What it means
MAC addresses operate at the data-link layer and are commonly represented as hexadecimal values. Ethernet switches learn which source addresses appear on which ports and use that table to forward frames. MAC addresses support local delivery; routers use network-layer addressing to move traffic between networks.
How it works
An address may be globally assigned, locally administered, virtual, randomized, or spoofed. Therefore, a MAC address is useful operational information but is not strong proof of a person's identity or device trustworthiness. Wireless privacy features often randomize addresses during discovery or connection.
A switch receives a frame from a laptop, learns the laptop's source MAC address on that switch port, and forwards later frames for that address to the learned port. When the destination is outside the subnet, the frame is addressed to the local router's interface instead.
Practical focus
- Use MAC data for topology, troubleshooting, and local access decisions with appropriate context
- Expect virtualization, mobility, and privacy randomization
- Monitor address changes and table anomalies as signals, not conclusive proof
- Combine device identity with certificates, posture, and authenticated access
Common mistakes
- Treating a MAC address as globally routable
- Assuming MAC filtering is strong authentication
- Forgetting that addresses can be copied or changed
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: