上QQ阅读APP看书，第一时间看更新

MAC addresses

In this section, we will discuss the format of the MAC address of an Ethernet frame. Let's take a look at a capture of an Address Resolution Protocol (ARP) message using the Wireshark tool:

As we can see in the preceding screenshot, both the source and destination Ethernet (MAC) addresses are included. The MAC address is a 48-bit (six-byte) address which is hard coded into the NIC of a device. A MAC address consist of hexadecimal values ranging from 0 to 9, and from A to F.

IEEE assigns the first three bytes (24 bits) of the MAC address to a vendor. This part of the address is known as the Organizationally Unique Identifier (OUI). The OUI helps network and security professionals determine the manufacturer of a MAC address.

Remembering the OUI value for each vendor can be a very challenging task; however, there are various OUI databases available online for anyone to query a MAC address. One notable database is the Wireshark OUI lookup tool, which can be found at https://www.wireshark.org/tools/oui-lookup.html.

The remaining three bytes (24 bits) of the MAC address are uniquely assigned by the vendor. By combining the OUI (24 bits) and the remaining portion of the address (24 bits), we'll get a unique 48-bit MAC address.

For example, the MAC address 00-E0-F7-58-1E-83 can be broken down as follows:

Using the command ipconfig /all on a Windows system will display the physical address, which is also known as the MAC address on the NIC:

MAC addresses is also known as burned-in address ( BIA) since they are usually hard coded into the NIC.