Are MAC Addresses Really Permanent and Unique?

MAC addresses are designed to be permanent and globally unique, but in practice they are neither guaranteed. The manufacturer's burned-in address comes from an IEEE-assigned block, so it should not repeat. Operating systems can still replace it in software, and phones, laptops and virtual machines now use randomized or generated addresses by default.

This post explains where the "permanent and unique" idea comes from, where it breaks down, and what that means for anyone who manages networks or Linux servers. It is part of our networking fundamentals series under What Is the OSI Model and Why Is It Still Relevant Today?. Facts about address structure come from the IEEE Registration Authority's own guidelines, and the randomization behaviour from Android, Apple and Microsoft documentation, all checked in November 2026.

Key takeaways

• A MAC address used on Ethernet and Wi-Fi is a 48-bit identifier (EUI-48). The first part identifies the organisation that bought the address block from the IEEE.
• Uniqueness depends on the IEEE assigning blocks without overlap and on manufacturers never reusing a value. The IEEE says it tries hard to avoid duplicates but does not guarantee that none exist.
• The burned-in address stays in the network card, but the address the operating system sends on the wire can be changed with one command.
• Android 10 and later, iOS 14 and later, and Windows (when the setting is on) use randomized Wi-Fi addresses, so one phone can show up with a different MAC on every network.
• A bit in the first byte tells you whether an address is universally administered (from a vendor block) or locally administered (set by software or an administrator).
• Because MACs can change and are visible to anyone on the link, MAC filtering is weak access control. Use 802.1X or proper authentication instead.

What a MAC address is

A Media Access Control (MAC) address identifies a network interface on a local link such as an Ethernet segment or a Wi-Fi network. The common format is 48 bits, written as six pairs of hexadecimal digits: 3c:22:fb:1a:2b:3c on Linux and macOS, or 3C-22-FB-1A-2B-3C on Windows. The IEEE calls this format an EUI-48 (Extended Unique Identifier). Its older name, MAC-48, is now obsolete according to the IEEE Registration Authority.

Switches use MAC addresses to decide which port a frame should leave from, and hosts use ARP (for IPv4) or Neighbor Discovery (for IPv6) to find the MAC that belongs to an IP address on the same subnet. A MAC address never crosses a router: each hop rewrites the Ethernet header with new source and destination MACs. If the difference between the two address types is still fuzzy, read the difference between a MAC address and an IP address and how ARP maps IP addresses to MAC addresses.

Why MAC addresses are called unique

The IEEE Registration Authority sells blocks of addresses to manufacturers. The main block types are:

For an MA-L block, the first three bytes are the OUI and the manufacturer fills in the last three bytes. As long as the IEEE never assigns the same block twice and each manufacturer uses each value once, no two cards share an address. You can look up which company owns a prefix in the IEEE's public MA-L listing.

The IEEE's own guidelines add an important footnote: the Registration Authority "makes a concerted effort to avoid duplicate assignments but does not guarantee" that none have happened, and global uniqueness also depends on proper use and the absence of faults. In other words, uniqueness is a well-run convention, not a law of physics. Manufacturing errors, cloned devices and cheap hardware that ships with the same default address on every unit have all produced duplicates in the field.

Reading the two special bits

When an EUI-48 is used as a MAC address, the two lowest bits of the first byte have special meanings, as defined in IEEE 802 and explained in the IEEE RA guidelines:

A quick way to read this: look at the second hexadecimal digit. If the address is unicast and that digit is 2, 6, A or E, the address is locally administered. So 02:42:ac:11:00:02 or da:a1:19:5e:4f:01 were generated by software, while 3c:22:fb:1a:2b:3c came from a vendor block. Since IEEE 802c-2017, the Structured Local Address Plan (SLAP) divides local address space into quadrants so that protocols and administrators can assign local addresses without colliding.

Why MAC addresses are called permanent

The manufacturer writes the universal address into the network card's non-volatile memory (EEPROM, flash or fuses) at the factory. This is often called the burned-in address (BIA) or permanent address. Reinstalling the operating system does not change it, and moving the card to another computer takes the address with it. That stability is why the address was historically used for DHCP reservations, asset inventories and software licences.

The catch is that the network card does not have to send its burned-in value. Drivers let the operating system program a different address into the card's filter, and every frame then carries the new value. The original stays stored in hardware and comes back if you remove the override. On Linux you can see both:

# Current address the interface is using
ip link show dev enp1s0

# Permanent (burned-in) address stored in the hardware
ethtool -P enp1s0

Recent versions of iproute2 also print a permaddr field in ip link output when the current address differs from the permanent one. So "permanent" is accurate for the stored hardware value, but not for the address other devices actually see.

