Ethernet and MAC Addresses

What Ethernet is

Ethernet is the family of technologies for wired local area networks standardized by the Institute of Electrical and Electronics Engineers (IEEE) as 802.3. It spans two OSI layers: at layer 1 it defines cables, signals and speeds (see Cabling and the Physical Layer), and at layer 2 it defines the frame format and the MAC addresses that let devices on the same LAN reach each other.

Ethernet was invented in the 1970s, standardized in 1983, and has since grown from 10 Mbit/s over shared coax to 400 Gbit/s and beyond (800 Gbit/s since 2024) over fiber — while keeping the same frame format. That backward compatibility is why it beat every competitor. Wi-Fi (IEEE 802.11) is a different standard, but it uses the same kind of 48-bit MAC addresses, so wired and wireless devices share one LAN seamlessly.

The Ethernet frame

Everything Ethernet carries travels inside a frame. The layout is fixed, so every network card and switch in the world can read it.

Frame sizes and the FCS

A frame is at least 64 bytes (14 bytes header, 46 bytes payload, 4 bytes FCS) and at most 1518 bytes with a 1500-byte payload. An IEEE 802.1Q VLAN (virtual LAN) tag inserts 4 more bytes after the source MAC, allowing 1522 bytes; see Switching and VLANs. A value of 1536 (0x0600) or more in the type field is an EtherType; a value of 1500 or less is the payload length, used by an older frame variant.

The receiver recalculates the checksum over the received frame and compares it with the FCS. If they differ, the frame was damaged on the way and is dropped silently — Ethernet does not ask for it again. The interface counts it as a CRC error, and higher layers (the Transmission Control Protocol, TCP) notice the missing data and resend it. Frames shorter than 64 bytes are counted as runts, frames longer than the maximum as giants.

MAC addresses

A MAC address (Media Access Control address) is the 48-bit layer 2 address of a network interface. The manufacturer stores it in the hardware (so it is also called the burned-in address or physical address), and it identifies the interface on the local network. Every network interface has one: each Ethernet port, each Wi-Fi adapter, each switch and router interface.

A MAC address only matters on the local link. Frames carry MAC addresses from one device to the next; routers replace them at every hop, while the IP addresses stay the same end to end. To find the MAC address that belongs to an IP address, a host uses the Address Resolution Protocol; see ARP and ICMP.

Notation

48 bits are six bytes, written as twelve hexadecimal digits (see Number Systems). Different systems group them differently; all three below are the same address:

Upper or lower case makes no difference. The addresses on this site come from the block 00-00-5E-00-53-00 to 00-00-5E-00-53-FF, which RFC 9542 (formerly RFC 7042) reserves for documentation.

The OUI

The first 24 bits (three bytes) of a universally administered MAC address are the Organizationally Unique Identifier (OUI), a number the IEEE assigns to each manufacturer. The last 24 bits are chosen by the manufacturer, one value per interface it builds. Because the OUI is public, you can look up the vendor of a device from its MAC address — handy when an unknown device shows up on a switch port. (The OUI 00-00-5E in the documentation addresses belongs to the Internet Assigned Numbers Authority, IANA.)

Unicast, multicast and broadcast

A destination MAC address can address one interface or a group. Two bits in the first byte say which, and who assigned the address:

• The I/G bit (individual/group), the least significant bit of the first byte: 0 for a unicast address (one interface), 1 for a group address.
• The U/L bit (universal/local), the second-least significant bit: 0 when the address is universally administered (from an OUI), 1 when it is locally administered — set by software, as virtual machines do and as phones do when they use a random "private" Wi-Fi address.

Group addresses come in two kinds:

• A broadcast is a frame sent to every device on the local network, using the destination MAC address FF:FF:FF:FF:FF:FF (all 48 bits set). A switch floods it out of every port in the VLAN except the one it came in on. ARP requests and Dynamic Host Configuration Protocol (DHCP) discovery use broadcasts, because the sender does not yet know whom to ask.
• A multicast is a frame sent to a group of interested devices rather than to one or all. Multicast MAC addresses have the I/G bit set: IPv4 multicast maps to addresses starting with 01:00:5E, IPv6 multicast to addresses starting with 33:33.

A source MAC address is always unicast. Python can read the two bits of any address, whatever notation it uses:

def describe(mac):
    digits = "".join(ch for ch in mac if ch in "0123456789abcdefABCDEF")
    octets = bytes.fromhex(digits)            # 6 bytes
    first = octets[0]
    ig = first & 0b01                         # I/G bit: 1 = group
    ul = (first >> 1) & 0b1                  # U/L bit: 1 = locally administered
    if octets == b"\xff" * 6:
        kind = "broadcast"
    elif ig:
        kind = "multicast"
    else:
        kind = "unicast"
    oui = bytes([first & 0b11111100]) + octets[1:3]
    owner = "local" if ul else "OUI " + oui.hex("-").upper()
    return f"{mac:<18} I/G={ig} U/L={ul}  {kind:<9}  {owner}"

for mac in ["00:00:5e:00:53:01", "0000.5e00.5302", "02-00-5E-00-53-10",
            "01-00-5E-90-10-01", "FF-FF-FF-FF-FF-FF"]:
    print(describe(mac))

00:00:5e:00:53:01  I/G=0 U/L=0  unicast    OUI 00-00-5E
0000.5e00.5302     I/G=0 U/L=0  unicast    OUI 00-00-5E
02-00-5E-00-53-10  I/G=0 U/L=1  unicast    local
01-00-5E-90-10-01  I/G=1 U/L=0  multicast  OUI 00-00-5E
FF-FF-FF-FF-FF-FF  I/G=1 U/L=1  broadcast  local

The third is the documentation address 00-00-5E-00-53-10 with the U/L bit turned on, as a virtual machine or a phone with a private address would use. The fourth comes from the multicast documentation block 01-00-5E-90-10-00 to 01-00-5E-90-10-FF (RFC 9542, formerly RFC 7042). The bytes and bit operators are explained on Boolean Logic.

CSMA/CD: how Ethernet used to share a cable

Early Ethernet put every device on one shared medium: a coax bus, and later a hub that repeated every signal to every port. Only one device could send at a time, so Ethernet used Carrier Sense Multiple Access with Collision Detection (CSMA/CD):

1. Carrier sense: listen first; send only when the medium is quiet.
2. Multiple access: all devices share the same medium on equal terms.
3. Collision detection: if two devices start at the same moment, their signals collide. Both notice, send a short jam signal, wait a random time (which grows after repeated collisions) and try again.

The 64-byte minimum frame size comes from this era: a frame had to last long enough for the sender to detect a collision from the far end of the cable while it was still sending.

A modern switched network does not need any of this. Every device has its own cable to a switch port, and twisted pair has separate pairs for sending and receiving, so both ends can send at the same time without ever colliding. On a full-duplex link CSMA/CD is simply switched off. It still exists in the standard, but you will only see it on a half-duplex link — which today usually means something is misconfigured. Wi-Fi, which really does share one medium, uses a related method, CSMA/CA (collision avoidance); see Wireless Networking.

Duplex and speed

Duplex describes whether both ends of a link can send at the same time. In half duplex, like a walkie-talkie, only one side sends at a time, and CSMA/CD manages the turns. In full duplex, like a telephone call, both sides send and receive simultaneously. A 1 Gbit/s full-duplex link can carry 1 Gbit/s in each direction at once. Every switch-to-device link today should be full duplex.

Autonegotiation

Autonegotiation lets the two ends of a twisted-pair link advertise the speeds and duplex modes they support when the link comes up, and pick the best mode both have in common. It is on by default, and for 1000BASE-T and faster copper it is required. The best practice is simple: leave autonegotiation on at both ends.

The trouble starts when one end is hard-coded and the other is on auto. The auto side no longer receives an advertisement. It can still sense the speed from the signal, but not the duplex, so the standard tells it to fall back to half duplex at 10 and 100 Mbit/s. If the other end was hard-coded to full duplex, the result is a duplex mismatch.

Duplex mismatch

A link with a duplex mismatch comes up and passes a ping — which is what makes it treacherous — but becomes very slow as soon as real traffic flows in both directions. The two sides show different symptoms:

• The half-duplex side sees the other side sending while it sends itself, treats that as a collision and counts late collisions (collisions after the first 64 bytes, which never happen on a correct link).
• The full-duplex side receives frames that the half-duplex side cut off halfway, and counts CRC errors and runts.

On a Cisco switch, check what each port negotiated:

Switch1# show interfaces status

Port      Name               Status       Vlan       Duplex  Speed Type
Gi1/0/1   Printer-floor2     connected    10         a-full a-1000 10/100/1000BaseTX
Gi1/0/2                      notconnect   1            auto   auto 10/100/1000BaseTX
Gi1/0/3   Camera-entrance    connected    20         a-half  a-100 10/100/1000BaseTX

• a-full a-1000: autonegotiated to full duplex at 1000 Mbit/s — the normal result.
• notconnect with auto auto: nothing is plugged in; the port is set to autonegotiate.
• a-half a-100: the port ended up at half duplex. A current device almost never wants that, so the camera is probably hard-coded to 100/full: a duplex mismatch.

