What Is a MAC Address? MAC vs IP Address
A MAC (Media Access Control) address is a 48-bit hardware address baked into a device's network interface. It identifies that interface on a local network at Layer 2 of the OSI model, and it's how an Ethernet switch decides which physical port to send a frame out of. An IP address does a different job: it's a logical Layer 3 address used to route data between networks.
The short version: a MAC address delivers a frame across one local link, while an IP address delivers a packet across many networks to reach the internet. They work together, and a tiny protocol called ARP is the glue that connects one to the other.
What a MAC address actually is
A MAC address is 48 bits long, almost always written as 12 hexadecimal digits like 00:1A:2B:3C:4D:5E (sometimes shown with dashes or dots). Every wired or wireless network interface — your laptop's Ethernet port, its Wi-Fi radio, a router's interface — has its own MAC address.
Those 48 bits split into two halves. The first 24 bits are the OUI (Organizationally Unique Identifier), a block that the IEEE assigns to a manufacturer — so the front half often tells you who made the card. The last 24 bits are the device-specific portion the manufacturer sets to keep each interface unique. Because it's assigned by the vendor, a MAC is sometimes called a burned-in address (BIA), but that's a bit misleading: modern operating systems and NICs let you override it in software, so a MAC can be changed or spoofed.
Why MAC addresses exist: the problem they solve
Picture a single Ethernet segment or a switch with many devices plugged in. When one device wants to hand a frame to another on that same local network, something has to identify the exact recipient on the wire. That's the problem the MAC address solves — local, physical delivery within one broadcast domain.
MAC addresses are flat, not hierarchical. There's no structure that says 'this group of MACs lives over here.' That's fine for a local link, where a switch can just remember where each address is, but it's exactly why MACs can't be used to route across the whole internet — you'd need a table with every device on Earth. Routable, hierarchical addressing is the job IP was invented for.
How switches use MAC addresses to forward frames
A switch operates at Layer 2 and forwards frames based on MAC addresses. It learns by watching traffic: when a frame arrives, the switch records the frame's source MAC and the port it came in on, building a MAC address table (also called a CAM table) that maps addresses to ports.
When a frame needs forwarding, the switch looks up the destination MAC. If it knows the port, it sends the frame only out that one port. If the destination is unknown, or the frame is a broadcast, it floods the frame out all ports except the one it arrived on, and learns from the reply. This is why a switch is fast and precise, while an old hub simply repeated everything to everyone.
MAC vs IP: two addresses, two jobs
The cleanest way to keep them straight: the IP address is Layer 3 and logical; the MAC address is Layer 2 and physical. An IP address is IPv4 (32-bit) or IPv6 (128-bit) and is hierarchical and routable, so routers can forward a packet across many networks by IP. A MAC is local to a single link and gets the frame to the next device on that link.
A common analogy: the destination IP is like the full mailing address on an envelope — it stays the same the whole journey and tells the postal system where the letter ultimately goes. The destination MAC is like the local courier handing the parcel to the very next stop. In fact, as a packet crosses each router (each Layer 3 hop), the source and destination MAC are rewritten for that new link, while the original source and destination IP stay the same end to end (barring NAT). The IP is your destination; the MAC is only ever your next hop.
How ARP maps an IP to a MAC
Devices usually know the IP address they want to reach, but a frame needs a destination MAC to actually go out on Ethernet. ARP (Address Resolution Protocol) fills that gap on IPv4 networks. The sender broadcasts an ARP request — essentially 'who has 192.168.1.1? tell me your MAC' — and the owner of that IP replies directly with its MAC. The sender caches the answer in its ARP table so it doesn't have to ask again for a while.
One crucial detail: ARP only works within the local subnet / broadcast domain. If the destination IP is on a different network, the sender doesn't ARP for the remote host at all. Instead it ARPs for its default gateway and sends the frame there, letting the router forward the packet onward. (IPv6 uses Neighbor Discovery for the same idea rather than ARP.)
Common beginner gotchas
MACs don't cross routers. A MAC address is only meaningful on its local link; a router strips the old frame and builds a new one for the next hop, so a device's MAC never shows up on the far side of a router. If you're troubleshooting reachability between subnets, MAC addresses aren't the thing that gets you there — routing by IP is.
A MAC isn't a security control on its own. Because MACs can be changed in software, MAC-based filtering is easily spoofed and shouldn't be your only defense. And don't confuse the two roles: your IP can change when you move to a new network (like a mailing address when you move house), while the MAC identifies the interface itself. When you're ready to actually see and manage these on real gear, that's a job for the CLI — the step-by-step commands live in our separate how-to guide.
Frequently asked questions
What is the difference between a MAC address and an IP address?
A MAC address is a 48-bit Layer 2 hardware address that identifies a network interface on the local link — it's how a switch delivers a frame to the right port. An IP address is a logical Layer 3 address (IPv4 is 32-bit, IPv6 is 128-bit) that routers use to move packets between networks. The MAC handles delivery on one local segment; the IP handles routing across the internet. They work together on every connection.
Why does a MAC address never change across a router but an IP address stays the same?
It's the reverse, and that trips people up. The destination IP stays the same end to end (barring NAT) because it identifies the final destination. The MAC, by contrast, is rewritten at every Layer 3 hop: each router builds a fresh frame with its own MAC as the source and the next device's MAC as the destination. So the IP is your ultimate address, while the MAC only ever names the next hop on the current link.
Does every device really have a unique MAC address, and can it be changed?
Each network interface ships with a manufacturer-assigned MAC that's meant to be globally unique — the first 24 bits identify the vendor (the OUI) and the rest are unique to the device. But 'burned-in' doesn't mean permanent: operating systems and NIC drivers let you override the MAC in software, which is why MAC spoofing exists and why MAC-based filtering shouldn't be relied on as a security measure by itself.
Now build it on real Cisco IOS
Concepts stick when you configure them. Try a free graded lab, then grade your own config against the answer key.