Networking Fundamentals · lesson 3 of 17 · 12 min
Ethernet and MAC addresses
Ethernet is the dominant wired networking technology. It defines how devices on the same local network segment communicate using frames.
MAC addresses
A MAC (Media Access Control) address is a 48-bit hardware identifier assigned to a network interface card (NIC). It is written as six pairs of hex digits:
00:1A:2B:3C:4D:5E
. The first three pairs identify the manufacturer (OUI — Organizationally Unique Identifier); the last three are device-specific.
MAC addresses are used for communication within a single network segment (Layer 2). They are not routed across the internet — that is IP’s job.
ARP — Address Resolution Protocol
When a device knows an IP address but needs the MAC address to send a frame, it broadcasts an ARP request: “Who has IP 192.168.1.1? Tell me your MAC.” The device with that IP replies with its MAC. ARP results are cached in the ARP table.
Security note: ARP has no authentication. ARP spoofing (ARP poisoning) lets an attacker associate their MAC with another device’s IP, enabling man-in-the-middle attacks on the local network.
Ethernet and MAC quiz
A device needs to send data to another device on the same subnet. It knows the destination IP but not the MAC. What protocol does it use?
- DNS
- DHCP
- ARP
- ICMP
Answer: ARP
ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses on the local network segment.
An attacker sends fake ARP replies to associate their MAC with the gateway’s IP. What attack is this?
- DNS poisoning
- ARP spoofing
- IP spoofing
- MAC flooding
Answer: ARP spoofing
ARP spoofing (ARP poisoning) tricks devices into sending traffic to the attacker’s machine instead of the real gateway — enabling a man-in-the-middle attack.
Previous lesson: TCP/IP model
Back to Networking Fundamentals
Next lesson: IPv4 address structure