What Is a MAC Address?

The simple answer

A MAC address (Media Access Control address) is a unique identifier assigned to a network interface card (NIC) at the time it's manufactured. It's permanently embedded in the hardware — every Wi-Fi card, Ethernet adapter, and Bluetooth chip has one, and no two are supposed to be the same anywhere in the world.

If an IP address is like your current home address (it can change when you move), a MAC address is like your fingerprint — it stays with the hardware forever regardless of where it connects.

What a MAC address looks like

A MAC address is 48 bits long, written as six pairs of hexadecimal characters separated by colons or hyphens. It always looks something like this:

Hexadecimal uses digits 0–9 and letters A–F, so each pair can represent values from 00 to FF. You don't need to memorize the math — just recognize the format on the exam.

MAC address vs IP address — the key difference

This is one of the most commonly tested comparisons on the A+ exam. The short version: a MAC address is a permanent hardware identity, while an IP address is a temporary logical assignment. They operate at different layers of the OSI model and serve different purposes.

* MAC addresses can be spoofed in software, but the physical address burned into the hardware doesn't change.

How to find your MAC address on Windows

The fastest way is with ipconfig /all — the same command from the network troubleshooting commands guide. Look for the line labeled Physical Address.

How switches use MAC addresses

This is where MAC addresses do their most important work. A switch operates at Layer 2 of the OSI model and uses MAC addresses — not IP addresses — to decide where to send frames on a local network.

This is why switches are more efficient than hubs — a hub blindly sends every frame to every device, while a switch uses MAC addresses to deliver frames only where they need to go.

ARP — how IP addresses get matched to MAC addresses

Here's a question worth thinking about: if switches use MAC addresses and routers use IP addresses, how does a device know the MAC address of another device it wants to talk to?

The answer is ARP — Address Resolution Protocol. When Device A wants to send data to 192.168.1.30 but doesn't know its MAC address, it broadcasts an ARP request to the whole network: "Who has 192.168.1.30? Tell me your MAC address."

What the A+ exam tests on MAC addresses

MAC spoofing — the Security+ attack

Although MAC addresses are burned into hardware, the operating system can override what it transmits — this is called MAC spoofing. An attacker changes their device's reported MAC address to impersonate another device on the network.

CAM table overflow attack

Switches maintain a CAM table (Content Addressable Memory) — a mapping of MAC addresses to switch ports. This is how a switch knows which port to send traffic to, rather than flooding it everywhere like a hub. Each entry has a timeout and is refreshed when traffic is seen from that MAC address.

A CAM table overflow attack exploits the fact that the CAM table has finite memory. The attacker floods the switch with thousands of frames with fake source MAC addresses, filling the CAM table completely. When the table is full, the switch can no longer learn new entries — it falls back to flooding all traffic out of all ports, exactly like a hub. The attacker's device, connected to one of those ports, now receives a copy of every frame on the network.

Normal operation:
Switch CAM table: AA:BB:CC → Port 1 | DD:EE:FF → Port 2 | ...
Switch sends traffic only to the correct port

Attack:
Attacker tool (macof) floods switch with 10,000+ fake MAC addresses
CAM table fills to capacity — no more entries can be added

Result:
Switch cannot find new MACs in table → floods ALL traffic to ALL ports
Attacker receives a copy of every frame → passive network interception

Port security — the defence

Port security is a switch feature that limits how many MAC addresses can be learned on a given port, and optionally locks the port to specific MAC addresses. It directly counters CAM table overflow attacks and prevents rogue devices from connecting.

Protect   Drop frames from unknown MACs. No alert, port stays up.
Restrict  Drop frames + increment violation counter + send SNMP trap.
Shutdown  Put port into err-disabled state immediately. Requires manual re-enable.
           ← Default and most secure. The exam answer when asked "most restrictive mode".

Broadcast vs unicast vs multicast — MAC addressing modes

Not all frames are addressed to a single device. Understanding the three MAC addressing modes is tested on both A+ and Network+:

Key Takeaways

Related Articles