Previous Table of Contents Next


MAC Attack

Just as each residence has a unique telephone number, your computer’s NIC also has a unique number. However, unlike a telephone, each NIC has a unique number built (or burned) into it at the factory; this is referred to as its burned-in address, or BIA. This address is long enough so that trillions and trillions of addresses are possible. For convenience, the address has a compact form, represented by six hexadecimal bytes.


Some folks refer to the BIA as the MAC (media access control) address.

Yikes! Hexadecimal sounds like a witch trial and a math contest rolled up into one. Really, though, it’s just a different method of counting—instead of having digits from 0–9 (decimal), you use digits 0–F (hex). Because you have more options for digits (16 rather than 10), you can express numbers more compactly. Don’t worry about it, though. All you really need to know is that a byte consists of two of these hex digits and that a MAC address is expressed using six bytes. Actually, 00-00-10-2b-5c-8d isn’t too much more tough than 1-800-555-1212, is it?

The IEEE hands out ranges of MAC addresses rather than the addresses themselves (for instance, Proteon Inc. has all numbers that start with 00-00-93). This means you can tell who made a network card by looking at the MAC address’s first three hex bytes. This is called the OUI (organizational unique identifier) and can be useful if you’re troubleshooting certain kinds of problems.


The Institute of Electronic and Electrical Engineers (or IEEE; pronounced eye triple-E) is the organization that, among other things, acts as a standards body for various electronic standards. One of the IEEE’s roles is to act as a clearinghouse for MAC addresses. Because so many network manufacturers exist, it’s really important that MAC addresses be tracked. Otherwise, two different manufacturers might accidentally make network cards with the same address, which will cause network problems if two of these network cards end up on the same network. This could happen even though there are many, many possible MAC addresses. A MAC address’s six-hex-digit format (or 48-bit address, if you want to sound geeky by talking in binary terms) turns into 281 trillion possible addresses—281,474,976,710,656 to be precise! That’s a heck of a lot of combinations. Compare this with the phone system in the United States, where only nine billion phone numbers are available.
OUI ou Non?

Knowing the OUI came in handy for me once when I was experiencing intermittent problems with a new application. The application vendor pointed the finger at one of my network card vendors, who, in turn, told me to get the “latest and greatest” drivers for its network cards to eliminate the problems I was experiencing with the application. Fortunately, I rolled out only a small set of those drivers, which turned out not to be the “greatest.” I started to have major network problems and noticed (from the OUIs listed by the network analyzer) that I was only experiencing problems with the cards I had just updated. I undid the update, the network problems went away, and I leaned on the application vendor to solve the original problem. The OUI can really be a useful concept to know.


The OUI only tells you who made the chip, not the manufacturer who put the board together. Creating a microchip is expensive, but putting these chips together on a circuit board that becomes a NIC is less expensive. Because of this cost differential, many vendors purchase other vendors’ chips to use on their brand of network cards. For example, although Emulex is on the OUI list as using 00-00-c9, Proteon, Inc. has released network boards with this OUI.


If a network configuration option ever asks you whether you want to override the MAC address of a NIC, say no! This option is intended only for experienced network administrators and can wreak havoc if not used correctly.


Previous Table of Contents Next