Frames and MAC addresses

Ethernet carries data in frames. A frame has source and destination link-layer addresses, a field identifying the carried protocol, payload data, and error-detection information. The frame is the unit of delivery on one local network segment.

Ethernet link-layer addresses are commonly called MAC addresses. They are 48-bit identifiers usually written as six hexadecimal pairs. They identify interfaces for delivery on the local Ethernet network. They are not Internet-wide routes.

Every interface you own has one. Look at yours:

ip link show eth0
# link/ether 3c:22:fb:9a:12:40 brd ff:ff:ff:ff:ff:ff

On macOS:

ifconfig en0 | grep ether
# ether a4:83:e7:2c:88:01

The 3c:22:fb half identifies the manufacturer of the network chip. The second half is unique to the interface. The brd ff:ff:ff:ff:ff:ff value is the broadcast address — a frame sent there is delivered to every interface on the segment.

Two addresses, two different jobs

Here’s the part that confuses beginners. When a laptop sends an IP packet to its router, the Ethernet destination is the router interface’s MAC address. The IP destination can still be a server on the other side of the world.

Check which MAC address your machine actually uses to reach the Internet:

ip neighbor
# 192.168.1.1 dev eth0 lladdr 9c:53:22:aa:04:1e REACHABLE

That entry maps your router’s IP address to its MAC address. Every packet you send to any website is wrapped in a frame addressed to 9c:53:22:aa:04:1e — the router — regardless of the IP destination inside. On macOS, arp -an shows the same table.

Keep the scopes separate: MAC addresses move a frame over one Ethernet link, while IP addresses help routers move a packet across networks. The MAC address changes at every routed hop. The IP addresses normally stay the same end to end.

A common mistake

People sometimes try to firewall or identify remote servers by MAC address. That can’t work. You never see a remote machine’s MAC address — only the MAC of the last local device that handed you the frame, usually your router. MAC addresses are local facts. Anything beyond your own link is IP territory.