MAC Address Format: Structure, Length & Examples

A MAC address is a network identifier used at the data-link layer to help devices communicate across technologies such as Ethernet and Wi-Fi. MAC stands for Media Access Control, and the familiar MAC address format usually contains 48 bits divided into six groups of eight bits, called octets. Because binary addresses would be difficult to read, MAC addresses are normally displayed as 12 hexadecimal digits. A typical example looks like 00:1A:2B:3C:4D:5E, although hyphens and dotted formats are also commonly used. Network switches use MAC addresses when forwarding Ethernet frames across local networks. Understanding MAC address structure is therefore useful for networking, cybersecurity, troubleshooting, device management, and system administration.

MAC addresses are often described as permanent hardware addresses assigned by manufacturers, but modern networking is slightly more complicated. Some addresses are globally administered and originate from IEEE-assigned address blocks, while others are locally administered by software, administrators, virtualization platforms, or operating systems. Smartphones and computers increasingly use randomized or private Wi-Fi MAC addresses to reduce tracking across wireless networks. This means a MAC address does not always reveal the physical manufacturer of a device simply by examining its first characters. The address can also change depending on the interface or privacy settings being used. This guide explains MAC address length, hexadecimal notation, address structure, vendor identifiers, special bits, formatting styles, randomization, and practical examples.

What Is a MAC Address?

A MAC address is an identifier associated with a network interface that operates at the data-link layer of a local network. Ethernet adapters, Wi-Fi interfaces, access points, switches, printers, cameras, and many other network-capable devices use MAC addresses during local communication. When an Ethernet frame travels across a local network, it normally contains both a source MAC address and a destination MAC address. The source identifies the sending interface, while the destination tells network equipment where the frame is intended to go. Ethernet switches examine this information and maintain MAC address tables to make forwarding decisions. This happens below most of the application-level networking that ordinary users interact with.

The traditional Ethernet MAC address is generally 48 bits long, which equals six bytes or six octets. Because one hexadecimal character represents four binary bits, 48 binary bits can be written using 12 hexadecimal characters. Those digits may include the numbers 0 through 9 and letters A through F. The address 3C:52:82:11:A7:9D, for example, contains six pairs of hexadecimal characters. Each pair represents one octet, or eight bits, of the complete address. Hexadecimal notation provides a much shorter and more readable representation than writing all 48 bits as a sequence of ones and zeros.

A device can have more than one MAC address because MAC addresses belong to network interfaces rather than to the entire device in a simple one-address-per-machine relationship. A laptop may have one MAC address for its Ethernet adapter and another for its Wi-Fi interface. A smartphone may have a Wi-Fi MAC address while using entirely different identifiers for cellular communication. Virtual machines and software-defined network interfaces can also receive their own MAC addresses. Network administrators should therefore avoid assuming that one physical computer always equals one MAC address. Understanding the interface associated with an address is important when troubleshooting or creating network policies.

MAC addresses are most relevant within the local network or link on which the interface is communicating. When traffic crosses a router, the original Ethernet source and destination MAC addresses are generally replaced with addresses appropriate for the next link. The IP addresses may continue representing the original endpoints, but Layer 2 addressing changes as packets move through routed networks. This is why a remote website normally does not receive the hardware MAC address of a visitor’s laptop through ordinary internet routing. MAC addresses primarily help deliver frames locally. IP addresses, by contrast, are designed to support communication across interconnected networks.

A MAC address is sometimes called a physical address, hardware address, Ethernet address, or burned-in address, depending on the operating system and context. These labels can be useful, but “physical address” can create the impression that the value is always permanently fixed inside hardware. Many systems allow MAC addresses to be changed or overridden in software, at least temporarily. Virtualization environments routinely create software-defined MAC addresses, and modern mobile operating systems may intentionally randomize wireless addresses for privacy. The more accurate concept is that a MAC address identifies an interface for link-layer communication. Whether that address originated in hardware, software, or a privacy mechanism depends on the implementation.

MAC Address Format and 48-Bit Structure Explained

The most familiar MAC address format contains six octets, with each octet consisting of eight binary bits. Multiplying six by eight gives a total length of 48 bits. In hexadecimal notation, each octet appears as two characters, producing a total of 12 hexadecimal digits. For example, the address A4:5E:60:2C:91:07 contains the six octets A4, 5E, 60, 2C, 91, and 07. Separators such as colons make these groups easier for humans to recognize. If the separators were removed, the same 48-bit value could be written as A45E602C9107.

Hexadecimal notation is used because it maps cleanly onto binary while remaining reasonably compact. Each hexadecimal digit represents exactly four bits, so two hexadecimal digits represent one eight-bit byte. The hexadecimal value A, for example, corresponds to binary 1010, while F corresponds to binary 1111. A pair such as AF therefore represents the eight-bit pattern 10101111. Network engineers usually do not convert an entire MAC address into binary during everyday work, but understanding the relationship becomes useful when analyzing individual control bits. The first octet contains particularly important bits that indicate whether an address is individual or group-based and universally or locally administered.

A standard 48-bit MAC address provides an extremely large address space. With 48 available bits, there are 2^48 possible binary patterns, corresponding to more than 281 trillion theoretical values. Not every value can be assigned freely because parts of the address space have special meanings and structured allocation rules. Broadcast, multicast, vendor-assigned, and locally administered addresses all use particular patterns. IEEE registration systems also divide portions of the address space among organizations that manufacture or assign networking identifiers. This organization reduces the chance that independently produced network interfaces will accidentally receive identical globally administered addresses.

The term EUI-48 is commonly used when discussing globally unique 48-bit extended identifiers used as network addresses. Historically, the term MAC-48 also appeared in IEEE terminology, while modern guidance generally refers to EUI-48 identifiers. EUI stands for Extended Unique Identifier. The 48-bit structure is widely associated with Ethernet and IEEE 802 network technologies, which is why many people simply call every 48-bit identifier a MAC address. However, MAC addressing is a networking function, while EUI terminology describes the identifier format and assignment framework. For most beginners, remembering six octets and 12 hexadecimal digits is sufficient before exploring these standards in greater detail.

Not every networking identifier called an EUI is 48 bits long. EUI-64 uses 64 bits, or eight octets, and appears in other technical contexts. It should not be confused with the ordinary six-octet Ethernet MAC address most users see in operating-system network settings. Some networking procedures can derive 64-bit interface identifiers from 48-bit MAC addresses, although modern IPv6 privacy practices often avoid directly exposing stable hardware-derived identifiers. When someone asks for the standard MAC address length on Ethernet or Wi-Fi, 48 bits remains the normal answer. The familiar written representation therefore contains six hexadecimal pairs rather than eight.

Common MAC Address Notation Styles and Examples

Colon-separated notation is one of the most common ways to display a MAC address. In this style, each of the six hexadecimal octets is separated by a colon, as in 00:1A:2B:3C:4D:5E. Linux, macOS, network appliances, management tools, and many technical documents commonly use this style. Uppercase and lowercase hexadecimal letters normally represent the same numerical values, so AA:BB:CC:DD:EE:FF and aa:bb:cc:dd:ee:ff describe the same address. Software may choose one style for consistency. The important information comes from the hexadecimal digits and their order rather than whether letters are displayed in uppercase or lowercase.

Hyphen-separated notation is also widely recognized, particularly in Windows environments and administrative documentation. The same example address could appear as 00-1A-2B-3C-4D-5E rather than using colons. The underlying 48-bit value has not changed; only the visual separator is different. Software accepting MAC addresses may support both colon and hyphen formats, although configuration systems sometimes require one exact syntax. Copying an address between tools can therefore require replacing the separators. When a program rejects an otherwise correct MAC address, checking its expected formatting convention is a simple troubleshooting step.

