Media Access Control (MAC) Address, IEEE OUI & EUI-48/EUI-64 Architecture Handbook
An exhaustive, production-grade architectural guide covering formal specifications, internal algorithmic execution, time and space complexity, multi-language code snippets, cryptographic security hardening, and real-world enterprise design patterns.
Data Link Layer Addressing, IEEE Registration Authorities & Hardware Identifiers
A Media Access Control address (MAC address), standardized under the IEEE 802 Local and Metropolitan Area Network architecture, is a unique hardware identifier assigned to a Network Interface Controller (NIC) for communication at the Data Link Layer (OSI Layer 2) of a network segment. MAC addresses serve as the physical delivery mechanism across Ethernet (IEEE 802.3), Wi-Fi (IEEE 802.11), and Bluetooth (IEEE 802.15). While IP addresses at Layer 3 provide logical routing across heterogeneous internetworks, physical Ethernet switches forward frames across local broadcast domains using MAC address tables (CAM tables).
Standard MAC addresses comply with the IEEE EUI-48 (Extended Unique Identifier 48-bit) format, consisting of 6 octets (48 bits, or 6 bytes). A MAC address is split into two equal 24-bit segments: the first 24 bits (3 octets) constitute the Organizationally Unique Identifier (OUI), purchased and assigned by the IEEE Standards Registration Authority to hardware vendors (e.g., Apple, Cisco, Intel, Samsung). The remaining 24 bits represent the Network Interface Controller (NIC) specific identifier assigned by the manufacturer, ensuring global uniqueness.
Critical bitwise flags exist within the very first octet of a MAC address: Bit 0 (the least significant bit of the first byte) is the Unicast/Multicast bit (I/G bit). When set to 0, the frame is directed to an individual network interface (Unicast); when set to 1, the frame is a Multicast or Broadcast frame (e.g., FF:FF:FF:FF:FF:FF). Bit 1 (the second least significant bit) is the Universal/Local bit (U/L bit). When set to 0, the address is globally unique as assigned by the IEEE; when set to 1, the address has been locally administered (MAC address randomization in modern smartphones).
Devised in 1973 by David Boggs and Robert Metcalfe during the development of Xerox PARC Alto Ethernet, 48-bit MAC addressing was adopted by the IEEE in 1980 to ensure every network card manufactured on Earth would possess a globally unique physical address.
OUI Lookup Algorithms, MAC Randomization & EUI-64 Expansion Math
O(1) Constant Time - Normalization and bitwise inspection; O(1) or O(log N) lookup in IEEE vendor trie.
O(1) Auxiliary Space - 6 bytes for binary MAC representation.
Processing, normalizing, and analyzing MAC addresses involves string parsing, bitwise flag inspection, and binary search across IEEE OUI databases.
Step 1: Normalization. MAC addresses appear in various notations: hyphen-delimited (00-1A-2B-3C-4D-5E), colon-delimited (00:1A:2B:3C:4D:5E), dot-delimited (001a.2b3c.4d5e Cisco style), or bare hexadecimal. The parser strips all non-hexadecimal characters, normalizes the string to 12 uppercase hex digits, and re-formats into canonical colon format.
Step 2: Bitwise Flag Inspection. The parser extracts the first byte (first two hex characters). Let byte0 = parseInt(hex.slice(0, 2), 16). The I/G (Individual/Group) bit is tested: isMulticast = (byte0 & 0x01) !== 0. The U/L (Universal/Local) bit is tested: isLocallyAdministered = (byte0 & 0x02) !== 0.
Step 3: MAC Address Randomization Detection. If isLocallyAdministered is true (bit 1 is set), the MAC address was dynamically synthesized by an operating system (iOS Private Wi-Fi Address, Android Randomized MAC, Windows 11 MAC Randomization) to prevent Wi-Fi physical location tracking. In randomized addresses, the OUI lookup will NOT match the physical hardware vendor.
Step 4: EUI-64 Expansion for IPv6 Stateless Address Autoconfiguration (SLAAC). To convert a 48-bit MAC address into a 64-bit IPv6 interface identifier: (1) Split the 6 bytes into two 3-byte halves; (2) Insert the 16-bit constant 0xFFFE between them; (3) Invert the Universal/Local bit (bit 1 of byte 0) via byte0 ^ 0x02. For example, 00:1A:2B:3C:4D:5E expands to 02:1A:2B:FF:FE:3C:4D:5E.
