APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

2005/07/19 MAC Address

I recently came across a newsgroup post that asked:


 Just curious, this serial number,
   # lshw
   description: Ethernet interface
   logical name: eth0
   serial: 00:11:e3:....

 if known to outsiders, could pose some kind of security risk?
 

That is funny. I have never seen a MAC address described as a serial number before. Given its purpose, that's a simply horrible tag to put on it. But then again, "MAC address" isn't particularly useful either. Maybe it should be listed as "uid" for unique identifier?

Of course, a MAC address (media access control address) is a serial number in one sense, but it's actually much more and much less. It's much more in the sense that it is a unique number that stays unique across multiple manufacturers. This is a 48 bit number where the first six bytes identify the manufacturer and they are supposed to assign the remaining bytes uniquely (Google for "mac address lookup"). That would make this a globally unique identifier, and of course it is, but it isn't used globally.

The MAC address is used locally. While it may sometimes be used as a serial number for warranty identification, its primary purpose is to uniquely identify network devices on a lan segment. MAC addresses are listed by ifconfig and arp, and can be tremendously useful in troubleshooting tcp/ip problems.

All directed local packets carry the MAC addresses of both the origin and destination machine. The ip address that we are so concerned with is only an extra tag for our convenience and is really unimportant to the cards: they recognize packets that belong to them by the MAC address. When all that a sending machine has is an ip address, it first does a broadcast asking "who has this ip?". The machine that thinks it owns that ip responds with its actual MAC address, which is then used for further communication. If you put in a different device to replace an ip that is in use (a new router, a new pc, whatever), the arp cache on other machines will have to time out or be forcibly cleared before they will be able to communicate with your replacement device, simply because they will use the old MAC address when they want to send packets to that ip.

I have seen appliance routers where both the inside and outside connection shared the same MAC address. That wouldn't cause any confusion as obviously these would be on diffferent segments. Obviously this cuts down on that manufacturers usage of addresses; I can't imagine any other reason why they'd do this.



Got something to add? Send me email.





(OLDER)    <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> -> Understanding network card MAC Address




Increase ad revenue 50-250% with Ezoic


More Articles by

Find me on Google+

© Tony Lawrence



Kerio Samepage


Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us





As soon as an Analytical Engine exists, it will necessarily guide the future course of the science. Whenever any result is sought by its aid, the question will then arise — by what course of calculation can these results be arrived at by the machine in the shortest time? (Charles Babbage)

Software engineering is the part of computer science which is too difficult for the computer scientist. (Friedrich Bauer)







This post tagged: