MAC Map

The Anatomy of a MAC Address: OUI, Device Identifiers, and Control Bits

A deep dive into EUI-48 bit fields, universal vs local flags, multicast bits, and standard hexadecimal notation.

At the data link layer (Layer 2 of the OSI model), network interfaces communicate across a shared physical medium using Media Access Control (MAC) addresses. Defined formally by the IEEE 802 standards committee, standard MAC addresses are 48-bit numbers structured as EUI-48 (Extended Unique Identifier 48) values. Although network administrators routinely view these addresses as twelve hexadecimal digits separated by colons or hyphens, their underlying binary composition contains essential control bits that determine how frames are processed, routed, and identified across Ethernet and Wi-Fi networks.

To understand what a MAC address reveals—and where its diagnostic value reaches its limits—one must examine how its 48 bits are allocated between organization identifiers, interface sequence numbers, and specialized control flags.

Binary Representation and Bit Transmission Order

A standard 48-bit MAC address consists of six 8-bit octets (bytes). When written in standard human-readable notation, these octets are displayed in hexadecimal format, such as 00:1A:2B:3C:4D:5E or 00-1A-2B-3C-4D-5E. Cisco networking equipment frequently formats the same address as three sets of four hexadecimal digits separated by dots, such as 001a.2b3c.4d5e. Despite differences in notation, the underlying bit layout remains identical.

Hexadecimal Octets:   [ 00 ] : [ 1A ] : [ 2B ] : [ 3C ] : [ 4D ] : [ 5E ]
Binary Equivalent:   00000000 00011010 00101011 00111100 01001101 01011110
                     |------- OUI (24 bits) -------|-- NIC Specific (24 bits) --|

In standard Ethernet (IEEE 802.3) frame headers, octets are transmitted sequentially from left to right (Octet 0 through Octet 5). Crucially, within each octet, Ethernet transmits the least significant bit (LSB) first on the physical wire. This transmission ordering makes the first two bits of the very first octet (Octet 0) particularly significant for framing hardware.

The Two Critical Control Bits in Octet 0

The first octet of every MAC address contains two embedded status flags located in its least significant bit positions. These two bits alter the fundamental interpretation of the entire 48-bit value.

Octet 0 Binary Layout: [ b7  b6  b5  b4  b3  b2  b1  b0 ]
                                                  |   |
                                                  |   +-- Bit 0: Individual / Group (I/G) Flag
                                                  +------ Bit 1: Universal / Local (U/L) Flag

1. The Individual / Group (I/G) Bit (Bit 0)

Bit 0 of the first octet determines whether the address refers to a single individual network interface or a group of destinations.

  • Unicast Address (b0 = 0): When Bit 0 is set to 0, the address specifies an Individual target. Network frames bearing a unicast destination MAC address are intended for delivery to a single specific network interface card (NIC) on the local broadcast domain.
  • Multicast Address (b0 = 1): When Bit 0 is set to 1, the address specifies a Group target. Frames addressed to a multicast MAC (such as 01:00:5E:xx:xx:xx for IPv4 multicast or 33:33:xx:xx:xx:xx for IPv6 multicast) are processed by all host interfaces configured to listen for that specific multicast group. The Ethernet broadcast address (FF:FF:FF:FF:FF:FF) represents a special case where all 48 bits are set to 1, forcing every active host on the Layer 2 segment to accept and process the frame.

2. The Universal / Local (U/L) Bit (Bit 1)

Bit 1 of the first octet specifies the administrative authority responsible for assigning the address.

  • Universally Administered Address (b1 = 0): When Bit 1 is set to 0, the address is designated as Universally Administered (UAA). UAA addresses are permanently assigned to hardware interfaces by manufacturer chipmakers during production. The manufacturer obtains a dedicated prefix block from the IEEE Standards Association to guarantee global uniqueness across all produced networking hardware.
  • Locally Administered Address (b1 = 1): When Bit 1 is set to 1, the address is designated as Locally Administered (LAA). LAA addresses override burned-in manufacturer defaults. They are dynamically generated by operating systems, hypervisors, container runtimes, or administrative utilities.

Understanding the U/L bit is vital for modern network diagnostics. If the second hexadecimal digit of the first octet is 2, 6, A, or E (such as 02:xx:xx:xx:xx:xx or DA:xx:xx:xx:xx:xx), the U/L bit is explicitly set to 1. This instantly alerts an administrator that the address is locally generated rather than a factory-assigned hardware ID.

OUI vs NIC Portion Breakdown

A Universally Administered MAC address (U/L = 0) is split evenly into two 24-bit segments:

Organizationally Unique Identifier (OUI)

The first 24 bits (Octets 0, 1, and 2) comprise the OUI. The IEEE Standards Association assigns OUIs to commercial entities, hardware manufacturers, and software developers. The purchasing organization receives exclusive rights to use that 24-bit prefix for its equipment. For example, the OUI prefix 00:50:56 is registered to VMware, Inc., while 00:1A:11 belongs to Google LLC.

Because the OUI consumes 24 bits (3 octets), a single OUI block provides space for 2^24 (16,777,216) unique individual network interface addresses.

Network Interface Controller (NIC) Specific Extension

The remaining 24 bits (Octets 3, 4, and 5) are managed independently by the hardware manufacturer holding the assigned OUI. The manufacturer increments this 24-bit field sequentially across production runs, assigning a distinct combination to every individual network adapter produced under that OUI block.

Extended Identifiers: EUI-48 vs EUI-64

While 48-bit addresses remain standard across traditional 802.3 Ethernet and 802.11 Wi-Fi, modern IPv6 networking and IEEE 802.15.4 low-power wireless networks utilize 64-bit Extended Unique Identifiers (EUI-64).

To derive an EUI-64 address from a traditional 48-bit EUI-48 MAC address (a process historically used in IPv6 Stateless Address Autoconfiguration or SLAAC under RFC 4291), the 16-bit hexadecimal value FF:FE is inserted directly between the 24-bit OUI and the 24-bit NIC extension. Additionally, the U/L bit in the first octet is inverted to indicate local scope in SLAAC interface identifiers.

Original EUI-48 MAC:      00:1A:2B  :  3C:4D:5E
Inserted 16-bit Value:             FF:FE
Resulting EUI-64 ID:      00:1A:2B : FF:FE : 3C:4D:5E
Inverted U/L Bit Result:  02:1A:2B:FF:FE:3C:4D:5E

Practical Implications for Network Diagnostics

Recognising the exact bit structure of a MAC address prevents diagnostic errors during network troubleshooting:

  1. Identifying Synthetic Addresses: When inspecting packet captures or switch CAM tables, checking the second hexadecimal character immediately distinguishes physical hardware interfaces from randomized virtual addresses.
  2. Filtering Multicast Noise: Recognizing the I/G bit prevents network monitoring tools from misclassifying multicast group traffic as anomalous host behaviour.
  3. Evaluating OUI Boundaries: An OUI lookup confirms which entity manufactured or registered the network chip, but as explored in our companion guide on OUI Registry Lookup Facts and Misconceptions, it does not guarantee the final identity of the end-user device.