--- title: 'Ethernet and MAC Addresses' source: 'https://academia.sh/en/courses/network-models/ethernet-and-mac-addresses' course: 'Network Models and Protocols' language: en updated: '2026-08-17T18:07:08+00:00' license: 'CC BY-SA 4.0' --- # Ethernet and MAC Addresses The fields of the Ethernet frame, the bit structure of the 48-bit hardware address, broadcast addresses, and a switch's address-learning mechanism. The previous topic defined how data is wrapped across the layers and named the outermost wrapping the frame. The frame's contents, though, have not been opened yet: what fields does a frame consist of, and what does the address on it mean? This lesson's question is how devices sharing the same physical medium find each other. The answer lies in an addressing scheme that is entirely local, independent of network-layer addresses. ## The Ethernet Frame An Ethernet frame consists of the following fields: | Field | Size | Function | |---|---|---| | Destination address | 6 bytes | Hardware address of the device receiving the frame | | Source address | 6 bytes | Hardware address of the sending device | | Type / length | 2 bytes | The payload's protocol (`0x0800` IPv4, `0x86DD` IPv6, `0x0806` ARP) | | Payload | 46–1500 bytes | The network-layer packet being carried | | Frame check sequence | 4 bytes | Cyclic redundancy check (CRC-32) | Before the frame, a 7-byte preamble and a 1-byte start-of-frame delimiter are placed on the wire; the medium is left idle for 12 bytes between frames. These 20 bytes do not belong to the frame, but they consume time on the wire. The payload's **lower** bound is 46 bytes. If the payload is shorter, padding is added to fill it out to 46. The reason for this bound is collision detection: a frame must take long enough to reach the farthest device on the wire and return, or the sender finishes sending without noticing the collision. Together with the address and type fields, the smallest frame is $6 + 6 + 2 + 46 + 4 = 64$ bytes. The payload's **upper** bound is 1500 bytes — this is the MTU value defined in the previous lesson. The frame's own headers are outside this bound; the largest frame is 1518 bytes. The frame check sequence is a cyclic redundancy check computed over the entire frame. Unlike the checksum in the IP header, it also covers the payload and detects bit errors noticeably more strongly. If the check fails, the frame is **silently dropped**; Ethernet does not retransmit. Noticing and recovering from the loss is the job of the upper layers. ## The Structure of the MAC Address A **MAC address (media access control address)** is a 48-bit value that addresses a network interface at the physical level. It is written as six hexadecimal bytes separated by colons or hyphens: `00:00:5e:00:53:01`. The address consists of two parts: - **First 3 bytes:** the organizationally unique identifier. Assigned to the organization that manufactures the interface. - **Last 3 bytes:** the interface number the organization assigns itself. The first byte's lowest two bits carry a separate meaning, and are the first thing to check when reading an address: | Bit | Name | If 0 | If 1 | |---|---|---|---| | 0 (lowest) | I/G | Unicast address (single interface) | Group address (broadcast or multicast) | | 1 | U/L | Universally administered (assigned by manufacturer) | Locally administered (assigned locally) | The program below decodes these two bits. ```python def decode_mac(mac: str) -> None: bytes_ = [int(x, 16) for x in mac.split(":")] first = bytes_[0] kind = "group" if first & 0b1 else "unicast" source = "local" if first & 0b10 else "universal" print(f"{mac} first byte={first:08b} {kind:7s} {source}") for address in ("00:00:5e:00:53:01", # client on the example network "00:00:5e:00:53:00", # gateway's internal interface "ff:ff:ff:ff:ff:ff", # broadcast "01:00:5e:00:00:01", # IPv4 multicast "33:33:00:00:00:01", # IPv6 multicast "02:00:5e:00:53:2f"): # locally administered decode_mac(address) ``` Output: ``` 00:00:5e:00:53:01 first byte=00000000 unicast universal 00:00:5e:00:53:00 first byte=00000000 unicast universal ff:ff:ff:ff:ff:ff first byte=11111111 group local 01:00:5e:00:00:01 first byte=00000001 group universal 33:33:00:00:00:01 first byte=00110011 group local 02:00:5e:00:53:2f first byte=00000010 unicast local ``` The masking operations are a direct application of the method introduced in the Bit-Level Operations lesson of the How Computers Work course: `first & 0b1` isolates the lowest bit, `first & 0b10` isolates the next one. Three address classes are distinguished. `ff:ff:ff:ff:ff:ff` is the **broadcast** address; every interface on the local network processes this frame. Addresses starting with `01:00:5e:...` are for IPv4 multicast, those starting with `33:33:...