I recently came across a newsgroup post that asked:
Just curious, this serial number, # lshw description: Ethernet interface logical name: eth0 serial: 00:11:e3:.... if known to outsiders, could pose some kind of security risk?
That is funny. I have never seen a MAC address described as a serial number before. Given its purpose, that's a simply horrible tag to put on it. But then again, "MAC address" isn't particularly useful either. Maybe it should be listed as "uid" for unique identifier?
Of course, a MAC address (media access control address) is a serial number in one sense, but it's actually much more and much less. It's much more in the sense that it is a unique number that stays unique across multiple manufacturers. This is a 48 bit number where the first six bytes identify the manufacturer and they are supposed to assign the remaining bytes uniquely (Google for "mac address lookup"). That would make this a globally unique identifier, and of course it is, but it isn't used globally.
The MAC address is used locally. While it may sometimes be used as a serial number for warranty identification, its primary purpose is to uniquely identify network devices on a lan segment. MAC addresses are listed by ifconfig and arp, and can be tremendously useful in troubleshooting tcp/ip problems.
All directed local packets carry the MAC addresses of both the origin and destination machine. The ip address that we are so concerned with is only an extra tag for our convenience and is really unimportant to the cards: they recognize packets that belong to them by the MAC address. When all that a sending machine has is an ip address, it first does a broadcast asking "who has this ip?". The machine that thinks it owns that ip responds with its actual MAC address, which is then used for further communication. If you put in a different device to replace an ip that is in use (a new router, a new pc, whatever), the arp cache on other machines will have to time out or be forcibly cleared before they will be able to communicate with your replacement device, simply because they will use the old MAC address when they want to send packets to that ip.
I have seen appliance routers where both the inside and outside connection shared the same MAC address. That wouldn't cause any confusion as obviously these would be on diffferent segments. Obviously this cuts down on that manufacturers usage of addresses; I can't imagine any other reason why they'd do this.
Got something to add? Send me email.
More Articles by Tony Lawrence © 2012-07-19 Tony Lawrence