Not the address of the US Federal Cheese Repository…
I was recently asked by one of the managers at an organization to explain what a MAC Address was and what role it plays in the network. Trying to find out what he already knew, I asked, “What do you think a MAC address might be?” The answer I got was: “The mailing address of the warehouse where they make Mac & Cheese?” (sigh) I see my work is cut out for me. (To be fair, it was cold out and nearly lunchtime!) “Go ahead and slip some lunch into the microwave oven and while we’re waiting for it to heat up, I’ll try to explain things,” I said with as much patience as I could muster.
Addresses: Where Do You Want To Go?
All information sent on an Ethernet LAN network is broken up into “Frames” for easy transport. Like packages or envelopes passing through post offices, these frames need to be labeled with an address, which enables anything handling that frame to know where to send the LAN frame and to whom the LAN frame is being sent. The same type of LAN address scheme is used to identify the senders of these Frames so that replies can be sent.The addresses used in an Ethernet network are known as MAC (Media Access Control) addresses. MAC Addresses are used in Ethernet, WiFi, Bluetooth, and a number of other network types. Let’s take a look at a typical Ethernet Frame:
Figure 1: A Standard Ethernet Frame
You can see the MAC Destination and MAC Source addresses in the typical Ethernet Frame shown in Figure 1. (See the 3rd and 4th fields.) In order to speed up LAN equipment, the Destination address and Source (Sender) address are sent in the very first parts of a frame. This enables LAN equipment to more quickly sort network traffic and determine whether a network frame needs attention from them.
Writing MAC Addresses
MAC Addresses are 6 bytes (or 48 bits long), providing 281,474,976,710,656 addresses in theory. In order to make these addresses easier for humans to remember, these addresses are usually written as six two-digit hexadecimal numbers, such as 01:23:45:67:89:AB. Some other, less common notations may write the same MAC address as: 01:23:45:67:89:ab, 01-23-45-67-89-AB, or 0123.4567.89ab.
Like phone numbers, there are supposed to be no duplicate addresses within the same network. In order to keep track of addresses, and establish some order, addresses are broken up into “chunks,” somewhat like area-codes. Dividing up the MAC addresses, has made it easier for creators of networking equipment to each own a “block” of addresses that they can pick address numbers from.
Dissecting a MAC Address
Figure 2: Parts of a MAC Address
The first three bytes of a MAC address were originally known as OUI’s, or Organizational Unique Identifiers. Each manufacturer of networking equipment was assigned an OUI, and was free to assign their own numbers in that block. If you were assigned an OUI of 01:23:45, the network equipment you manufactured would typically be numbered from 01:23:45:00:00:01 through 01:23:45:FF:FF:FE and you could be reasonably certain that other manufacturers would not use your numbers. So, to summarize, the first three bytes (depicted in orange) are assigned to a manufacturer of networking equipment and the manufacturer assigns the last three bytes of an address (depicted in blue).
“Special” Address Numbers
There are some addresses that are used for special purposes. A frame addressed to FF:FF:FF:FF:FF:FF is known as a “broadcast” and is received by every device on a network segment. (You can think of this as the equivalent of walking into a room, and yelling, “Hey, all of you listen up!”) Similarly, packets could be broadcast to all equipment of a particular brand by using the manufacturer’s 3-byte OID paired with a value of “FF:FF:FF” for the 3-byte NIC (blue) portion of the address. (For example, packets addressed to 01:23:45:FF:FF:FF will be received by every device with an address starting with 01:23:45.)
In more current versions of Ethernet, the first byte of the MAC address has some special properties. If the lowest bit in the first byte of an address is a ‘1’ (making it an odd number), the Ethernet frame that follows may be a multi-cast packet, which is like a limited broadcast that is sent on the network once but may be received by multiple endpoints at the same time. (This multitasking technique is typically used for applications such as video, which can be sent on the network once, and viewed by many devices at the same time.)
So What?
What good is it that we know the address format of a LAN frame? This can be a key way to find the source of a network problem!
If your network equipment is complaining that it is seeing strange network packets coming from a particular MAC Address, you may be able to tell the manufacturer of that equipment by looking at the first three bytes of the MAC Address. Why not use the Layer 3 IP/Internet address to identify a bad network device? For any devices such as IP Phones that use DHCP to assign IP addresses, a network device may change IP Addresses every time that it is reset, making it difficult to positively identify a network device.
Looking up OID’s: Manual or Automatic?
While some network management systems may show you an ethernet address, they will generally not decode them for you.
You can manually look up an OID address prefix with the IEEE organization that assigns them, but PathSolutions provides a much more convenient way of accessing the manufacturer information.
The latest version of PathSolutions software includes a new feature that integrates MAC Address decoding with the User Interface. If you are looking at an Ethernet MAC Address within the software, you need only hover your mouse over the address in order to find the manufacturer information from the OID portion of the address. Frequently this information is just enough to allow a network administrator to tell if that MAC address belongs to an IP Phone or a user laptop, saving valuable time in tracking down and fixing network problems.
Until Next Time!
So, know you know what a MAC address is, and that we can frequently use the first three bytes of a MAC address to find out useful information about the manufacturer of that network device.
If your network management system isn’t pinpointing your network performance issues down to the actual device, and you are still looking up Ethernet addresses manually, you owe it to yourself to take the latest version of our software out for a test drive!
(DING!) And now I’m off to eat my cheese and pasta treat – hopefully someplace without getting any additional interruptions. I hope YOU have a good lunch too!
In case you wanted some reading material to learn more about Ethernet Addresses, or you are already an expert looking for the latest detailed technical updates, here are some helpful links from the IEEE Registration Authority:
