skip to content

What is an Ethernet MAC address, and what do its OUI and the group and local bits of its first octet tell you?

level: juniorimportance: must knowfreq 60%

answer

  1. 48 bits, six octets
  2. who assigned the prefix
  3. lowest bit of the first octet
  4. the bit beside it
  5. all ones

basics

~20 s

A MAC address is Ethernet's 48-bit interface identifier. A global one starts with an IEEE-assigned prefix, usually a 24-bit OUI; in the first octet, the lowest bit marks a group address and the next bit a locally administered one.

solid answer

~40 s

A **MAC address** is the 48-bit identifier Ethernet writes into every frame's destination and source fields, shown as six hex octets such as `00-00-5E-00-53-01`. A globally unique one (an EUI-48) begins with a prefix the IEEE Registration Authority assigns, most often a 24-bit **OUI**, and the assignee numbers the rest. Two bits of the first octet have fixed meanings (RFC 9542): the least significant, the **I/G or group bit**, is 0 for unicast and 1 for multicast or broadcast; the next one, the **U/L or local bit**, is 0 for a globally assigned address and 1 for a locally administered one, which no OUI holder controls. All 48 bits set, `ff-ff-ff-ff-ff-ff`, is the **broadcast** address every station on the segment accepts.

go deeper

for a junior

Recall the shape: 48 bits as six hex octets, a 24-bit OUI naming the assignee, and ff-ff-ff-ff-ff-ff as broadcast. Know that the address only matters on the local link.

for a middle

Explain the group and local bits as the two lowest bits of the first octet and read them from the second hex digit. Separate global, local, unicast and group addresses with a real example of each.

for a senior

Show why a MAC is not proof of identity: software sets it, local addresses carry no registry meaning, and the OUI names a chip maker more often than a product. Tie that to how much policy you would hang on it.

for a principal

Frame the address space as a governance trade-off: global uniqueness from a registry versus local assignment by operators and software. Discuss what an organisation loses in inventory and auditing once local addresses become the norm.

## What a MAC address is Every Ethernet frame carries two **MAC (Media Access Control) addresses**: the destination, which tells receivers whether the frame is for them, and the source, which names the interface that sent it. Each is **48 bits**, written as six octets in hex, separated by hyphens (`00-00-5E-00-53-01`, the form RFC 9542 uses) or colons (`00:00:5e:00:53:01`). A MAC address only means something on one link: a router strips the frame and builds a new one for the next link, so the addresses never cross the router the way an IP address does. RFC 9542, which restates the IEEE 802 rules for IETF use and obsoletes RFC 7042, calls a globally unique 48-bit MAC address an **EUI-48** and says the old term "MAC-48" is obsolete. ## Reading the prefix: OUIs and longer blocks A global address is split between the IEEE Registration Authority and whoever it assigned a block to. The authority assigns a prefix; the holder numbers the remaining bits. | Block | Prefix length | Bits the holder controls | |---|---|---| | MA-L (the classic **OUI**) | 24 bits | 24 | | MA-M | 28 bits | 20 | | MA-S | 36 bits | 12 | So the first three octets of a global address usually identify the **assignee** of the block: often the maker of the network chip or adapter, not the brand or model of the device it ended up in. The IANA, for example, holds OUI `00-00-5E`, and RFC 9542 sets aside `00-00-5E-00-53-00` to `00-00-5E-00-53-FF` as documentation addresses. ## The two special bits in the first octet The low-order bits of the first octet are not part of anyone's numbering; they describe the address itself (RFC 9542 section 2.1.1): - **I/G (individual/group) bit**, value `0x01`, which RFC 9542 calls the M bit: 0 means **unicast**, one interface; 1 means a **group** address, multicast or broadcast. - **U/L (universal/local) bit**, value `0x02`, which RFC 9542 calls the X bit: 0 means the address is **global**, under the control of the prefix's owner; 1 means it is **locally administered**, assigned by the local operator or software, and the holder of a matching OUI has no authority over it. Because both bits sit in the low nibble of the first octet, you can read them from the **second hex digit**: | Second hex digit of the first octet | Group bit | Local bit | Meaning | |---|---|---|---| | 0, 4, 8, C | 0 | 0 | global unicast | | 1, 5, 9, D | 1 | 0 | global group | | 2, 6, A, E | 0 | 1 | local unicast | | 3, 7, B, F | 1 | 1 | local group | IEEE 802.3 transmits each octet least significant bit first, which is why the group bit sits at the bottom of the first octet: it is the very first address bit on the wire, so a receiver knows at once that the destination is a group address. ## Unicast, multicast and broadcast in practice 1. `00-00-5E-00-53-01` starts `00`: group bit 0, local bit 0, a global unicast address from IANA's OUI. 2. `01-00-5E-00-00-01` starts `01`: the group bit is set. It is the Ethernet address for the IPv4 all-hosts group 224.0.0.1 (RFC 1112). 3. `33-33-00-00-00-01` starts `33`: both bits set. It is a group address for IPv6 multicast (RFC 2464), and RFC 9542 notes that every `33-33` address has the local bit on. 4. `ff-ff-ff-ff-ff-ff` has all 48 bits set: the **broadcast** address, which every station on the segment accepts (RFC 894 maps IPv4 broadcast to it). A source address is always an individual address; the group bit is meaningful only in the destination. ## Common misreadings - Treating the OUI as a device fingerprint. It names the block's assignee, and only when the local bit is 0. - Assuming the address is fixed. The maker stores a global address, but software can make an interface send any address, so a MAC proves nothing about who sent a frame. - Reading the bits from the wrong end. The group and local bits are the two **least** significant bits of the first octet, not the top two. - Calling any address that starts with `01` a vendor address; that leading `1` is the group bit.

  • How many addresses does one 24-bit OUI give its holder?
    The holder controls the other 24 bits, so 2 to the 24th, 16,777,216 unicast EUI-48 addresses with the group bit clear. RFC 9542 adds that only the OUI's assignee may form group addresses from it, by setting the group bit in the first octet. Large makers therefore hold several OUIs, and smaller holders get an MA-M or MA-S block with 20 or 12 bits to number.
  • Can software change the MAC address an interface sends, and what does that mean for trust?
    Yes. The global address the maker stores is a default, not a lock; the operating system writes whatever source address it is told to into each frame, and locally administered addresses exist precisely so operators and software can assign their own. RFC 9542's security considerations warn that MAC addresses can be spoofed and that a known device can return with a new one, so a MAC is a hint, never an authenticated identity.

saying these in an interview costs you the question

  • The OUI tells you the brand and model of the device.
  • A MAC address is burned in and software cannot change what is sent.
  • The group and local bits are the two most significant bits of the first octet.
  • Ethernet's broadcast address is 00-00-00-00-00-00.
  • An address starting 01 is simply another vendor's unicast address.
  • MAC addresses travel unchanged end to end across routers.