercial installation.

The switch MAC address table

A managed switch builds a table mapping every MAC address it has seen to the port it arrived on, and uses that table to send each frame to exactly one port instead of all of them. It is the mechanism that makes a switch a switch rather than a hub. Our guide to hubs, switches and routers covers how this differs from the devices it replaced.

Tracing a device to a physical port

When something misbehaves on the network and all you have is an IP address, the path back to the physical wall port runs through the MAC address. Resolve IP to MAC via ARP, look that MAC up in the switch’s address table to get the port, then follow the patch panel documentation to the outlet. Without labelled patch panels and an accurate port map this becomes an afternoon of unplugging cables, which is one of several reasons the network closet documentation matters.

DHCP reservations

Devices that need a predictable IP address get one reserved against their MAC address. Printers, cameras, access points, servers and desk phones all belong in this category. Anything on Wi-Fi that randomizes does not.

Port security on managed switches

A managed switch can be configured to limit how many MAC addresses appear on a port, and to shut the port down if that limit is exceeded. This is useful protection against someone plugging an unmanaged switch into a wall port, and against MAC flooding attacks. It is available on the managed models covered in our small business Cisco switches guide, and not available at all on unmanaged switches.

Zero-touch provisioning

VoIP desk phones and wireless access points are commonly provisioned by MAC address. You supply the list of MAC addresses to the platform, the configuration is staged against each one, and the device pulls its own settings the first time it is plugged in. For a fifty phone deployment this is the difference between an hour and a full day, and it is standard practice in the VoIP installations we run. The same applies when planning access point deployments.

Camera and access control commissioning

IP cameras and door controllers are identified by MAC address during discovery, before they have a usable IP address. Video management software and access control platforms scan the subnet, list what they find by MAC, and you match each one to its physical location from your records. Getting those records right during install is what stops a fifty camera system from becoming fifty unlabelled entries in a list. This applies to both security camera installations and access control systems, and our UniFi door access guide covers the commissioning process in detail.

Hardware-bound licensing

Some software licences are tied to the MAC address of a specific interface. This matters most when hardware is replaced or moved, which is why licence auditing appears in our data center relocation checklist. Replacing a network card can deactivate software nobody realised was bound to it.

MAC filtering is not a security control

This needs saying plainly, because it is still recommended in a lot of older material.

MAC address filtering does not secure a network. MAC addresses are transmitted in the clear in every frame, including on encrypted Wi-Fi. Anyone within range can capture traffic, read the list of permitted addresses, and set their own interface to one of them. Changing a MAC address takes one command on any operating system. The whole bypass is a few minutes of work with freely available tools.

The same weakness applies to MAC Authentication Bypass (MAB), the 802.1X fallback used for devices that cannot authenticate themselves, such as printers and older cameras. If an attacker learns a MAC address on the bypass list, they can impersonate it and reach the network without authenticating. MAB is a practical necessity in most networks, but it should be understood as a compatibility measure rather than a security one, and the devices on it should sit in a restricted VLAN.

What to use instead

• 802.1X with certificates. The device proves its identity cryptographically. A spoofed MAC address gets nowhere without the certificate.
• WPA2 or WPA3 Enterprise for wireless, rather than a shared passphrase.
• VLAN segmentation so that cameras, door controllers, guest Wi-Fi and payment systems cannot reach your business systems even if one is compromised.
• Port security and DHCP snooping on managed switches as supporting controls.

MAC filtering still has a legitimate role as an administrative convenience: keeping a tidy inventory, stopping casual accidental connections, or organising a small fixed set of devices. It is not a boundary and should never be the only thing between a visitor and your network.

MAC-based attacks worth knowing about

• MAC spoofing. Setting an interface to another device’s address to impersonate it or bypass a filter.
• MAC flooding. Overwhelming a switch’s address table with fabricated addresses until it fails open and begins broadcasting to every port, allowing traffic capture. Port security is the standard mitigation.
• ARP spoofing. Sending forged ARP replies so that other devices associate a legitimate IP address with the attacker’s MAC address, placing the attacker in the middle of the conversation. Dynamic ARP inspection on managed switches mitigates this.

All three are prevented or detected by features that exist on managed switches and do not exist on unmanaged ones. It is one of the more concrete arguments for not running a business network on unmanaged hardware.

Special MAC addresses to recognise

Address or prefix	What it is
FF:FF:FF:FF:FF:FF	Broadcast. Delivered to every device on the local segment. ARP requests use it.
01:00:5E:xx:xx:xx	IPv4 multicast.
33:33:xx:xx:xx:xx	IPv6 multicast.
01:80:C2:xx:xx:xx	Spanning tree and other IEEE 802.1 control protocols.
Second hex digit is 2, 6, A or E	Locally administered. Randomized or spoofed, not a manufacturer address.
00:00:00:00:00:00	Usually an error, an uninitialised interface, or a driver problem.

Common problems and what causes them

Symptom	Likely cause	Fix
A phone appears as a new device every time it connects	MAC randomization set to rotate	Expected behaviour. Stop identifying it by MAC, or set the private address to off for that network.
A DHCP reservation stops working	The device randomized its address	Reserve by MAC only for wired and fixed devices. Use a different method for phones.
Two devices with the same MAC address	Spoofing, a cloned virtual machine, or a manufacturing duplicate	Locate both via the switch address table. Change the locally administered one.
A device shows a MAC address but no IP	DHCP failure, wrong VLAN, or a blocked port	Check the port’s VLAN assignment and the DHCP scope.
The switch shows many MAC addresses on one port	An unmanaged switch has been plugged in downstream, or a virtualization host is running	Confirm which. If unauthorised, enable port security.
Wi-Fi analytics show far more visitors than reality	Randomization creating multiple identities per device	Expected. Adjust the counting method rather than the network.
Software deactivates after a hardware repair	The licence was bound to the replaced interface	Contact the vendor to rehost. Audit MAC-bound licences before any hardware change.

Frequently asked questions

What is a MAC address?

A MAC address is a 48-bit hardware identifier assigned to a network interface, written as 12 hexadecimal digits such as 00:1A:2B:3C:4D:5E. The first 24 bits identify the manufacturer and the last 24 identify the individual interface. It operates at Layer 2 of the OSI model and delivers data between devices on the same local network.

What does MAC stand for?

Media Access Control. It has nothing to do with Apple Mac computers, which is a common source of confusion. Every device with a network interface has one, regardless of manufacturer or operating system.

What is the difference between a MAC address and an IP address?

A MAC address identifies a physical network interface and works only on the local network segment. An IP address identifies a device’s position on a network and routes across the internet. The IP address stays the same for the whole journey while the MAC address is rewritten at every hop. Switches use MAC addresses, routers use IP addresses.

Can a MAC address be changed?

Yes. Although the hardware address is burned into the interface at manufacture, every modern operating system can override it in software. This is called MAC spoofing. It has legitimate uses, including privacy and replacing a failed device that a system has been configured around, and it is also why MAC filtering does not provide security.

Are MAC addresses unique?

Universally administered addresses are intended to be globally unique, because manufacturers buy registered OUI blocks from the IEEE. In practice duplicates occasionally occur through manufacturing errors or cloned virtual machines. Locally administered addresses, including randomized ones, carry no uniqueness guarantee at all.

How do I find my MAC address?

On Windows run ipconfig /all and look for “Physical Address”. On macOS open System Settings, Network, then the interface details. On iPhone go to Settings, General, About, Wi-Fi Address. On Android look under Settings, About phone, Status. On Linux run ip link show. Devices such as cameras and access points usually print it on a label on the unit.

Why does my phone show a different MAC address on each network?

Because it is randomizing on purpose. Android 10 and later, iOS 14 and later, and Windows 10 and later all generate a private MAC address per network by default so a device cannot be tracked across locations. The hardware address still exists but is not the one your network sees.

Does MAC filtering make a network secure?

No. MAC addresses travel unencrypted in every frame, so anyone within range can read a permitted address and set their own interface to match it in seconds. Use 802.1X with certificates and WPA2 or WPA3 Enterprise instead. MAC filtering is an administrative convenience, not a security boundary.

What is an OUI?

The Organizationally Unique Identifier is the first 24 bits of a MAC address, identifying the manufacturer. Organisations purchase OUI blocks from the IEEE Registration Authority, and the registry is public, which is why a MAC address can be looked up to reveal who made the hardware.

How can I tell if a MAC address is randomized?

Look at the second hexadecimal digit. If it is 2, 6, A or E, the address is locally administered and unicast, meaning it was set by software rather than assigned by a manufacturer. On a modern network that usually indicates a randomized phone or laptop address, or a deliberately spoofed one. You can check any address with the lookup tool above.

Can two devices have the same MAC address?

They should not, but it happens. Causes include manufacturing errors, virtual machines cloned without regenerating their addresses, and deliberate spoofing. The symptom is intermittent connectivity for both devices as the switch repeatedly relearns which port the address is on. Locate both through the switch’s MAC address table.

Does a MAC address reveal my location or identity?

Not directly. It does not contain location data and it does not leave your local network segment, so websites cannot see it. It can however be used to track a device across Wi-Fi networks that observe it, which is precisely why randomization was introduced.

Do I need to know MAC addresses to set up an office network?

For wired and fixed devices, yes. DHCP reservations, port security, zero-touch provisioning of phones and access points, and commissioning of cameras and door controllers all work from MAC addresses. Recording them accurately during installation saves considerable time later. For staff phones on Wi-Fi, MAC addresses are no longer a reliable identifier.

Need a network built and documented properly?

Most of what makes MAC addresses useful in practice comes down to documentation. A switch address table only tells you which port a device is on. Turning that into a physical location needs labelled patch panels, an accurate port map, and a record of which device is where. That is what separates a five minute fault trace from an afternoon of pulling cables.

Cablify designs, installs and documents commercial networks across Toronto, Mississauga, Brampton, Vaughan, Markham, Oakville, Burlington, Hamilton, Kitchener and the wider GTA. Every installation includes structured cabling certified with Fluke DSX testing, labelled patch panels, a documented port map, and an asset register with the MAC address of every device we commission.

Site surveys are free and quotes are based on what we find onsite. Call 1-647-846-1925 or 1-877-450-2134, or email info@cablify.ca.

Book a free site survey

Related guides

• Hub vs switch vs router: network devices explained
• What is an MDF and IDF? A guide to network closets
• Small business Cisco switches: PoE, features and models
• How many access points does a building need?
• UniFi door access control: the complete commercial guide
• Business VoIP services in Toronto