The fix is to set both ends the same way — preferably both to auto. On the switch:

Switch1# configure terminal
Switch1(config)# interface GigabitEthernet1/0/3
Switch1(config-if)# speed auto
Switch1(config-if)# duplex auto
Switch1(config-if)# end

• configure terminal enters global configuration mode; interface GigabitEthernet1/0/3 selects the port.
• speed auto and duplex auto (the defaults) turn autonegotiation back on. To hard-code instead, you would use for example speed 100 and duplex full — and then configure the camera the same.
• end returns to privileged EXEC mode.

On a Linux host, ethtool shows the same information for a network card:

sudo ethtool enp3s0

Settings for enp3s0:
        Supported ports: [ TP ]
…
        Speed: 1000Mb/s
        Duplex: Full
…
        Auto-negotiation: on
…
        Link detected: yes

MTU and jumbo frames

The maximum transmission unit (MTU) is the largest payload a link can carry in one frame. For Ethernet the standard MTU is 1500 bytes: the largest IP packet that fits in a 1518-byte frame. Larger packets must be split (fragmented) or, more often in practice, the sender must use smaller packets.

Every frame carries fixed overhead — header, FCS, and on the wire also the preamble and a gap of 12 bytes between frames — so larger frames waste a smaller share of the link:

WIRE_OVERHEAD = 8 + 14 + 4 + 12   # preamble+SFD, header, FCS, interframe gap
IP_AND_TCP = 20 + 20               # IPv4 and TCP headers without options

for mtu in (1500, 9000):
    data = mtu - IP_AND_TCP
    on_wire = mtu + WIRE_OVERHEAD
    print(f"MTU {mtu}: {data} data bytes per {on_wire} bytes on the wire = {data / on_wire:.1%}")

MTU 1500: 1460 data bytes per 1538 bytes on the wire = 94.9%
MTU 9000: 8960 data bytes per 9038 bytes on the wire = 99.1%

Frames with an MTU above 1500 bytes are called jumbo frames, usually with an MTU around 9000 bytes. They are used inside data centers, for storage networks and for moving virtual machines between hosts. Jumbo frames are not part of the IEEE standard, and they only work when every device on the path — both hosts and all switches in between — is configured for them.

ping -M do -s 1472 -c 1 192.0.2.10
ping -M do -s 1473 -c 1 192.0.2.10

PING 192.0.2.10 (192.0.2.10) 1472(1500) bytes of data.
1480 bytes from 192.0.2.10: icmp_seq=1 ttl=64 time=0.412 ms

--- 192.0.2.10 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.412/0.412/0.412/0.000 ms

PING 192.0.2.10 (192.0.2.10) 1473(1501) bytes of data.
ping: local error: message too long, mtu=1500

--- 192.0.2.10 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms

-M do forbids fragmentation, -s sets the data size and -c 1 sends one ping. The first ping fits; the second is one byte too large for the local MTU and is refused before it leaves the host.

Finding a MAC address

You will look up MAC addresses constantly: to register a device, to find which switch port a device is on, or to check a DHCP reservation. On Linux, ip link (from the iproute2 tools) lists every interface:

ip link show

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 00:00:5e:00:53:2a brd ff:ff:ff:ff:ff:ff

link/ether is the MAC address of enp3s0, brd the broadcast address, and mtu 1500 the interface MTU. LOWER_UP means the physical link is up. On Windows, use ipconfig /all and look for "Physical Address":

ipconfig /all

…
Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : example.com
   Description . . . . . . . . . . . : PCIe Gigabit Ethernet Controller
   Physical Address. . . . . . . . . : 00-00-5E-00-53-2B
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
…

On a Cisco switch or router, show interfaces shows it:

Switch1# show interfaces GigabitEthernet1/0/1
GigabitEthernet1/0/1 is up, line protocol is up (connected)
  Hardware is Gigabit Ethernet, address is 0000.5e00.5301 (bia 0000.5e00.5301)
…

address is the MAC address the interface uses now; bia is the burned-in address from the manufacturer. They differ only when an administrator has changed the address. Which MAC addresses a switch has seen on which port is in its MAC address table; see Switching and VLANs.