What Is a MAC Address

A MAC address (Media Access Control address) is a 48-bit address that identifies a network device at the data link layer. It is written as hexadecimal digits separated by colons or hyphens, such as 00:1A:2B:3C:4D:5E.

MAC addresses operate at the data link layer (layer 2 of the OSI reference model) and let devices within the same network (the same segment) identify the party they are communicating with. A router can tell your home PC, smartphone, and IoT devices apart because each one presents a different MAC address. A MAC address is not forwarded beyond a router, however, so it never reaches anyone on the far side of the internet.

Addresses come in two kinds: the one assigned to a device at the factory (the factory-assigned address) and one generated by the OS in software. The two are distinguished by two bits in the leading byte, which indicate whether the address is globally unique or locally administered, and whether it is unicast or multicast.

The leading bits of a factory-assigned address are an identifier that the IEEE assigns to an organization. The assignment blocks are MA-L (whose leading 24 bits are the OUI), MA-M (28 bits) and MA-S (36 bits), and with MA-M and MA-S the leading 24 bits are the OUI of the IEEE Registration Authority itself. Searching only the leading 24 bits may therefore fail to lead to the manufacturer, and you need to look the address up again using 28 or 36 bits. The remaining bits are numbers that the organization receiving the assignment gives to each unit, so as long as the assignment rules are followed, factory-assigned addresses are designed not to collide. Because a device can present a different address in software, though, there is no guarantee that the address actually on the wire is unique.

MAC Address vs IP Address

MAC addresses and IP addresses are both essential to network communication, but they differ in role and in the layer at which they operate.

Operates at the data link layer (layer 2). Used to identify devices within the same segment. The factory-assigned address is fixed, but a device may present an address generated by the OS instead. Not forwarded beyond a router. Formatted like 00:1A:2B:3C:4D:5E.

Operates at the network layer (layer 3). Used for routing between networks. Assigned dynamically by DHCP, and changes depending on the network you connect to.

To use a delivery analogy, the IP address is like the street address that gives the final destination, while the MAC address is like the name of the person who takes the parcel for this one leg of the trip. A router decides the destination network of a packet from its IP address and rewrites the source and destination MAC addresses each time it hands the packet to the next leg. The MAC address that the original device presented therefore does not survive past the routers along the way.

Resolving an IP address to a MAC address within the same segment is the job of ARP (Address Resolution Protocol). ARP is used by the hosts and routers that are trying to communicate; the switches in between do not interpret ARP, and relay frames by consulting a forwarding table built from the source MAC addresses of the frames they receive.

MAC Address Randomization

The MAC address carried in Wi-Fi probe frames and association requests is sent without encryption. Because a factory-assigned address is globally unique and fixed, continuing to use it leaves a device in a state where merely observing the radio nearby is enough to identify and track it (Android's developer documentation likewise explains that the factory-assigned address allows a device to be individually identified and tracked). To mitigate this, iOS and Android introduced mechanisms that randomize the address used when connecting to Wi-Fi.

iOS 14 / iPadOS 14 and later: presents a random address unique to each Wi-Fi network (a private Wi-Fi address). You can check it and switch it under Settings, then Wi-Fi, then the details button next to the network name, then Private Wi-Fi Address. In iOS 18 / iPadOS 18 and later you can choose one of three modes per network - off, fixed, or rotating - and rotating switches to a different address roughly every two weeks. Apple's documentation states that fixed is the default on networks using WPA2 or better, and rotating is the default on networks with weak encryption or no encryption. On devices managed by an organization, the feature can be disabled from the device management service.
Android 10 and later: uses a randomized address by default. The default scheme is persistent randomization, which derives an address from network profile information such as the SSID and security type and keeps using it for the same network until the device is reset. In Android 12 and later, a non-persistent scheme that draws a fresh address for every connection is used under some conditions, such as networks suggested by an app. The settings screen only lets you enable or disable randomization per network; the scheme itself cannot be chosen.

