As of May 31, 2023, we have updated our Code of Conduct.
56 votes
Accepted

TCPDump - Filter by MAC Address

You have used the following as your packet filter: host aa:bb:cc:11:22:33 As it stands, this is looking for an IP or hostname but you are giving it a MAC address. To use a MAC address, you need to ...
YLearn's user avatar
  • 27.1k
34 votes

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a ...
Ron Maupin's user avatar
  • 97.7k
34 votes
Accepted

How does a switch learn a MAC address not in its lookup table?

Good question. I'll answer it with an animation: When Host A sends the frame, the switch does not have anything in its MAC address table. Upon receiving the frame, it records Host A's MAC Address to ...
Eddie's user avatar
  • 14.5k
34 votes
Accepted

Why is the CAM table in a switch called CAM table and not MAC table even though it holds MAC addresses?

CAM (Content Addressable Memory) is memory that can be addressed by content, rather than a numeric memory address. You can look up the interface by presenting the memory with the MAC address. This is ...
Ron Maupin's user avatar
  • 97.7k
22 votes

Does every host on the LAN share the same ARP table, or do hosts keep them individually?

Actually, every interface in a device has its own ARP table. A host could have several ARP tables (one for each interface it has). ARP tables are not shared between hosts, or even among interfaces in ...
Ron Maupin's user avatar
  • 97.7k
22 votes
Accepted

What is the least possible separation of two NICs with the same MAC address?

Suppose you have two NICs with the same MAC address, but not necessarily the same IP address. You can't have that within the same link-layer segment. Identical MAC addresses will disable reliable ...
Zac67's user avatar
  • 79.8k
21 votes
Accepted

Can my MAC address be identified by a web site?

In general it is not possible for a web site that you access to learn your MAC address. However there are special cases where the server could learn your MAC address: IPv6 supports assigning ...
kasperd's user avatar
  • 764
20 votes
Accepted

How does a switch know where to route packet, when there is another switch in front of the destination?

A Layer 2 switch learns most of its information about the location of other endpoints via "listening" to ingressing frames, and when it is not aware of the location, it uses floodingand will learn ...
HAL's user avatar
  • 1,679
17 votes
Accepted

Why the first octet of a MAC address always end with a binary 0?

You may notice that two least-significant bits of the most-significant byte of a 48-bit MAC address are usually set to 0 (as in all your examples). There are two flags in the most-significant byte of ...
Ron Maupin's user avatar
  • 97.7k
17 votes

How Does A Layer 2 Switch Differentiate Between Different Networks?

A (layer-2) switch doesn't care at all about the IP networks you run through it. however, no normal traffic can occur between two nodes on two different networks. That is correct. Different IP ...
Zac67's user avatar
  • 79.8k
16 votes

Can my MAC address be identified by a web site?

No, a remote site will only learn what public IP address you're using, not the MAC address of your device, unless you're using IPv6 with a EUI-64 address. In that case, your MAC address could be ...
Teun Vink's user avatar
  • 16.6k
16 votes

Why do we need MAC Address if we can uniquely identify each machine with an IP Address

There is a historical reason for this, as @ronmaupin alludes to. In small networks, you don't need a layer 3 protocol. All the devices are directly addressable, so layer 2 addresses work fine. As ...
Ron Trunk's user avatar
  • 66.1k
15 votes

Why is the CAM table in a switch called CAM table and not MAC table even though it holds MAC addresses?

CAM - Content Addressable Memory, referring to the memory used for the MAC address table. It works kind of reverse from RAM, you address it by giving it content and it returns you the address where ...
manish ma's user avatar
  • 1,591
13 votes
Accepted

What are EUI-48 and EUI-64?

Historically, both EUI-48 and MAC-48 were concatenations of a 24-bit OUI (Organizationally Unique Identifier) assigned by the IEEE and a 24-bit extension identifier assigned by the organization with ...
Cristina Gaucan's user avatar
13 votes
Accepted

What use are MAC addresses?

Well, but how does it find out it's [www.example.com's] MAC address needed for 802.11 data link layer? Your computer doesn't, nor does it need to do so. Since the MAC address is only used within the ...
YLearn's user avatar
  • 27.1k
13 votes
Accepted

Does the source MAC address of a frame change when it passes through several switches?

No. If all the switches are layer-2 switches, the frames are switched without any changes. Only with routers, including layer-3 switches where the packets need to cross to other VLANs, will the ...
Ron Maupin's user avatar
  • 97.7k
13 votes

Do routers change MAC address of packets when forwarding

When a frame comes into a router, the router strips off and discards the frame, losing any layer-2 addressing, including MAC addresses. The router will build a new frame for the next interface. Not ...
Ron Maupin's user avatar
  • 97.7k
12 votes
Accepted

Does a switch always get a MAC address from a PC?

A switch learns the source MAC from the sender. If the destination is not in the CAM table, the switch floods the frame out all ports. So if the receiver never responds, the switch will never learn ...
Ron Trunk's user avatar
  • 66.1k
12 votes
Accepted

Does an unmanaged switch deal with IP addresses at all

An unmanaged switch doesn't use/care for/understand IP addresses at all. A managed L2 switch uses IP addresses for management only. Some L2 switches also support limited L3/IP functionality like ACLs. ...
Zac67's user avatar
  • 79.8k
11 votes

Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?

Bluetooth devices are required to have a unique device address, assigned from the same registry as Ethernet and Wifi MAC addresses. Quoting the Bluetooth specification version 5.0 volume 1: Each ...
fgrieu's user avatar
  • 243
10 votes
Accepted

Find MAC address of a remote computer using IP

Getting a MAC address requires the ability to get broadcast traffic. ARP is a broadcast protocol and is therefore only available on a LAN. Once traffic is routed you are unable to get the MAC ...
Citizen's user avatar
  • 387
10 votes
Accepted

Why don't we use MAC address instead of IP for having "Internet" or doing communication?

MAC is Media Access Control which provides physical connectivity only. IP Address provides Host or Network interface Identification and Location addressing. For your second question, Let we have two ...
Puneet Dixit's user avatar
10 votes
Accepted

What does a switch do when the destination MAC address is unknown?

I think you are confused. The destination MAC address for any destination not on your LAN is the MAC address of the gateway configured in your source host. MAC addresses are layer-2 addresses, and ...
Ron Maupin's user avatar
  • 97.7k
9 votes
Accepted

Raw-Ethernet Frames

First, Wi-Fi (IEEE 802.11) is not ethernet (IEEE 802.3) any more than token ring (IEEE 802.5) or any of the other IEEE LAN standards other than 802.3 are ethernet. The frame headers are different for ...
Ron Maupin's user avatar
  • 97.7k
9 votes

Find MAC address of a remote computer using IP

No. MAC addresses only have significance on a LAN. Different LAN types have difference kinds of MAC addresses. Knowing the MAC address of a host on a different LAN is meaningless.
Ron Maupin's user avatar
  • 97.7k
9 votes
Accepted

Learning of MAC addresses with cut-through switching?

Cut-trough switching is not a standard. Actually it violates the 802.1D standard in some (minor) aspects. So each vendor implement it on its own way and there's not a single answer to this question. ...
JFL's user avatar
  • 19.3k
9 votes
Accepted

Why do we need MAC Address if we can uniquely identify each machine with an IP Address

Don't confuse the network layers. Each layer has a specific purpose. Also, don't assume that there is only one protocol for each layer. Layer-2 has many protocols, some of which use MAC addresses, and ...
Ron Maupin's user avatar
  • 97.7k
9 votes
Accepted

Does Switch need its own MAC address?

The basic function of a switch is transparent bridging - for this, it doesn't need any MAC address of its own. However, if you need to talk to a switch - ie. a managed switch - then that switch ...
Zac67's user avatar
  • 79.8k
9 votes

Does every host on the LAN share the same ARP table, or do hosts keep them individually?

To answer the question another way: what mechanisms might be available to share an ARP table? This is one of the fundamentals for IP over ethernet (and any similar layer 2 network). If a device was ...
jonathanjo's user avatar
  • 16.1k
9 votes
Accepted

How Does A Layer 2 Switch Differentiate Between Different Networks?

The switch doesn't even "see" what is going on above MAC layer. However, hosts are usually configured to send packets to another IP subnet via a default-gateway IP address. So the hosts ...
manish ma's user avatar
  • 1,591

Only top scored, non community-wiki answers of a minimum length are eligible