` for IPv6 multicast; only interfaces that joined the relevant group process them. The rest are unicast addresses. Locally administered addresses are addresses that do not come from a manufacturer: virtual interfaces, container networks, and wireless clients that rotate their address for privacy use this block. In `02:00:5e:00:53:2f`, the second bit is set, so the address is local. ## The Scope of Addresses A MAC address is a **local** address. When a frame passes through a router, the frame is entirely rebuilt: the source address becomes the router's outgoing interface, and the destination address becomes the next device. The distinction emphasized in the previous topic becomes concrete here — link-layer addresses change at every hop, IP addresses do not. One consequence of this: a MAC address can be seen only by devices on the same local network. A remote server does not know the hardware address of the client connecting to it. ## How a Switch Learns Addresses A **switch** is a device that operates at the link layer and forwards frames only to the port they need to reach. It does not know in advance which address is on which port; it learns **by observing source addresses**. The rule has three steps: 1. An incoming frame's **source** address is written to the table together with the port it arrived on. 2. If the frame's **destination** address is in the table, the frame is forwarded only to that port. 3. If the destination address is not in the table, or is a group address, the frame is sent to every port except the one it arrived on. This is called **flooding**. On the switch in the example network's administration section, after the client sends its first frame to the gateway, the table becomes this: | MAC address | Port | How it was learned | |---|---|---| | `00:00:5e:00:53:01` | 4 | Source address of the frame the client sent | The gateway's address is not yet in the table; the client's frame goes to every port by flooding. When the gateway responds, its address is learned too: | MAC address | Port | How it was learned | |---|---|---| | `00:00:5e:00:53:01` | 4 | The client's frame | | `00:00:5e:00:53:00` | 1 | The gateway's response frame | Table entries are removed after an aging period; this lets the table correct itself when a device moves to a different port. One consequence of this learning method is that two addresses are not naturally learned together: if a device has never sent a frame, the switch does not know where it is, and every frame headed to it is flooded. ## Collision Domain and Broadcast Domain Two scope concepts must be distinguished. A **collision domain** is the set of devices where a collision can occur if they send at the same time. Every port of a switch is its own collision domain; on a link running full duplex, no collision occurs at all. A **broadcast domain** is the set of devices a broadcast frame reaches. Because a switch floods broadcast frames, it does not split the broadcast domain. The device that splits a broadcast domain is the router: a router does not pass broadcast frames to the other side. This distinction is one of the reasons the example network is split into sections. As the number of devices in a single broadcast domain grows, so does the work each broadcast frame creates: in a hundred-device broadcast domain, one broadcast frame causes ninety-nine unnecessary processing events. Putting the organization's sections into separate networks limits this load. The **virtual LAN (VLAN)** mechanism makes it possible to define multiple broadcast domains on a single physical switch: every port is tagged with an identifier, and frames do not pass between ports with different identifiers. The sections in the example network could just as well be separated this way, on one switch instead of separate switches; the address plan is the same either way. ## Summary - An Ethernet frame consists of a destination address, source address, type field, 46–1500-byte payload, and 4-byte check sequence; the smallest frame is 64 bytes, the largest 1518. - If the check sequence fails, the frame is silently dropped; recovering the loss is the job of the upper layers. - A MAC address is 48 bits; the first byte's lowest bit gives the unicast/group distinction, the next bit the universal/local distinction. - `ff:ff:ff:ff:ff:ff` is the broadcast address; the `01:00:5e:...` and `33:33:...` prefixes are for multicast. - A switch learns its address table by observing incoming frames' source addresses; it floods frames with an unknown destination. - A switch splits collision domains but not the broadcast domain; the device that splits the broadcast domain is the router. ## Next Step To send a frame, the destination's hardware address must be known. Yet applications specify the destination by IP address; a client knows it will send to `192.168.10.193`, but does not know which hardware address that corresponds to. The next lesson covers the address resolution protocol that bridges these two address spaces, and the security gap it leaves behind.