Network Identifier Standards Comparison
| Identifier Scheme | Bit Length | OSI Layer | Scope of Uniqueness | Persistence Model |
|---|---|---|---|---|
| MAC Address (EUI-48) | 48 bits (6 bytes) | Layer 2 (Data Link) | Local broadcast domain | Burned into NIC ROM (BIA); rewritten by OS during MAC randomization. |
| EUI-64 | 64 bits (8 bytes) | Layer 2 / Layer 3 | Global (used in IPv6 SLAAC) | Standard for Zigbee, 6LoWPAN, FireWire, and IPv6 host autoconfiguration. |
| IPv4 Address | 32 bits (4 bytes) | Layer 3 (Network) | Global / Intranet routing | Logical address dynamically assigned via DHCP or statically configured. |
| IPv6 Address | 128 bits (16 bytes) | Layer 3 (Network) | End-to-end global Internet | Hierarchical global routing address with 64-bit network prefix and 64-bit host interface ID. |
Multi-Language Implementation Blueprints
// Parse, normalize, and analyze MAC address bitwise properties
export interface MacAnalysis {
normalized: string;
oui: string;
isMulticast: boolean;
isLocallyAdministered: boolean;
isRandomized: boolean;
eui64: string;
}
export function inspectMacAddress(rawMac: string): MacAnalysis {
// Strip all non-hexadecimal characters
const cleanHex = rawMac.replace(/[^a-fA-F0-9]/g, '').toUpperCase();
if (cleanHex.length !== 12) {
throw new Error('MAC address must contain exactly 12 hexadecimal characters (48 bits).');
}
// Format into standard colon notation
const normalized = cleanHex.match(/.{1,2}/g)!.join(':');
const oui = cleanHex.slice(0, 6);
// First byte bitwise analysis
const firstByte = parseInt(cleanHex.slice(0, 2), 16);
const isMulticast = (firstByte & 0x01) !== 0;
const isLocallyAdministered = (firstByte & 0x02) !== 0;
// EUI-64 generation (insert FFFE in middle and invert U/L bit)
const invertedFirstByte = (firstByte ^ 0x02).toString(16).padStart(2, '0').toUpperCase();
const eui64 = [
invertedFirstByte,
cleanHex.slice(2, 4),
cleanHex.slice(4, 6),
'FF',
'FE',
cleanHex.slice(6, 8),
cleanHex.slice(8, 10),
cleanHex.slice(10, 12)
].join(':');
return {
normalized,
oui,
isMulticast,
isLocallyAdministered,
isRandomized: isLocallyAdministered && !isMulticast,
eui64
};
}Technical Note: Inspects U/L and I/G bits in the first octet and computes the RFC 4291 EUI-64 IPv6 interface identifier.
ARP Spoofing, CAM Table Flooding & Wi-Fi Location Tracking
ARP Cache Poisoning (ARP Spoofing): The Address Resolution Protocol (RFC 826) is entirely unauthenticated. An attacker on the local LAN transmits unsolicited ARP replies associating the gateway IP with the attacker MAC address. Switches and victim machines update their ARP tables, routing all outbound internet traffic through the attacker machine (Man-in-the-Middle).
CAM Table Overflow Attacks: Ethernet switches record source MAC addresses in a Content Addressable Memory (CAM) table to know which physical port connects to which machine. An attacker floods the switch with hundreds of thousands of frames with bogus random source MACs. When the CAM table fills up, the switch enters "fail-open" hub mode, broadcasting every packet to every port and allowing the attacker to sniff all LAN traffic.
Physical Wi-Fi Tracking via Static MACs: When a smartphone probes for Wi-Fi networks, it broadcasts its MAC address in cleartext. Retail stores and surveillance systems deploy probe sniffers that track individuals by their static MAC address. To counter this, Apple and Google introduced MAC Randomization.
Enterprise Case Study: Enterprise 802.1X Network Access Control (NAC) & Zero Trust Campus LAN
A global university campus with 60,000 students and staff needed to prevent rogue devices from plugging into physical Ethernet wall ports while managing thousands of smartphones using randomized MAC addresses.
Edge Cases, Pitfalls & Troubleshooting Matrix
Smartphone MAC Randomization breaking static DHCP leases
Pitfall: Network administrator reserves static IP for a laptop based on hardware MAC.
Consequence: Device changes its MAC address dynamically, receiving an unexpected IP and breaking local port forwarding.
Engineering Solution: Disable "Private Wi-Fi Address" strictly for trusted home/office networks, or identify devices via 802.1X.
Broadcast MAC address handling
Pitfall: Treating FF:FF:FF:FF:FF:FF as an individual hardware vendor.
Consequence: Lookup failure in OUI databases.
Engineering Solution: Intercept FF:FF:FF:FF:FF:FF as the universal Layer 2 broadcast address.
OUI-36 (IAB) smaller vendor allocations
Pitfall: Assuming the vendor prefix is always exactly 24 bits (3 bytes).
Consequence: Failing to identify vendors registered under IEEE OUI-28 or OUI-36 (Individual Address Blocks).
Engineering Solution: Implement hierarchical prefix matching checking 36-bit, 28-bit, and 24-bit IEEE tables.
Fiber Channel and Infiniband non-Ethernet formats
Pitfall: Passing 64-bit or 128-bit storage WWNs (World Wide Names) into EUI-48 parsers.
Consequence: Length validation errors.
Engineering Solution: Differentiate between 48-bit EUI-48 MACs and 64-bit EUI-64 / WWN identifiers.