MAC Address is the acronym for media access control address. MAC addresses are used to uniquely identify network interfaces for communication at the physical layer of the network. MAC addresses are usually embedded into the network card. A MAC address is like a serial number of a phone while the IP address is like the phone number. Launched by sniffing a network for MAC addresses of clients who are actively associated with a switch port and re-using one of those addresses. By listening to the traffic on the network, a malicious user can intercept and use a legit user's MAC address to receive all the traffic destined for that user. MAC Address is the acronym for media access control address. MAC addresses are used to uniquely identify network interfaces for communication at the physical layer of the network. MAC addresses are usually embedded into the network card. A MAC address is like a serial number of a phone while the IP address is like the phone number.
MAC Address Lookup Tool searches your MAC Address or OUI in mac address vendor database. The MAC Address vendor database consists of a list of mac addresses of all devices manufactured till date. Finding the mac address from this database tells us which manufacturer originally manufactured this device and what is the prefix, postfix of a given mac address, moreover it tells us what country was this device manufactured. All this information is useful if you want to verify the generated mac address with the original vendor of this device in OUI vendor database.
MAC Address or media access control address is a unique ID assigned to network interface cards (NICs). It is also known as a physical or hardware address. It identifies the hardware manufacturer and is used for network communication between devices in a network segment. MAC Address usually consists of six groups of two hexadecimal digits.
The network adapters or network interface cards always come with a MAC address which is fed into hardware, usually in read-only memory (ROM), or BIOS system. The physical address is stored into the NIC by its manufacturer, that is why this address is also called a burned-in address (BIA) or ethernet hardware address.
There are several NIC manufacturers; some well-known of them are Dell, Cisco, Belkin. The first three sets of two hexadecimal numbers in a MAC Address identifies the card manufacturer, and this number is called OUI (organizationally unique identifier). OUI is always the same for NICs manufactured by the same company. For example, let's say a network card manufactured by dell has a physical address: 00-14-22-04-25-37
, in this address, 00-14-22
is the OUI of Dell which identifies that the device is by Dell. It may be interesting for you to know that all the OUIs are registered and assigned to the manufacturers by IEEE.
To find MAC Address, see the instructions given below for popular operating systems.
cmd
and press EnterOR
cmd
and press Enteripconfig/all
and press EnterM:M:M:S:S:S
. For example: 00-14-22-04-25-37
System Preferences
System Preferences
, click View
menu and select Network
Network
window that just opened, click the Wi-Fi
, Ethernet
, or Airport
icon on left.Advanced
on bottom right.Hardware
, and look for MAC Address
field.MAC Address
should be in the format: M:M:M:S:S:S
. For example: 00-14-22-04-25-37
ifconfig -a
00-14-22-04-25-37
Settings
app.General
option in settings.About
option.Wi-Fi Address
MAC Address
should be in the format: M:M:M:S:S:S
. For example: 00-14-22-04-25-37
Settings
app.Wireless & Networks
Wi-Fi Settings
Advanced
, and your wireless network card's MAC Address should appear here.Settings
app.About Device
Hardware Info
Advanced
, and your wireless network card's MAC Address should appear here.If you are using a display filter of eth.addr xx:xx:xx:xx:xx:xx and you are not seeing any information being displayed/sniffed, then the traffic for that MAC address is not passing through the port you're sniffing on.
You can use a list for your MAC's in one display filter, but not a range, unless you switch to IP's instead of MAC's. For instance, tshark -i 1 -R 'eth.addr eq xx:xx:xx:xx:xx:xx or eth.addr eq xx:xx:xx:xx:xx:xx'
If you are trying to trace MAC's on the switch you are also connected to, then you'll want to sniff from a port which is spanned/mirrored to the port which has inbound/outbound traffic of that switch, so that you will see all the traffic coming in and out of the switch.
(I'm assuming the traffic you are looking for is traveling to a destination on another switch, outside the network, or at least to your gateway).
By specifying the MAC address filter, eth.addr eq xx:xx:xx:xx:xx:xx you are filtering for all traffic to and from that associated MAC address. Like the MAC address, The LLC logical link control protocol is also layer 2, but is upper sublayer of Data Link Layer and won't affect the ability to capture the traffic unless you specify llc as a filter and there isn't any llc traffic, then you would get the blank screen.
Hope this is helpful,John