How the 48-bit hardware address breaks down into OUI, NIC, and special flag bits
A MAC (Media Access Control) address is a 48-bit unique identifier assigned to every network interface controller. In my work troubleshooting network hardware, I've looked at thousands of MAC addresses, and the key insight is that they are fundamentally 48-bit binary numbers that we humans just happen to write in hexadecimal for convenience. When you see AA:BB:CC:DD:EE:FF, the network hardware sees 10101010:10111011:11001100:11011101:11101110:11111111. Every hex digit maps directly to four binary bits, and understanding that mapping is essential for grasping how switches, ARP, and MAC filtering actually work at the wire level.
I always emphasize to network engineers that MAC addresses are not random. They follow a strict IEEE structure, and the binary layout reveals information about the manufacturer, the address type, and whether the address is globally unique or locally administered. Once you know where to look in the 48-bit sequence, you can read a MAC address like a license plate.
A MAC address is split into two halves of 24 bits each. The first 24 bits (3 octets) are the Organizationally Unique Identifier (OUI), assigned by the IEEE to hardware manufacturers. The last 24 bits (3 octets) are the Network Interface Controller (NIC) portion, assigned by the manufacturer to uniquely identify that specific device. Let me break down 00:1A:2B:3C:4D:5E in binary:
00000000.00011010.00101011 — This tells you the manufacturer. In this case, 00:1A:2B belongs to a well-known vendor. I have a habit of memorizing common OUIs because it makes identifying devices on a network much faster.00111100.01001101.01011110 — This is the device-specific portion. The manufacturer ensures no two devices from their pool get the same 24-bit NIC value.00000000.00011010.00101011.00111100.01001101.01011110With 24 bits in the NIC portion, each manufacturer can produce 224 = 16,777,216 unique devices per OUI. In my experience, large manufacturers like Cisco, Intel, and Apple have multiple OUIs assigned because they produce far more than 16 million network interfaces.
Since MAC addresses are written in hexadecimal (base-16), each hex digit represents exactly 4 binary bits. This is one of those patterns that makes life easier once you learn it. Let me show you the full conversion table for the hex digits you will encounter most often:
0000, 1 = 0001, 2 = 0010, 3 = 00110100, 5 = 0101, 6 = 0110, 7 = 01111000, 9 = 1001, A = 1010, B = 10111100, D = 1101, E = 1110, F = 1111For example, the MAC address AA:BB:CC:DD:EE:FF converts to binary as: 10101010 10111011 11001100 11011101 11101110 11111111. Each colon-separated pair in hex becomes 8 binary bits. I often do this conversion in my head when debugging MAC-based ACLs, and after a while, you start recognizing patterns like FF (all ones, the broadcast MAC) or 00 (all zeros) instantly.
One detail that surprises many engineers is that the least significant bit of the first octet (bit 0 of the 48-bit address) determines whether the MAC is for unicast or multicast. If the bit is 0, the address is unicast (addressed to one specific device). If it is 1, the address is multicast (addressed to a group of devices). For example, 01:00:5E:xx:xx:xx is a multicast MAC range used by IPv4. In binary, the first octet 01 is 00000001 — the last bit is 1, confirming it is multicast. I have used this binary check countless times when analyzing packet captures to quickly distinguish between unicast and multicast traffic.
The second-to-last bit of the first octet (bit 1 of the 48-bit address) tells you whether the MAC is globally unique (assigned by the manufacturer) or locally administered (overridden by software). When the bit is 0, the address is globally unique (burned into the hardware). When it is 1, the address has been locally overridden — common in virtualization, MAC spoofing, or network testing.
In my lab environment, I frequently set locally administered MAC addresses on virtual machines to avoid conflicts. I use addresses starting with 02:xx:xx:xx:xx:xx because 02 in binary is 00000010 — bit 1 is 1 (locally administered) and bit 0 is 0 (unicast). This is a safe range that will never conflict with manufacturer-assigned addresses.
Over the years, I've encountered several special MAC addresses that are worth memorizing because they show up in packet captures and troubleshooting scenarios regularly:
11111111.11111111.11111111.11111111.11111111.11111111. Every bit is 1. This address is used when a device wants to reach every device on the local network. ARP requests use this address.00000001.00000000.01011110). The remaining 24 bits encode the IP multicast group. I've debugged multicast routing issues by verifying that the destination MAC starts with this pattern.00110011.00110011 in binary.Pro Tip: When you see a MAC address in a Wireshark capture, mentally convert the first octet to binary. The last two bits tell you everything about the address type: bit 0 = unicast(0)/multicast(1), bit 1 = global(0)/local(1). This takes five seconds and reveals more than staring at the hex ever will.
The Address Resolution Protocol (ARP) is what connects the IP world (Layer 3) to the MAC world (Layer 2). When your computer knows the destination IP is 192.168.1.1 but does not know the MAC address, it sends an ARP request with the broadcast MAC (FF:FF:FF:FF:FF:FF). The device with that IP responds with its MAC address. I've used ARP table inspection more times than I can remember to track down duplicate IPs, stale entries, or devices that are silently conflicting on a network. Understanding the binary structure of both IP and MAC addresses makes it clear why ARP exists — they are entirely separate addressing systems at different layers, and ARP is the translation layer between them.
Open the Binary Code Decoder in a new tab and enter some binary patterns to see the results instantly. All conversions happen in your browser — no data is sent to any server.