---
{
  "title": "MAC addresses",
  "summary": "Understand local-link MAC addressing and switch learning while avoiding permanent-device or human-identity claims from a single address.",
  "topic": "networking",
  "level": "Beginner",
  "updated": "2026-10-12",
  "units": [
    1
  ],
  "aliases": [],
  "sources": [
    {
      "title": "Cisco: Networking basics",
      "url": "https://www.cisco.com/site/us/en/learn/topics/networking/what-is-computer-networking.html"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---
## The idea

A MAC address identifies a link-layer interface in relevant networking contexts. Switches can learn associations between addresses and ports to forward frames. Addresses may be changed, randomized, or shared through virtualization, so do not treat them as permanent proof of device or user identity. Correlate them with network segment, time, switch or access records, and other identifiers.

## In practice

A DHCP record and switch-port observation help associate activity with a device at a particular time, but user attribution needs more evidence.

## A common misunderstanding

A familiar vendor prefix or recorded address is not strong authentication.

## Check your understanding

Why record the network and time with an address?

**Think it through:** The association can change and its meaning is local to the observed environment.

## Local forwarding has its own identifiers

Imagine a fictional classroom switch observes frames from a laptop on one port. It can learn an association between the source MAC address and that port for forwarding purposes. This helps it deliver later frames within the relevant link-layer context.

The observation is not a verified employee identity. An address can be locally administered, randomized, changed, or associated with virtual interfaces. The fact that it has a familiar vendor prefix is not strong authentication of the person or system using it.

## A moving laptop changes the evidence

Suppose a learner disconnects from a wired desk and joins wireless access. The interface and addressing context can change. A historical wired observation and a later wireless observation should not be merged solely because an analyst expects one permanent identifier.

Record the time, segment, interface, and source of the observation. A switch forwarding table, an access-point association record, and a lease record each describe related but different facts. Their retention and collection times also differ.

## Attribution requires another step

During an incident, a MAC-to-port association can help locate an observed endpoint within a network. It does not by itself establish who was using the device, whether an account was compromised, or whether traffic came from an automated process.

For the classroom, combine the observation with appropriately authorized device inventory and account evidence if the investigation needs that conclusion. Keep the original evidence and label the inference rather than presenting a guessed owner as a measured fact.

For a safe learning exercise, inspect the interfaces on your own device and compare their address types. Explain where a local neighbor mapping and a switch's learned association would be used. Then draw a remote website request and identify why the website's MAC address is not normally learned directly across the internet. This separates local delivery, network routing, and user attribution into their proper scopes.

## Keep exploring

- [[arp]]
- [[routing-and-switching]]
- [[dhcp]]