Every device on your network has at least two addresses, a MAC address and an IP address, and it's easy to assume they're two names for the same thing. They aren't. One gets data across the local link to the next device, the other gets it across the whole internet to its destination, and most network puzzles get easier once you know which one is doing the work.
A MAC address is a hardware-level address used only on the local network segment, your Wi-Fi or your Ethernet switch. It looks like 00:1A:2B:3C:4D:5E: six bytes, written in hex.
An IP address is a logical address used end to end, from your device to a server on the other side of the world. It looks like 192.0.2.15 or 2001:db8::15.
The simplest way I've found to keep them apart: the IP address says where the data is ultimately going, and the MAC address says which device on this particular wire should pick it up next.
In networking-model terms, MAC addresses belong to layer 2 (the data link) and IP addresses to layer 3 (the network). You don't need the model to use either, but it explains why they never compete: each layer does a different job.
Say your laptop at 192.168.1.20 wants to load a page from a server at 203.0.113.80.
That repeats at every hop. The MAC addresses get rewritten each time, while the destination IP address stays the same all the way (NAT changes the source address along the way, which we cover in NAT and port forwarding explained).
The practical consequence: a website never sees your MAC address. By the time your traffic leaves your router, your device's MAC is gone. The server only sees an IP address, normally your router's public one, which you can check with our IP lookup.
You can see your device's ARP cache, the table of IP-to-MAC mappings it has learned:
arp -aThat works on Windows, macOS and Linux. On modern Linux the preferred command is:
ip neigh(IPv6 does the same job with Neighbor Discovery rather than ARP, but the idea is identical, and ip neigh shows both.)
Windows:
ipconfig /allEach adapter lists a "Physical Address" (the MAC) and its IPv4 and IPv6 addresses. For just the MACs:
getmac /vmacOS:
ifconfig en0The ether line is the MAC, inet is IPv4, inet6 is IPv6. On most Macs en0 is Wi-Fi, but check with networksetup -listallhardwareports if you're not sure. Note that on Wi-Fi this shows the address in use on the current network, which may be a private one (more on that below).
Linux:
ip link show
ip addr showlink/ether is the MAC; inet and inet6 are the IP addresses.
iPhone and Android: both show a Wi-Fi address in the network's details screen. On an iPhone, tap the (i) next to the network; on Android it's in the network details, sometimes under Advanced. Again, that's usually the randomised address for that network, not the hardware one.
The IP address these commands show is your private, local one. Your public address is different, and it belongs to your router. What is my IP address covers the distinction.
A traditional MAC address is 48 bits. The first 24 bits are the OUI (organisationally unique identifier), a prefix the IEEE assigns to a manufacturer, and the manufacturer fills in the rest. That's why an OUI lookup can tell you a device was made by a particular network card or phone maker, which is handy when you're trying to identify an unknown device in your router's client list.
Two bits in the first byte carry meaning. The lowest bit marks multicast versus unicast. The next bit up is the "locally administered" bit: 0 means a manufacturer-assigned address, 1 means software made it up. You can spot a locally administered address by eye, because the second hex digit will be 2, 6, A or E. 02:1A:2B:3C:4D:5E is locally administered; 00:1A:2B:3C:4D:5E isn't.
Virtual machines, containers and, increasingly, phones and laptops all use locally administered addresses.
MAC addresses were meant to be permanent, and that made them a tracking identifier. A phone scanning for Wi-Fi broadcasts its MAC, so anything listening in a shop or a station could recognise the same device visit after visit. The major operating systems now randomise by default or offer to.
This is good for privacy and occasionally annoying at home. A DHCP reservation or parental-control rule keyed to a MAC address stops matching when the device shows up with a different one, and the router's client list fills up with "new" devices. For your own home network, it's reasonable to set the private address to Fixed or turn it off for that one network, and leave it on everywhere else.
Firewall rules, allowlists, port forwarding: IP addresses. That's the layer the router is making decisions on. If you want a device to keep the same IP, use a DHCP reservation, which is one of the few places the MAC address matters at home.
MAC filtering on Wi-Fi: it's weak security. MAC addresses are sent unencrypted in every frame, so anyone nearby can see an allowed one and copy it. Use WPA2 or WPA3 with a strong passphrase instead.
Wake-on-LAN: uses the MAC, because a sleeping machine has no working IP stack to address.
Privacy online: your IP address is what sites see. Your MAC stays on your local network, with one historical exception: old-style IPv6 addresses embedded the MAC in the address itself. Modern systems avoid that, as explained in why your IPv6 address keeps changing.
No. The MAC address is replaced at every router hop, so it never leaves your local network. A website sees your public IP address, and sometimes an IPv6 address, but not your MAC.
They shouldn't on the same network, and if they do, both will have intermittent connectivity. It happens mostly with cloned virtual machines or a MAC set manually. Across different networks, duplicates don't matter.
The hardware address is fixed, but the one your device uses on Wi-Fi may not be. With randomisation on, it's typically different per network, and may rotate over time.
Only loosely. A DHCP server usually gives the same device the same local IP based on its MAC, which is why randomised MACs can cause a device to get a new local address. Your public IP has no link to your MAC at all.
0 comments
No comments yet. Be the first.