Five situations where the MAC address is not permanent or unique

1. An administrator changes it on purpose

Changing a MAC address is a normal administration task: replacing a failed server while keeping a DHCP reservation, matching a licence tied to a MAC, or testing. On Linux a temporary change looks like this (it is lost at reboot):

sudo ip link set dev enp1s0 down
sudo ip link set dev enp1s0 address 02:00:00:aa:bb:01
sudo ip link set dev enp1s0 up

To make it persistent on RHEL, Rocky or Fedora with NetworkManager, set the cloned address on the connection profile. NetworkManager accepts an explicit address or the special values preserve, permanent, random and stable:

sudo nmcli connection modify "System enp1s0" ethernet.cloned-mac-address 02:00:00:aa:bb:01
sudo nmcli connection up "System enp1s0"

Choose a locally administered address (second hex digit 2, 6, A or E) so you never collide with a real vendor block. Our guide to configuring networking in RHEL 10 with nmcli and nmtui covers connection profiles in detail.

2. Wi-Fi privacy randomization

Because a fixed MAC lets shops, airports and advertisers recognise the same phone across visits, all major platforms now hide the hardware address on Wi-Fi:

The IEEE responded with IEEE Std 802.11bh-2024, an amendment approved in September 2024 that defines how Wi-Fi networks can keep services working when client stations use randomized and changing addresses.

3. Virtual machines, containers and cloud instances

A virtual network card has no factory. The hypervisor generates its address, usually from the vendor's own OUI or from locally administered space. KVM and libvirt use the 52:54:00 prefix (locally administered), and VMware uses its own OUIs such as 00:50:56. Cloud providers assign a MAC to each virtual interface, and container runtimes generate a locally administered MAC for each container interface. These addresses are unique only within the scope the platform manages, and cloning a VM image without regenerating its MAC is a classic way to create duplicates on a LAN.

4. Shared or virtual MACs for high availability

Some protocols deliberately give the same MAC to more than one device. VRRP (RFC 5798) uses a virtual router MAC in the form 00:00:5e:00:01:XX, which moves to whichever router is currently active so that hosts never have to update their ARP cache. Linux bonding in active-backup mode presents one MAC for several physical ports. Here "one address, many cards" is the design.

5. Spoofing by an attacker

Because changing a MAC takes one command and every frame shows the sender's address, an attacker on the same network can copy a trusted device's MAC to bypass MAC filters or captive portals. This is the main reason MAC addresses should never be your only proof of identity. Switch features such as port security, DHCP snooping and Dynamic ARP Inspection, plus 802.1X authentication, are the standard defences.

What this means for network and Linux administrators

• Do not rely on MAC filtering for security. Use WPA3-Enterprise or 802.1X with certificates or credentials. MAC allowlists only keep out people who do not try.
• Expect DHCP reservations to break for personal devices. A phone with a randomized address looks like a new client. Ask users to set the network to a fixed private address, or identify devices through 802.1X instead.
• Keep server MACs stable. On servers, leave the hardware address in place or set a documented locally administered one, so reservations, monitoring and firewall rules keep working.
• Regenerate MACs when cloning VMs. Most hypervisors do this by default; check templates and automation scripts that copy configuration files.
• Watch for duplicates. Two interfaces with the same MAC cause switch MAC tables to flap and traffic to drop intermittently. The symptoms resemble two devices sharing the same IP address.
• Keep MACs out of IPv6 addresses. Older SLAAC built the interface ID from the MAC (modified EUI-64), which exposed it to every website. RFC 8064 recommends stable opaque identifiers (RFC 7217) instead, and RFC 8981 defines temporary addresses. Windows, macOS, iOS and Android avoid MAC-based interface IDs by default; on Linux, check the ipv6.addr-gen-mode setting of each NetworkManager profile.

For how MAC addresses drive switching and broadcast behaviour inside a LAN, see how physical addressing affects LAN communication.

Quick reference: universal vs locally administered addresses

Build hands-on Linux networking skills

Reading ip link output, managing NetworkManager profiles and troubleshooting ARP problems are core tasks in our Linux administration training, taught on RHEL in our Kharadi, Pune classroom and live online across India. If you are new to RHEL, start with setting up RHEL 10 for the first time.

Frequently asked questions

Can a MAC address be changed?

Yes. The burned-in address in the hardware usually stays the same, but the operating system can make the card use any address. On Linux, ip link set dev IFACE address ... changes it until reboot, and NetworkManager's cloned-mac-address setting makes the change persistent.

Are MAC addresses really unique worldwide?

Universally administered addresses are meant to be unique because the IEEE assigns non-overlapping blocks to manufacturers. The IEEE itself does not guarantee that duplicates never occur, and randomized, virtual and manually set addresses are only unique within their own network.

Why does my phone show a different MAC address on each Wi-Fi network?

It uses a private or randomized address for privacy. Android 10 and later and iOS 14 and later generate a separate address per network by default, so networks cannot track the device across locations using its hardware MAC.

How can I tell if a MAC address is randomized?

Check the second hexadecimal digit. For a unicast address, 2, 6, A or E means the locally administered bit is set, which is what randomized, virtual and manually assigned addresses use. Vendor-assigned addresses have 0, 4, 8 or C in that position.

Is MAC filtering a good security measure?

No. MAC addresses are sent unencrypted in every frame and can be copied with one command, so filtering stops only casual users. