MAC Addresses and the Address Table

Every network interface has a MAC address (Media Access Control address), a unique hardware identifier burned into the device by its manufacturer. While IP addresses can change as a device moves between networks, the MAC address normally stays fixed with the hardware. Switches rely entirely on MAC addresses to forward frames, so understanding them is essential to understanding how a LAN works.

A MAC address is 48 bits long, usually written as twelve hexadecimal digits in six pairs, like 00:1A:2B:3C:4D:5E. Each pair represents one byte. The colons (or sometimes hyphens or dots) just separate the pairs for readability. This format gives a vast number of possible addresses, enough to uniquely identify network hardware worldwide.

A MAC address has two halves:

• First 24 bits — OUI (Organizationally Unique Identifier): identifies the manufacturer, assigned by the IEEE.
• Last 24 bits: a unique value the manufacturer assigns to that specific device.

Together they make each MAC globally unique. You can often look up the OUI to identify a device's maker.

The MAC is sometimes called the BIA (Burned-In Address) because it is set in the hardware's firmware. However, modern operating systems can spoof or override it in software, presenting a different MAC. Attackers may do this to bypass filters, and privacy features randomize MACs on Wi-Fi. So while normally fixed, a MAC is not truly unchangeable.

A switch keeps a MAC address table (also called a CAM table, for Content Addressable Memory) mapping each known MAC address to the switch port where that device lives. This table is the heart of switching: every forwarding decision checks it. The switch builds and updates it automatically by watching the source addresses of incoming frames.

The table populates through learning. Each time a frame enters a port, the switch reads its source MAC and records that MAC plus the incoming port number. If the same MAC later sends from a different port — because a device moved — the switch updates the entry. This continuous learning keeps the table matching the real network layout.

Most table entries are dynamic: learned automatically and aged out after a period of silence. Administrators can also add static entries that map a specific MAC to a port permanently, useful for important servers or for security. Static entries do not age out and override learned behavior, giving precise control where it matters.

The MAC table has a finite size. A switch can hold only so many entries. An attacker can exploit this with MAC flooding, sending many frames with fake source MACs to fill the table. When full, the switch may revert to flooding all frames like a hub, letting the attacker sniff traffic. Port security defends against this by limiting MACs per port.

Keep the two address types straight:

• MAC address — Layer 2, hardware, used within a local network by switches.
• IP address — Layer 3, logical, used to route between networks.

A device keeps its MAC across local moves but gets new IPs on new networks. Switches use MACs; routers use IPs. This division of labor is fundamental.

Not all MAC addresses point to one device. The special address FF:FF:FF:FF:FF:FF is the broadcast address, meaning every device on the local network. A normal device-specific MAC is a unicast address, and certain ranges are reserved for multicast groups. When a switch sees the broadcast destination, it floods the frame to all ports, which is how protocols like ARP reach every device at once.

For the exam, know that a MAC address is a 48-bit hardware address in twelve hex digits, with the first half being the manufacturer OUI. Switches store learned MAC-to-port mappings in the MAC address table, using dynamic entries that age out and optional static ones. Understand MAC flooding as an attack and that MAC is Layer 2 while IP is Layer 3.

Test your MAC address knowledge.

You learned that a MAC address is a 48-bit hardware identifier shown as twelve hex digits, split into a manufacturer OUI and a device portion. Though burned in, it can be spoofed. Switches keep a MAC address table (CAM table) mapping MACs to ports, filled by learning source addresses, with dynamic entries that age out and optional static ones. MAC flooding attacks the table's limited size; port security defends it. MAC is Layer 2; IP is Layer 3.