27

Again and again I read that devices are uniquely identified by their MAC addresses. But how are MAC addresses determined? (And do they tell us anything about the device which they represent?)

migrated from cs.stackexchange.com Sep 4 '15 at 15:46

This question came from our site for students, researchers and practitioners of computer science.

  • This is about the computer industry, not about computer science, so it's off-topic on Computer Science. Between Super User (about computer hardware) and Information Security (about security), I'm migrating to Super User, because the answer is that there isn't any security to speak of. – Gilles Sep 4 '15 at 15:46
39

How are MAC addresses determined?

Vendors are given a range of MAC addresses that can be assigned to their products by the IEEE (Institute of Electrical and Electronics Engineers).

MAC Address are assigned to Vendors in various sized blocks as appropriate.

The IEEE offers Registration Authority programs or registries which maintain lists of unique identifiers under standards and issue unique identifiers to those wishing to register them. The IEEE Registration Authority assigns unambiguous names to objects in a way which makes the assignment available to interested parties.

You can go to Vendor/Ethernet/Bluetooth MAC Address Lookup and Search to find the Vendor given a MAC Address or find a MAC Address Range given a Vendor.


Devices are uniquely identified by their MAC addresses

This is incorrect. Devices are not uniquely identified by their MAC addresses:

  • In the past Vendors have intentionally or by mistake assigned the same MAC Address to multiple devices.
  • It is possible to change the MAC address presented by most hardware to the OS, an action often referred to as MAC spoofing:

MAC spoofing is a technique for changing a factory-assigned Media Access Control (MAC) address of a network interface on a networked device. The MAC address is hard-coded on a network interface controller (NIC) and cannot be changed. However, there are tools which can make an operating system believe that the NIC has the MAC address of a user's choosing.

See also Are MAC addresses unique when coming out of the factory? and MAC address recycling?


Duplicate MAC Addresses

Manufacturers re-use MAC addresses and they ship cards with duplicate addresses to different parts of the United States or the World so that there is only a very small chance two computers with network cards with the same MAC address will end up on the same network.

MAC addresses are 'burned' into the Network Interface Card (NIC), and cannot be changed. See ARP and RARP on how IP addresses are translated into MAC addresses and vice versa.

In order for a network device to be able to communicate, the MAC address it is using must be unique. No other device on that local network subnet can use that MAC address. If two devices have the same MAC address (which occurs more often than network administrators would like), neither computer can communicate properly. On an Ethernet LAN, this will cause a high number of collisions. Duplicate MAC addresses on the same LAN are a problem. Duplicate MAC addresses separated by one or more routers is not a problem since the two devices won't see each other and will use the router to communicate.

Source Media Access Control


Further reading

  • Just for laughs, we had Suns (SPARC) here a while back. On them the MAC of all NICs was the same (essentially some serial number of the machine). No problem as long as you had the various NICs on separate networks. – vonbrand Sep 4 '15 at 16:41
  • 3
    @coderworks Thanks for pointing that out. I will update the answer to clarify, but essentially "MAC spoofing is a technique for changing a factory-assigned Media Access Control (MAC) address of a network interface on a networked device. The MAC address is hard-coded on a network interface controller (NIC) and cannot be changed. However, there are tools which can make an operating system believe that the NIC has the MAC address of a user's choosing. " – DavidPostill Sep 4 '15 at 20:56
  • 1
    @JakeGould Interesting aside, but I've no idea what the answer to this is. Some google searching did not throw up anything useful. – DavidPostill Sep 5 '15 at 7:08
  • 1
    @JakeGould As another aside, I did find a reference to the FBI discovering 3,500 counterfeit Cisco network components with an estimated retail value of more than $3.5 million as well as several reports that counterfeit network components often have duplicate or stolen MAC addresses. – DavidPostill Sep 5 '15 at 7:19
  • 1
    @DavidPostill Interesting info on the counterfeit routers, but that’s still in the realm of theft. It would be interesting to understand how legitimate companies creating “accidental” dupes of MAC addresses in hardware are dealt with. – JakeGould Sep 5 '15 at 18:36
9

But how are MAC addresses determined?

They are determined by IEEE Registration Authority in the RFC 5342 Section 2.1

48-bit MAC "addresses" are the most commonly used Ethernet interface identifiers. Those that are globally unique are also called EUI-48 identifiers. An EUI-48 is structured into an initial 3-octet OUI (Organizationally Unique Identifier) and an additional 3 octets assigned by the OUI holder. For organizations not requiring 3 octets' worth of identifiers, the IEEE allocates IABs (Individual Address Blocks) instead, where the first 4 1/2 octets (36 bits) are assigned, giving the holder of the IAB 1 1/2 octets (12 bits) they can control.

The IEEE describes its assignment procedures and policies for IEEE 802 related identifiers in [802_O&A].

Two bits within the initial 3 octets of an EUI-48 have special significance: the Group bit (01-00-00) and the Local bit (02-00-00). OUIs and IABs are allocated with the Local bit zero and the Group bit unspecified. Multicast identifiers may be constructed by turning on the Group bit, and unicast identifiers constructed by leaving the Group bit zero.


And do they tell us anything about the device which they represent?

Basically MAC Address can be splitted in 2 part.

There is a MAC Address:

00-14-22-01-23-45

And it is Splitted in two parts as this.

00-14-22

and

01-23-45

First is determined by Organizationally unique identifier or it is called the "Vendor"

A Quoted definition of OUI

An Organizationally Unique Identifier (OUI) is a 24-bit number that uniquely identifies a vendor, manufacturer, or other organization globally or worldwide.

and Second block is a unique identifier, this value is not necessarily unique it could be repeated, because that 48 bits are not infinite or they could be spoofed, and bassically consist in use Third party software to change your current MAC address and appear to be another device in the network.


Here is a online site where you can lookup a vendor.

MAC Address Look-up

1

Every network device has got a MAC address that is a 48 bit identifier that uniquely and globally identifies the particular device. This address is burnt into the NIC during its fabrication.

The MAC address can be represented as xx:xx:xx:yy:yy:yy where each xx represents an octet (8 bits). xx and yy are in hexadecimal format.

Here, xx:xx:xx represent the manufacturer ID whereas yy:yy:yy represent the device ID manufactured by a given manufacturer. Further, no two manufacturers can have the same manufacturer ID and no two devices by the same manufacturer can have same device ID.

In this way, the uniqueness of MAC address is enforced.

However, remember that one manufacturer may have one or more manufacturer ID (in case it is manufacturing a lot of devices).

  • Note that the MAC address is sometimes stored in firmware, and it IS possible to have a conflict, for example if you set two MAC addresses to be the same. – ChrisInEdmonton Sep 4 '15 at 16:02
  • 4
    "no two devices by the same manufacturer can have same device ID" - wrong. In the past vendors have made mistakes and reused the same MAC address on multiple devices. – DavidPostill Sep 4 '15 at 16:05
  • "the uniqueness of MAC address is enforced" - also wrong. See MAC spoofing – DavidPostill Sep 4 '15 at 16:06
  • Well written but simply incorrect. Sadly I do not have sufficient rep to downvote! – Lightness Races in Orbit Sep 5 '15 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.