MAC addresses: find, change, randomise, look up

The Physical Address in ipconfig /all, the ether line in ifconfig, the link/ether in ip link: all the same 48-bit number burned into the network hardware, written three different ways. Here is everything people ask about it.

What it is

A Media Access Control address identifies a network interface at layer 2, on the local segment only. Ethernet switches use it to decide which port to send a frame to; Wi-Fi access points use it to address stations; DHCP servers use it to remember which device had which lease. It never crosses a router: the far end of an internet connection sees your router's public IP and nothing about your MAC. Websites cannot see it. Your ISP sees only the MAC of your router's WAN port.

Six bytes, written as twelve hex digits: 8C-16-45-3A-9B-2D (Windows), 8c:16:45:3a:9b:2d (everything else), 8c16.453a.9b2d (Cisco). The first three bytes are the OUI, assigned by the IEEE to the manufacturer; the last three are the device's serial within that block. Two bits in the first byte carry meaning: bit 0 (the lowest) set means multicast; bit 1 set means locally administered, i.e. not a factory address. So a first byte of x2, x6, xA or xE marks a randomised, cloned or virtual address.

Find your MAC address

ipconfig /all | findstr /i "Description Physical"
getmac /v /fo list
wmic nic where "NetEnabled=true" get Name,MACAddress

Get-NetAdapter | Format-Table Name, InterfaceDescription, MacAddress, Status
(Get-NetAdapter -Name Wi-Fi).MacAddress

ifconfig en0 | grep ether
networksetup -getmacaddress en0
networksetup -listallhardwareports         # every port with its MAC
system_profiler SPNetworkDataType | grep -i mac

ip link
ip -br link
cat /sys/class/net/enp3s0/address
nmcli device show enp3s0 | grep HWADDR
ethtool -P enp3s0                          # permanent (factory) address even if changed
lshw -class network | grep serial          # needs root

Find another device's MAC

ping 192.168.1.10 && arp -a | findstr 192.168.1.10     # Windows: ping first so the ARP cache is populated
ping -c1 192.168.1.10 && ip neigh show 192.168.1.10    # Linux
ping -c1 192.168.1.10 && arp -n 192.168.1.10           # macOS
sudo nmap -sn 192.168.1.0/24                           # every host with vendor names (Linux/macOS with nmap)
sudo arp-scan --localnet                               # Linux; fast and shows vendors

The router's client list (often called Attached devices or Device list) shows MAC, IP and hostname together and is the quickest source for a whole network.

Manufacturer (OUI) lookup

Paste the first three bytes into an OUI database: the IEEE's own registry at standards-oui.ieee.org, the Wireshark lookup at wireshark.org/tools/oui-lookup.html, or nmap/arp-scan which bundle a copy. Prefixes worth recognising:

Randomised addresses have no manufacturer, which is why your router labels half the phones in the house as "Unknown".

Private (randomised) Wi-Fi addresses

Since iOS 14, Android 10 and macOS 15 (and Windows 10 as an option), devices present a different, random, locally-administered MAC to each Wi-Fi network so that shops and airports cannot track you across locations. Consequences at home:

• DHCP reservations and MAC filters keyed on the hardware address stop matching. Either reserve against the random address the router sees (it is stable per network on iOS and Android by default) or turn the feature off for your home network.
• iOS 18 and later add a Rotating option that changes the address periodically on that network; reservations cannot survive that.
• Captive portals that remember you by MAC will ask you to log in again if the address rotates.

Change (spoof) the MAC address

Legitimate reasons: cloning the MAC an ISP has locked to an old router, testing, bypassing a stale DHCP lease, privacy on public networks, or avoiding a conflict between cloned VMs. Changing it on a network you do not own to bypass access controls or impersonate another device is where it stops being legitimate.

Set-NetAdapter -Name "Ethernet" -MacAddress "02-11-22-33-44-55"
Restart-NetAdapter -Name "Ethernet"
# revert
Set-NetAdapter -Name "Ethernet" -MacAddress $null

sudo ip link set enp3s0 down
sudo ip link set enp3s0 address 02:11:22:33:44:55
sudo ip link set enp3s0 up
# persistent with NetworkManager
sudo nmcli con mod "Wired connection 1" ethernet.cloned-mac-address 02:11:22:33:44:55
# systemd-networkd: MACAddress= in the [Link] section of the .network file
# macchanger, if installed
sudo macchanger -r enp3s0          # random
sudo macchanger -p enp3s0          # restore permanent
# see the factory address regardless
ethtool -P enp3s0

# Ethernet
sudo ifconfig en5 ether 02:11:22:33:44:55
# Wi-Fi: must be disassociated first; on macOS 14+ toggle Wi-Fi off/on and run the command before it rejoins
sudo ifconfig en0 ether 02:11:22:33:44:55
# reverts at reboot; the per-network Private Address setting is the supported way to randomise

MAC filtering and why it is weak

Routers offer an allow-list of MAC addresses on Wi-Fi. It keeps out casual neighbours and nothing else: every frame on a Wi-Fi network carries the sender's MAC in the clear, so anyone with a laptop can list the permitted addresses in seconds and set their own to match. It also fights randomised addresses on your own family's phones. Use WPA3 (or WPA2-AES) with a strong passphrase for security, a separate guest network for visitors, and treat MAC filtering as tidy-up rather than protection. The same applies to port security on managed switches, though there it at least raises an alert.

MAC addresses in IPv6

Old-style SLAAC embedded the MAC in the IPv6 address (EUI-64: look for ff:fe in the middle). Modern systems use random stable identifiers instead, precisely so the MAC does not leak to the internet. The IPv6 calculator detects EUI-64 addresses and recovers the MAC from them.

Related pages

• MAC formats in tool output
• DHCP reservations by MAC
• Wi-Fi from the command line