Cisco networking equipment and documentation have traditionally made dotted hexadecimal notation especially familiar to network engineers. In this representation, the 12 hexadecimal characters are grouped into three blocks of four characters. The address 00:1A:2B:3C:4D:5E becomes 001A.2B3C.4D5E. Each dotted block represents 16 bits rather than the eight-bit groups emphasized by colon notation. The address still contains exactly the same 48 bits. Engineers working across Cisco devices, Windows computers, Linux servers, and monitoring systems regularly learn to recognize all three display styles as equivalent forms of the same MAC address.

A MAC address can also appear without separators, producing a continuous 12-character hexadecimal string such as 001A2B3C4D5E. Databases, APIs, inventory applications, and scripts sometimes store addresses this way because removing punctuation simplifies comparison and validation. Software can reinsert separators when presenting the value to users. When normalizing network data, administrators often remove colons, hyphens, and dots and convert letters to a consistent case before comparing addresses. This prevents formatting differences from making identical MAC addresses appear unrelated. Normalization becomes especially useful when combining device information from several monitoring platforms or operating systems.

Several recognizable special addresses are useful examples. FF:FF:FF:FF:FF:FF is the Ethernet broadcast address, meaning a frame using it is intended for all relevant devices on the local broadcast domain. The all-zero address 00:00:00:00:00:00 has special or unspecified meanings in certain contexts and should not be treated like an ordinary assigned interface address. Multicast MAC addresses follow group-address rules rather than representing one individual interface. Locally administered addresses can resemble normal MAC addresses but indicate that the value was assigned locally rather than through universal manufacturer allocation. Recognizing these categories helps administrators understand why not every 12-digit hexadecimal address represents an ordinary factory-assigned interface.

OUI, Vendor Prefixes, and the First Part of a MAC Address

A commonly taught explanation divides a traditional globally administered MAC address into two broad portions. The first 24 bits, or first three octets, are often associated with an Organizationally Unique Identifier, commonly shortened to OUI. IEEE assigns these address blocks to organizations, which can then use the remaining bits when creating unique interface identifiers. An address beginning with a particular vendor-controlled prefix may therefore suggest which organization received that block. Network inventory tools often use IEEE registration information to display a likely manufacturer beside a MAC address. This capability can be helpful when identifying unknown equipment connected to a network.

Consider a simplified example such as 00:1A:2B:7C:8D:9E. In a traditional OUI-based explanation, 00:1A:2B represents the organization-related portion, while 7C:8D:9E forms the interface-specific portion assigned within that block. The manufacturer needs to avoid duplicating the lower portion within the relevant assignment so globally administered addresses remain unique. This creates a structured alternative to every manufacturer independently choosing random 48-bit values. IEEE registration authorities manage several types of MAC address assignments today, so real allocation structures can be more nuanced than the classic 24-bit OUI explanation. The OUI model nevertheless remains extremely useful for introductory networking.

Vendor lookup can help administrators identify unfamiliar devices, but it should not be treated as definitive proof of the device’s identity. A MAC address may belong to a network adapter manufactured by a different company from the computer containing it. USB Ethernet adapters, Wi-Fi chipsets, virtual interfaces, and embedded modules can therefore produce vendor results that surprise users. An address can also be changed or spoofed in software. Locally administered addresses may have no meaningful manufacturer prefix at all. Vendor information should therefore be combined with DHCP records, switch-port information, hostnames, authentication logs, and other network evidence when identifying devices.

Modern IEEE allocation systems also include address blocks of different sizes rather than relying only on the classic large OUI-based assignment model. Organizations with smaller address requirements can obtain smaller allocations, while larger manufacturers may manage broader address spaces. This means describing every first three-octet prefix as a complete manufacturer identity can oversimplify modern address administration. From an SEO and beginner-learning perspective, the key concept is that globally administered MAC addresses can contain an IEEE-assigned organizational portion. The exact allocation boundaries depend on the registration block involved. Understanding that nuance prevents a useful introductory rule from becoming an incorrect universal assumption.

