APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

2005/07/19 MAC Address

© July 2005 Tony Lawrence

I recently came across a newsgroup post that asked:

 Just curious, this serial number,
   # lshw
   description: Ethernet interface
   logical name: eth0
   serial: 00:11:e3:....

 if known to outsiders, could pose some kind of security risk?

That is funny. I have never seen a MAC address described as a serial number before. Given its purpose, that's a simply horrible tag to put on it. But then again, "MAC address" isn't particularly useful either. Maybe it should be listed as "uid" for unique identifier?

Of course, a MAC address (media access control address) is a serial number in one sense, but it's actually much more and much less. It's much more in the sense that it is a unique number that stays unique across multiple manufacturers. This is a 48 bit number where the first six bytes identify the manufacturer and they are supposed to assign the remaining bytes uniquely (Google for "mac address lookup"). That would make this a globally unique identifier, and of course it is, but it isn't used globally.

The MAC address is used locally. While it may sometimes be used as a serial number for warranty identification, its primary purpose is to uniquely identify network devices on a lan segment. MAC addresses are listed by ifconfig and arp, and can be tremendously useful in troubleshooting tcp/ip problems.

All directed local packets carry the MAC addresses of both the origin and destination machine. The ip address that we are so concerned with is only an extra tag for our convenience and is really unimportant to the cards: they recognize packets that belong to them by the MAC address. When all that a sending machine has is an ip address, it first does a broadcast asking "who has this ip?". The machine that thinks it owns that ip responds with its actual MAC address, which is then used for further communication. If you put in a different device to replace an ip that is in use (a new router, a new pc, whatever), the arp cache on other machines will have to time out or be forcibly cleared before they will be able to communicate with your replacement device, simply because they will use the old MAC address when they want to send packets to that ip.

I have seen appliance routers where both the inside and outside connection shared the same MAC address. That wouldn't cause any confusion as obviously these would be on diffferent segments. Obviously this cuts down on that manufacturers usage of addresses; I can't imagine any other reason why they'd do this.

Got something to add? Send me email.

(OLDER)    <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> Understanding network card MAC Address

Inexpensive and informative Apple related e-books:

Take Control of Preview

El Capitan: A Take Control Crash Course

Take Control of Apple Mail, Third Edition

iOS 10: A Take Control Crash Course

Take Control of Pages

More Articles by © Tony Lawrence

Printer Friendly Version

Have you tried Searching this site?

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us

Printer Friendly Version

Every piece of software written today is likely going to infringe on someone else's patent. (Miguel de Icaza)

Linux posts

Troubleshooting posts

This post tagged:


Unix/Linux Consultants

Skills Tests

Unix/Linux Book Reviews

My Unix/Linux Troubleshooting Book

This site runs on Linode