2005/07/19 MAC Address

I recently came across a newsgroup post that asked:

 Just curious, this serial number,
   # lshw
   description: Ethernet interface
   logical name: eth0
   serial: 00:11:e3:....

 if known to outsiders, could pose some kind of security risk?
 

That is funny. I have never seen a MAC address described as a serial number before. Given its purpose, that's a simply horrible tag to put on it. But then again, "MAC address" isn't particularly useful either. Maybe it should be listed as "uid" for unique identifier?

Of course, a MAC address (media access control address) is a serial number in one sense, but it's actually much more and much less. It's much more in the sense that it is a unique number that stays unique across multiple manufacturers. This is a 48 bit number where the first six bytes identify the manufacturer and they are supposed to assign the remaining bytes uniquely (see http://www.cavebear.com/CaveBear/Ethernet/vendor.html for a list of manufacturer prefixes). That would make this a globally unique identifier, and of course it is, but it isn't used globally.

The MAC address is used locally. While it may sometimes be used as a serial number for warranty identification, its primary purpose is to uniquely identify network devices on a lan segment. MAC addresses are listed by ifconfig and arp, and can be tremendously useful in troubleshooting tcp/ip problems.

All directed local packets carry the MAC addresses of both the origin and destination machine. The ip address that we are so concerned with is only an extra tag for our convenience and is really unimportant to the cards: they recognize packets that belong to them by the MAC address. When all that a sending machine has is an ip address, it first does a broadcast asking "who has this ip?". The machine that thinks it owns that ip responds with its actual MAC address, which is then used for further communication. If you put in a different device to replace an ip that is in use (a new router, a new pc, whatever), the arp cache on other machines will have to time out or be forcibly cleared before they will be able to communicate with your replacement device, simply because they will use the old MAC address when they want to send packets to that ip.

I have seen appliance routers where both the inside and outside connection shared the same MAC address. That wouldn't cause any confusion as obviously these would be on diffferent segments. Obviously this cuts down on that manufacturers usage of addresses; I can't imagine any other reason why they'd do this.

Site map | Disclaimer
/Words2005/2005_07_19.html copyright and reprint notice

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.