MAC randomization further reduces the reliability of vendor identification. Modern smartphones, tablets, laptops, and other devices may use private Wi-Fi addresses generated by the operating system instead of transmitting the factory hardware address on every wireless network. These addresses are generally created as locally administered values, signaling that they were not assigned through the ordinary universal manufacturer process. A vendor lookup may therefore return no manufacturer or provide misleading information if the tool ignores the local-address bit. This behavior is intentional because stable hardware identifiers can make devices easier to track between networks. Network administrators increasingly need to account for privacy addresses when designing access-control and inventory systems.

Unicast, Multicast, Broadcast, and Locally Administered MAC Addresses

Two important control bits are located within the first octet of an IEEE MAC address. The least significant bit is commonly called the Individual/Group, or I/G, bit. When this bit is 0, the address represents an individual destination, commonly described as a unicast MAC address. When the bit is 1, the address represents a group destination and can be associated with multicast addressing. This allows Ethernet frames to target either one interface or a defined group of interested receivers. Understanding this bit is especially useful when reading protocol captures or determining why a destination MAC does not resemble a normal host address.

The next least significant bit in the first octet is the Universal/Local, or U/L, bit. A value of 0 indicates universal administration under the relevant IEEE assignment framework, while a value of 1 indicates a locally administered address. Locally administered MAC addresses may be created manually by an administrator, generated for virtual machines, assigned by software, or produced by privacy features. They remain valid for local link-layer communication when managed correctly. However, they do not carry the same guarantee of globally coordinated assignment as universal addresses. Whoever creates local addresses must therefore avoid collisions within the network where they are being used.

The distinction between local and universal administration explains why a MAC address can change even though many textbooks describe it as permanently assigned hardware information. An operating system can present a locally administered value while leaving the factory address unchanged inside the adapter. This feature has existed for many years and is sometimes called MAC spoofing or MAC cloning, depending on why the change is made. Legitimate uses include testing, virtualization, network migration, compatibility requirements, and privacy. Malicious users can also alter addresses to bypass weak MAC-based restrictions. Consequently, MAC address filtering should not be treated as a strong authentication mechanism by itself.

Broadcast communication is another important MAC addressing category. The Ethernet broadcast address is FF:FF:FF:FF:FF:FF, containing hexadecimal F in every position. A switch generally floods an Ethernet broadcast frame through the appropriate ports within the same Layer 2 broadcast domain, subject to VLAN and security rules. Protocols such as ARP and DHCP can rely on broadcast behavior during parts of their normal operation. Routers normally separate broadcast domains rather than forwarding ordinary Layer 2 Ethernet broadcasts between unrelated IP networks. This keeps broadcasts local and helps networks scale without every device receiving traffic generated throughout an entire organization.

Multicast addresses provide a middle ground between one-to-one unicast and one-to-everyone broadcast. They allow a frame to be addressed to a group of receivers interested in a particular network service or protocol. IPv4 and IPv6 multicast traffic can be mapped to corresponding Ethernet multicast MAC address ranges. Network switches may use features such as IGMP snooping or multicast listener information to avoid flooding all multicast traffic everywhere unnecessarily. Multicast appears in applications including discovery protocols, streaming, routing protocols, and infrastructure services. Recognizing whether a MAC is individual, group-based, universally assigned, or locally administered gives administrators much more information than simply reading its hexadecimal characters.

MAC Address vs. IP Address: What Is the Difference?

A MAC address and an IP address both help deliver network traffic, but they operate at different layers and solve different problems. A MAC address is primarily used for communication on a local data-link network, while an IP address supports logical addressing and routing across multiple networks. Ethernet switches make forwarding decisions using MAC addresses, whereas routers primarily make forwarding decisions using IP addresses. A computer connected to the internet therefore commonly uses both addressing systems simultaneously. The IP address identifies where the packet needs to travel across networks, while the MAC address helps deliver each frame across the current local link.

When one IPv4 device needs to communicate with another device on the same Ethernet network, it may use the Address Resolution Protocol, or ARP, to determine which MAC address corresponds to the destination IPv4 address. The sender can then place that MAC address into the Ethernet frame containing the IP packet. If the destination is on another network, the sender usually sends the frame to the MAC address of its default gateway instead. The router removes that frame, processes the IP packet, and creates another link-layer frame for the next connection. This process illustrates why MAC addresses normally change between routed links while IP addressing maintains end-to-end routing information.

