DEV Community

David
David

Posted on

MAC Addresses Explained: What They Are, How They Work, and Why Developers Should Care

#beginners #networking #tutorial #webdev

Every network interface on every device in the world has a MAC address. Your laptop, your phone, your smart fridge, your printer — they all have at least one. Yet most developers couldn't tell you what the individual parts of a MAC address mean.

Let's change that.

What is a MAC Address?

MAC stands for Media Access Control. It's a unique identifier assigned to a network interface controller (NIC) — the hardware that connects your device to a network.

A MAC address looks like this:

00:1A:2B:3C:4D:5E
Enter fullscreen mode Exit fullscreen mode

It's 48 bits (6 bytes) long, usually written as 6 pairs of hexadecimal digits separated by colons or hyphens.

MAC Address Structure

Those 6 bytes aren't random. They have a defined structure:

|  OUI (3 bytes)  | NIC Specific (3 bytes) |
| 00 : 1A : 2B    | 3C : 4D : 5E          |
|  Manufacturer   | Device-unique          |
Enter fullscreen mode Exit fullscreen mode

OUI — Organizationally Unique Identifier

The first 3 bytes identify the manufacturer. The IEEE assigns OUI blocks to companies:

OUI Manufacturer
00:00:0C Cisco
00:1A:11 Google
3C:22:FB Apple
DC:A6:32 Raspberry Pi
00:50:56 VMware

This means you can identify the vendor of a device just from its MAC address. Network admins use this all the time.

NIC Specific

The last 3 bytes are assigned by the manufacturer to uniquely identify each device. With 3 bytes (24 bits), each OUI block supports ~16.7 million unique devices.

Special Bits in the First Byte

The first byte contains two important flags:

Bit 0 (LSB): Unicast (0) vs Multicast (1)
Bit 1:       Globally unique (0) vs Locally administered (1)
Enter fullscreen mode Exit fullscreen mode

Examples:

  • 00:1A:2B:... — Bit 0 = 0, Bit 1 = 0 → Unicast, globally unique (normal)
  • 01:00:5E:... — Bit 0 = 1 → Multicast address
  • 02:42:AC:... — Bit 1 = 1 → Locally administered (Docker uses these!)

Where MAC Addresses Show Up in Development

1. Docker Networking

Docker assigns locally administered MAC addresses to containers:

docker inspect -f '{{.NetworkSettings.MacAddress}}' my-container
# Output: 02:42:ac:11:00:02
Enter fullscreen mode Exit fullscreen mode

Notice the 02 prefix — bit 1 is set, marking it as locally administered.

2. Virtual Machines

Virtualization platforms generate MAC addresses for virtual NICs. VMware uses the 00:50:56 OUI, VirtualBox uses 08:00:27.

3. IoT and Device Identification

MAC addresses are commonly used to identify devices on local networks:

# Find devices on your network
arp -a
# or
nmap -sn 192.168.1.0/24
Enter fullscreen mode Exit fullscreen mode

4. Wake-on-LAN

WoL uses MAC addresses to wake sleeping devices by sending a "magic packet" containing the target's MAC address repeated 16 times:

import socket
import struct

def wake_on_lan(mac):
    mac_bytes = bytes.fromhex(mac.replace(':', ''))
    magic = b'\xff' * 6 + mac_bytes * 16
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
    sock.sendto(magic, ('255.255.255.255', 9))

wake_on_lan('00:1A:2B:3C:4D:5E')
Enter fullscreen mode Exit fullscreen mode

5. Network Testing and Simulation

When building network tools, testing with realistic MAC addresses matters. Random MACs can be invalid — proper test MACs need valid structure, correct bit flags, and realistic OUI prefixes.

MAC vs IP: What's the Difference?

Property MAC Address IP Address
Layer Data Link (Layer 2) Network (Layer 3)
Scope Local network only Global (routable)
Assignment Hardware/manufacturer DHCP/manual
Format 48-bit hex 32-bit (v4) or 128-bit (v6)
Changes? Usually permanent* Can change per network
Example 00:1A:2B:3C:4D:5E 192.168.1.100

*Modern devices randomize MAC addresses for privacy (more on this below).

MAC Address Randomization

Starting around 2014, mobile operating systems began randomizing MAC addresses for Wi-Fi scanning to prevent tracking:

  • iOS 14+: Random MAC per network by default
  • Android 10+: Random MAC per network
  • Windows 10/11: Optional random hardware addresses
  • macOS Sequoia+: Random Wi-Fi addresses

This broke a lot of assumptions in networking — captive portals, device tracking, DHCP reservations, and parental controls all relied on stable MAC addresses.

Finding Your MAC Address 

# macOS
ifconfig en0 | grep ether

# Linux
ip link show
# or
cat /sys/class/net/eth0/address

# Windows (Command Prompt)
ipconfig /all
# or
getmac
Enter fullscreen mode Exit fullscreen mode

Common MAC Address Formats

Different systems write MAC addresses differently:

Format Example Used By
Colon-separated 00:1A:2B:3C:4D:5E Linux, macOS
Hyphen-separated 00-1A-2B-3C-4D-5E Windows
Dot-separated 001A.2B3C.4D5E Cisco
No separator 001A2B3C4D5E Some APIs

All represent the same address — just formatted differently.

EUI-64: MAC Addresses in IPv6

IPv6 can derive interface identifiers from MAC addresses using EUI-64:

MAC:    00:1A:2B:3C:4D:5E
Step 1: Insert FF:FE → 00:1A:2B:FF:FE:3C:4D:5E
Step 2: Flip bit 7  → 02:1A:2B:FF:FE:3C:4D:5E
IPv6:   fe80::21a:2bff:fe3c:4d5e
Enter fullscreen mode Exit fullscreen mode

This creates a link-local IPv6 address from the MAC address — which is why MAC randomization matters for IPv6 privacy too.

Generate Test MAC Addresses

If you need valid MAC addresses for testing, development, or documentation, randommac.com generates them instantly with proper structure — valid OUI prefixes, correct bit flags, multiple formats. No signup, works in the browser.

MAC addresses are networking fundamentals that most developers interact with more often than they realize. Docker containers, virtual machines, IoT devices, network debugging — understanding the structure helps you troubleshoot faster and build better network-aware applications.

What's your most interesting MAC address debugging story? Share it in the comments 👇

Top comments (0)