Every MAC address has an origin—a point where it was first assigned to a device or interface. Understanding this assignment process is crucial for network administration, security analysis, device identification, and troubleshooting.

The MAC address assignment ecosystem involves multiple parties and mechanisms:

• IEEE Registration Authority: Assigns organizational prefixes to vendors
• Hardware Manufacturers: Burn addresses into NICs during production
• Virtualization Platforms: Generate addresses for virtual machines and containers
• Operating Systems: May override or randomize hardware addresses
• Network Administrators: Can configure alternative addresses for specific purposes

This page explores each of these mechanisms in depth, revealing how the apparently simple 'hardware address' is actually managed through a sophisticated global system.

The IEEE Registration Authority (IEEE-RA) manages the global MAC address assignment system, ensuring that addresses remain globally unique across all manufacturers and devices worldwide.

The IEEE-RA's responsibilities:

• Maintains the authoritative registry of all assigned OUIs
• Processes applications from companies seeking OUI assignments
• Ensures no duplicate assignments
• Publishes the public OUI database
• Manages special-purpose address registrations

Registration costs and process:

As of current IEEE pricing (subject to change):

Registration steps:

1. Application: Submit company information and intended use
2. Payment: Process registration fee
3. Verification: IEEE verifies applicant is a legitimate organization
4. Assignment: IEEE assigns unique OUI from available pool
5. Publication: OUI appears in public registry (unless confidential registration)

Confidential registrations:

Companies can request confidential OUI registrations (at additional cost). These OUIs won't appear in the public database with company identification, useful for:

• Competitive secrecy about new product development
• Military or government applications
• Internal corporate networks

Example OUI registrations:

Note: Major manufacturers often hold multiple OUIs—Apple, Intel, and Cisco each have dozens assigned due to their production volumes.

When a network interface card (NIC) is manufactured, a globally unique MAC address is permanently encoded into the hardware. This 'burned-in address' (BIA) serves as the device's default identity.

Manufacturing process:

1. OUI allocation: Manufacturer receives OUI from IEEE
2. Address range management: Factory tracks which addresses have been used
3. Programming: Each NIC is programmed with a unique address during production
4. Verification: Automated testing confirms address uniqueness
5. Documentation: Address may be printed on device label or packaging

Storage locations:

The BIA vs operational address distinction:

Modern NICs support separate concepts:

• Burned-In Address (BIA): The factory-programmed address stored in EEPROM/ROM. This is the 'permanent' address.

• Operational Address (LAA): The address actually used for network communication. By default, this equals the BIA, but can be overridden.

When you view a NIC's properties, you may see both:

Windows: "Network Address" in adapter properties = LAA (configurable)
         "Physical Address" reported = Current operational address

Linux:   /sys/class/net/eth0/address = Current operational address
         ethtool -P eth0 = Permanent (BIA) address

Why separate operational addresses?

• Virtual machine mobility: VMs can migrate between physical hosts while keeping the same MAC
• NIC replacement: Replace hardware without changing address for licensing/configuration tied to MAC
• Testing and debugging: Use specific addresses for controlled testing
• Privacy: Randomize to avoid tracking (discussed later)

Locally Administered Addresses (LAAs) are MAC addresses assigned by local administrators, virtualization platforms, or software—rather than by the hardware manufacturer. They are distinguished by the U/L bit (bit 1 of the first byte) being set to 1.

Characteristics of LAAs:

• U/L bit = 1 (first byte second bit set)
• First hexadecimal digit typically: 2, 6, A, or E (for unicast LAA)
• Not guaranteed globally unique (only locally meaningful)
• Must be managed to avoid local conflicts
• Commonly used in virtualization and for special purposes

Common LAA use cases:

Virtual machines require MAC addresses for their virtual network interfaces, but they don't have physical hardware with burned-in addresses. Hypervisors implement various strategies to generate and manage VM MAC addresses.

Hypervisor MAC assignment strategies:

VMware MAC address ranges:

VMware uses several registered OUIs:

VM MAC address persistence:

VM MAC addresses are typically stored in the VM configuration:

• VMware: .vmx file contains ethernet0.addressType and ethernet0.generatedAddress
• Hyper-V: VM configuration database and XML export
• libvirt/KVM: XML domain definition contains <mac address='...'/>
• VirtualBox: .vbox XML configuration

Addresses persist across:

• VM power cycles
• Host reboots
• VM cloning (may be regenerated to avoid duplicates)

Addresses may change with:

• VM import/export (some hypervisors regenerate)
• NIC removal and re-addition
• Cloning without 'new SID/identity' option

A significant evolution in MAC addressing is the adoption of MAC address randomization for privacy protection. This technique replaces consistent hardware addresses with random, temporary addresses to prevent tracking.

The privacy problem:

Traditionally, MAC addresses were permanent identifiers. This enabled:

• Location tracking: Retail stores tracking customers via WiFi probe requests
• Behavioral profiling: Correlating device appearances across locations and times
• Device fingerprinting: Identifying returning devices even with different IPs
• Targeted advertising: Building profiles based on physical movement patterns

Devices constantly broadcast WiFi 'probe requests' seeking known networks—each containing the device's MAC address, creating tracking opportunities.

Types of MAC randomization:

1. Probe Request Randomization

• Device uses random MAC when scanning for available networks
• Prevents tracking of disconnected, scanning devices
• Implemented in iOS 8+, Android 6+

2. Per-Network Randomization (Persistent)

• Device generates unique MAC for each SSID
• Same random MAC used consistently for same network
• Prevents cross-network correlation
• More aggressive privacy protection

3. Time-Based Rotation

• Random MAC changes periodically (e.g., every 24 hours)
• Even the same network sees different addresses over time
• Most aggressive option; can cause captive portal issues

Impact on network operations:

Changing a device's operational MAC address is a common network administration task with legitimate uses ranging from privacy to testing to hardware replacement. Here's a comprehensive guide for major operating systems.

Important considerations before changing:

1. Use valid LAA format: Set U/L bit = 1 (first byte: x2, x6, xA, or xE)
2. Avoid reserved addresses: Don't use broadcast (FF:FF:FF:FF:FF:FF) or multicast
3. Check for conflicts: Ensure no other device on your network uses the same address
4. Document changes: Track manual MAC assignments for troubleshooting

This page has covered the complete lifecycle of MAC address assignment—from global registration to practical modification. Let's consolidate the key points:

Looking ahead:

With address assignment understood, the next page examines OUI (Organizationally Unique Identifier) in depth—exploring its structure, the lookup process, notable OUI assignments, and how network administrators use OUI information for device identification and network management.