IPv6 uses Neighbor Discovery rather than ordinary IPv4 ARP to perform related local-link functions. Neighbor Discovery helps devices discover nearby nodes, routers, and link-layer addresses through ICMPv6 messages. The underlying concept remains similar: the system needs an appropriate Layer 2 destination to place an IP packet onto the local network. Modern IPv6 addressing also emphasizes privacy mechanisms that reduce the need to expose stable hardware-derived identifiers. This becomes important because early IPv6 techniques could create interface identifiers related to MAC addresses. Contemporary operating systems often generate addresses using privacy-conscious methods instead.

IP addresses can change frequently depending on network configuration. A laptop may receive one private IPv4 address at home, another at work, and a different one at a hotel through DHCP. Its globally assigned hardware MAC might remain unchanged, although Wi-Fi privacy features can cause the address presented to each wireless network to differ as well. MAC addresses and IP addresses are therefore no longer accurately described as simply “permanent hardware” versus “temporary software.” Both can change under different circumstances. Their more important difference is the networking role each address plays within the protocol stack.

Knowing the distinction becomes useful during troubleshooting. If a computer has a valid MAC address but cannot obtain an IP configuration, the physical and link layers may be working while DHCP or another network-layer configuration process has failed. If an IP address appears in an ARP table with an unexpected MAC address, administrators may investigate address changes, duplicate IPs, virtualization, or security problems. Switch logs can show where a MAC address was learned physically, while routing tables explain where IP networks are reachable. Using both types of information allows engineers to follow communication from the local Ethernet segment through routed infrastructure.

How Switches and Wi-Fi Networks Use MAC Addresses

Ethernet switches learn MAC addresses by observing the source address of frames arriving on their ports. If a frame with source MAC A0:B1:C2:D3:E4:F5 arrives on port 10, the switch can associate that MAC address with port 10 in its forwarding table. When another device later sends a frame to that destination, the switch knows where to forward it instead of sending it through every port. These learned entries usually expire after a period of inactivity so the table can adapt when devices move. This dynamic learning behavior is one of the core reasons switched Ethernet networks can operate efficiently.

When a switch receives a frame whose destination MAC address is not yet present in its table, it may flood the frame through other eligible ports within the same VLAN. Once the destination device replies, the switch learns where that source MAC lives and future traffic can be forwarded more precisely. Broadcast frames are also flooded within their appropriate broadcast domain because they are intentionally addressed to everyone on that Layer 2 segment. Multicast handling depends on switch features and configuration. Network administrators can inspect MAC address tables to determine which switch port is currently associated with a particular endpoint.

Wi-Fi also uses MAC addressing, although IEEE 802.11 wireless frames can contain additional address fields because access points and wireless distribution systems introduce more complex forwarding relationships. A client’s Wi-Fi MAC address helps the access point identify the station participating in the wireless network. Authentication systems, DHCP servers, captive portals, and management platforms may record that address as part of device activity. Because a stable Wi-Fi MAC can help networks recognize the same device repeatedly, privacy concerns encouraged operating-system developers to adopt private or randomized addresses. Modern wireless administration therefore cannot always assume that a phone will present its factory MAC.

DHCP servers commonly record MAC-related client identifiers when assigning IPv4 addresses, which allows administrators to connect network-layer activity with a particular interface. Home routers often display a list of connected clients containing hostnames, assigned IP addresses, and MAC addresses. Administrators can also create DHCP reservations so a particular client receives a predictable IP address. However, randomized MAC addresses can cause a device to appear as a new client when its private address changes. Modern network-management systems increasingly need identity information beyond a static hardware address. User authentication, device certificates, and endpoint-management platforms can provide more reliable identity in managed environments.