Randomization works by setting the locally administered bit in the leading byte of the address to 1 and the unicast bit to 0, then filling the remaining 46 bits with random values. On a network where randomization has been disabled, the factory-assigned address is transmitted.

The background to why this mechanism became necessary is that retailers and commercial facilities were collecting the MAC addresses contained in Wi-Fi probe requests (the signals a device broadcasts before connecting) to track visit frequency, dwell time and movement paths. Like a browser fingerprint, a fixed MAC address functioned as an identifier that could follow an individual over a long period. Since randomization became the default, it has become difficult for a third party observing the radio to keep following the same device across stores or across a city. With persistent randomization, though, the same address is used for the same network, so the operator of that network can still tell a repeat visit. Bluetooth Low Energy implements the same idea as the resolvable private address (RPA).

How to Find Your MAC Address

You can check your own device's MAC address in the following ways.

Windows: run ipconfig /all at the command prompt and look at the Physical Address entry.
macOS: shown as the Wi-Fi Address under System Settings, Network, Wi-Fi, Details. You can also check it in Terminal with ifconfig en0 | grep ether.
iOS: the Wi-Fi Address under Settings, General, About is the hardware MAC address. The per-network private address is shown under Settings, Wi-Fi, and the network you are connected to.
Android: check the hardware address under Settings, About device, Wi-Fi MAC address. The per-network random address can be found in the details of the Wi-Fi settings (the item name and where it sits vary by device).
Linux: run ip link show or ifconfig in a terminal.

A router's admin screen lists the MAC addresses of every connected device. You need it when setting up MAC address filtering (a feature that allows only specific MAC addresses to connect), but because MAC addresses ride in frames without encryption, anyone nearby can observe one and present that value as their own. Filtering does not amount to an access control boundary.

MAC Addresses and Security

Here are the security issues to keep in mind around MAC addresses.

The limits of MAC address filtering: MAC address filtering on a router allows only registered devices to connect. An attacker, however, can intercept the MAC address of a legitimate device and spoof their own device's MAC address to match it. Because MAC addresses are sent without encryption, no special conditions are needed to observe one and spoof it. Filtering is about as effective as putting a nameplate on an unlocked door, and does not amount to an access control boundary. Protect your Wi-Fi with WPA2 / WPA3 encryption and a passphrase that is hard to guess, and do not leave filtering responsible for protection.
ARP spoofing: an attacker sends forged ARP replies to bind their own MAC address to the gateway's IP address, a man-in-the-middle attack technique for intercepting communication within the same network. HTTPS encrypts the content of the communication itself, but information about where you are communicating can still leak.
Privacy and tracking: when randomization is disabled, or on devices that do not have it, the factory-assigned address goes out over the air as it is. Enabling randomization and turning off automatic connection to Wi-Fi networks you do not need shortens the time during which the address observed nearby keeps pointing to the same device.

Common Misconceptions

MAC address filtering makes your Wi-Fi secure: MAC addresses ride in frames without encryption, so an attacker only has to observe one nearby and set that value on their own device to get past the filter. MAC address filtering does not amount to an access control boundary. Protect your Wi-Fi with WPA2 / WPA3 encryption and a passphrase that is hard to guess, and do not leave filtering responsible for protection.
MAC addresses can never be changed: The factory-assigned address burned into the hardware itself does not change, but the address a device presents can be changed in software. Randomization being the default for Wi-Fi connections in iOS 14 and later and Android 10 and later is built on exactly this. On Linux and macOS you can set a different MAC address with a command, and on Windows you can set one from Device Manager provided the adapter's driver supports it (where it does not, the item simply does not appear).
Someone can identify you on the internet using your MAC address: A MAC address is used only within the same segment, and a router rewrites the MAC addresses when it hands a packet to the next leg, so a device's MAC address never reaches the internet side. A website's server cannot learn the MAC address of a visitor. Within the range connected to the same Wi-Fi, however, MAC addresses are visible, so privacy risks do exist on the local network (if randomization is enabled, what is visible there is not the factory-assigned address but a random address for that network).

MAC Address