What is a MAC address?

MAC address

No, this MAC address has nothing to do with Apple. MAC stands for Media Access Control and operates at layer 2 of the OSI model.

What does look like?

A MAC address consists of six pairs of hexadecimal numbers. The format you will see it displayed the most is:

bc:d0:74:66:9b:5a

The first part (bc-d0-74) will tell you who the vendor is. You can use a tool that is called an OUI lookup tool to find out which vendor sold this network interface card.

In this case we see that the OUI belongs to Apple inc which is correct as I am writing this post on a Mac. 🙂

The second part is uniquely identifying this specific network interface. Note that a MAC address belongs to an interface and not to a computer. If you have 2 different network ports (one physical and on Wifi adapter, they each will have different MAC addresses.

What are they used for?

We already have IP addresses, why do we need another address? The answer is that we need this address to be able to ‘switch’ between computers on the same subnet/VLAN. Switching, unlike routing works with MAC addresses to get a packet to the destination.

So no routing … but how does switching work?

As I already told switching works based on MAC addresses. In a switched network a MAC address table is build, much like a routing table but for switching.

But how is this MAC address table build?

Every time a computer send something on a network it will send it’s source MAC address within the packet. This allows the switch to build a picture of where which MAC address is located. This way the switch knows that when it receives a packet with this MAC address as a destination, it should deliver it to that port AND that port ONLY.

OK, Nice! But what if the switch does not have the MAC address in its table? Then the switches will send it out each and every port except the one it received the packet on. Once this device that was the destination for this packet answers, it will mean that, as it has sent a reply with its MAC address it will be put into the MAC address table on the switch. This way the switch knows exactly where to send packets for that destination next time.

Limits of the MAC address table

Unfortunately, a switch has a limited amount of space in the MAC address table. As a consequence, if the MAC address table is totally full, it will remove the first ones it received and will welcome the new senders.

In the next article about MAC address we will cover some security features you can apply and why it is not a great idea to use all links between switches.

Categories

Latest articles

Latest comments

No comments to show.

All Splunk Posts