MAC addresses also appear in security and troubleshooting tools such as packet analyzers, wireless controllers, network access-control systems, and intrusion-detection platforms. A packet capture can show source and destination Layer 2 addresses alongside IP, TCP, UDP, DNS, and application information. This helps engineers determine which device actually transmitted a frame on the local network. However, a captured MAC address should still be treated as one piece of evidence rather than absolute proof of identity because addresses can be changed. Effective network investigation combines MAC information with switch ports, authentication events, timestamps, DHCP leases, IP addresses, and other contextual data.

MAC Randomization, Privacy, and Modern Addressing

MAC randomization was developed partly because a stable wireless hardware address can be used as a persistent identifier. If a phone exposes the same Wi-Fi MAC address while interacting with many wireless environments, observers may be able to associate network activity with the same device over time. Modern operating systems therefore increasingly use randomized addresses during Wi-Fi scanning and connection. A private address can be unique to a particular network rather than following the device everywhere. This reduces the usefulness of the MAC address as a cross-network tracking identifier. The feature improves privacy without changing the basic 48-bit MAC address format used for wireless communication.

A randomized Wi-Fi MAC address is generally created as a locally administered address rather than pretending to be a universally assigned manufacturer address. The U/L bit signals this local administration within the MAC structure. To most normal network functions, the address still behaves like a usable individual MAC address. The access point can learn it, DHCP can assign an IP address to it, and network traffic can flow normally. What changes is the relationship between the presented address and the permanent identifier associated with the hardware. The network may see a privacy address instead of the factory value printed in device diagnostics or stored by the adapter manufacturer.

Private addressing can create challenges for networks that rely heavily on MAC addresses for identification. A school, office, hotel, or home router may have rules that associate permissions, reserved IP addresses, or parental controls with a particular MAC. If a device begins using a different private address, the network can interpret it as a completely new endpoint. Modern operating systems therefore often allow private-address behavior to be controlled on a per-network basis. Managed enterprise systems may also use stronger authentication methods that do not depend on permanent MAC identity. Device certificates and user-based access provide better foundations for security than simple MAC allowlists.

Virtual machines and containers provide another reason locally administered MAC addresses are common. Hypervisors may generate addresses for virtual network adapters so many software-defined machines can communicate through physical infrastructure. Cloud platforms can manage huge numbers of such virtual interfaces without each one having a factory-burned network card. Administrators must ensure the generated addresses remain unique within the relevant Layer 2 environment. Duplicate MAC addresses can confuse switches and cause traffic to move toward the wrong port or virtual interface. Automated address-management systems therefore play an important role in large virtualized environments.

These changes do not make the traditional MAC address format obsolete. Ethernet and Wi-Fi still depend heavily on 48-bit link-layer addressing, but the assumptions surrounding those addresses have evolved. A MAC address may be globally assigned, locally configured, virtualized, randomized, or temporarily replaced by software. Vendor lookup is therefore less definitive than it once appeared, and MAC filtering provides limited security when used alone. The modern understanding of MAC addresses focuses on their networking function rather than treating them as permanent digital serial numbers. That perspective makes the familiar 12-digit hexadecimal format easier to understand in today’s privacy-conscious and software-defined networks.

Frequently Asked Questions About MAC Address Format

What is the standard MAC address format?

A standard Ethernet MAC address is typically 48 bits long and written as 12 hexadecimal digits divided into six octets. A common example is 00:1A:2B:3C:4D:5E.

How many characters are in a MAC address?

A 48-bit MAC address contains 12 hexadecimal characters when separators are ignored. Colons, hyphens, or dots may be added for readability, so the visible character count depends on the notation style.

Why do some MAC addresses use colons and others use hyphens?

Colons and hyphens are simply different ways of formatting the same 48-bit value. Cisco systems may also use dotted notation such as 001A.2B3C.4D5E.

Can a MAC address change?

Yes. Operating systems, virtualization software, administrators, and privacy features can use locally administered or randomized MAC addresses instead of the original hardware-assigned value.

What does the first half of a MAC address mean?

In the classic globally administered EUI-48 model, the early portion can identify an IEEE-assigned organizational address block associated with a manufacturer or organization. However, locally administered and randomized addresses may not contain meaningful vendor information.