Before you start
Objectives: learn what is MAC address, how and when it is used, and which protocols are associated with it.
Prerequisites: no prerequisites.
Key terms: address, mac, destination, ip, frame, source, layer, packet, adapter, broadcast, arp, rarp, ffff, card
MAC Specs
An Ethernet MAC address is a 12 character number (48 bit) that uniquely identifies each Network Adapter. The numbers are hexadecimal, meaning that each number ranges from 0-9 or A-F, giving us a total of 16 possible combinations for each position. Example MAC address would be: 00-1A-4B-59-95-6D
Each number in MAC address can be represented by zero and all the way up to nine, giving us a total of 10, plus A, B, C, D, E and F, giving us 16 possible values. The MAC address is a 48 bit number that has 12 digits often separated by dashes, periods or colons. The MAC address uniquely identifies each Network Adapter card and is actually physically burned into the Network Adapter card. For this reason, it is often called a burned in address, since it’s hard coded into the hardware.
MAC Address Parts
The MAC address is guaranteed unique through design. The MAC address identifies both the Network Adapter, as well as the manufacturer of the network adapter card. Each manufacturer is assigned a range of MAC addresses. The first half (first 6 digits) of the MAC address is assigned to each manufacturer. The manufacturer determines the rest of the address, assigning a unique value which identifies the host address. A manufacturer that uses all the addresses in the original assignment can apply for a new MAC address assignment. Some network cards allow us to change the MAC address through jumpers, switches, or software, but there’s really not much reason to do so.
OSI Layer
Devices use the MAC address to send Frames to other devices on the same subnet, the same network segment. MAC addresses exist at the layer two, or the Data Link layer, in the OSI model. Before a device can communicate with another host it needs to know the MAC address of the destination device that’s on that segment.
Example
In our example we have two computers connected through a simple network. PC 1 has a message that it needs to send to PC 2. On the bottom we have listed the seven OSI model layers.
Image 220.1 – Simple Network
Remember that at layer 3 a Packet is created. The packet includes the destination IP address and the source IP address. So in this case we would have packet information which includes the data, for the destination IP address we have the IP address of PC 2, and as the source the IP address of PC 1. The packet is then converted into a Frame for layer 2. Within the Frame we need to have the destination MAC address of the destination device, as well as the source address of the source device, along with the packet information.
Image 220.2 – First 3 Layers
In our example let’s say that PC 1 has an address of 10.10.10.1 and PC 2 has an address of 10.10.10.2, and let’s assume that PC 1 already knows the IP address of PC 2, so as it creates the Frame it uses its own MAC address as the source address within the Frame. But how does it learn what the destination MAC address is? Before two devices can communicate, they must know their MAC addresses.
ARP
In this case the computer uses a protocol that’s called the Address Resolution Protocol (ARP), to discover the MAC address of a device from a known IP address. Source device creates a special frame with its own address and it uses the broadcast MAC address as the destination address. The broadcast address is an address where all positions are set to F. The frame is then sent across the wire.
Image 220.3 – MAC Broadcast
PC 2 receives the Frame and looks at the destination MAC address. It realizes that it’s a broadcast frame, so it needs to process the Frame to see what’s inside. It strips off the Frame headers leaving a Packet with a destination IP address that matches its own. The host then knows that it needs to process the Packet and respond to the Packet. The Packet basically asks, what is your MAC address? To supply the MAC address to the original device, PC 2 creates a new packet using its own address as the source address, and the original sending device’s IP address as the destination device. It gets this information from the original Packet. It then creates a Frame using the original source MAC address as the destination MAC address, and using its own MAC address as the source MAC address, and it sends that information back to PC 1.
Image 220.4 – Response
PC 1 receives this special Frame, realizes that the Frame is addressed to itself and then obtains the MAC address of the destination device. Once this original device knows the MAC address of the destination device, it can create the Packet with the destination IP address and its own source address, create a Frame using the destination MAC address as the destination, and it’s own MAC address as the source address, and it can send those packets to the destination device.
Image 220.5 – Sending Data
So hosts use ARP to find the MAC address of a host when it knows the IP address. To find the MAC address of the recipient, the sending device sends out a broadcast frame. This means that the destination MAC address is all F’s (FFFF:FFFF:FFFF), the source MAC address is its own MAC address, the destination IP address is the known IP address of the destination host and the source IP address is its own IP address. All hosts on the subnet process the broadcast frame, looking at the destination IP address. If the destination IP address matches its own address, the host responds with a Frame that includes its own MAC address as the sending MAC address. The original sender then reads the MAC address from the Frame and associates the IP address with the MAC address, saving it in cache. Once the sender knows the MAC address of the receiver, it sends data in Frames addressed to the destination device.
RARP
Another protocol called Reverse ARP or RARP is used to find the IP address when the MAC address is already known. Once a host learns the MAC address of a destination device it takes that MAC address and puts it into a table so that the next time it needs that information it is available in its cache and does not have to go though the ARP process. Network Adapters function at both the layer 1 and layer 2 of the OSI model. At layer 1, Network Adapter is responsible for sending the bits on the transmission medium. At layer 2, Network Adapter uses the MAC address to create Frames. Transceivers and Media Converters operate only at layer 1, and both are responsible for taking the bits and converting them to electrical, light or other signals for transmission on the transmission medium. Frames include a Cyclic Redundancy Check (CRC) which is used to detect Frames that have been corrupted during transmission.
Image 220.6 – CRC
Remember
The MAC address is a 48 bit number that has 12 digits often separated by dashes, periods or colons. It uniquely identifies each network adapter card and is actually physically burned into the network adapter card. The first half (first 6 digits) of the MAC address is assigned to each manufacturer. MAC addresses exist at the layer two, or the Data Link layer, in the OSI model. ARP is used to discover the MAC address of a device from a known IP address. The broadcast MAC address is an address where all positions are set to F (FFFF:FFFF:FFFF). RARP is used to find the IP address when the MAC address is already known.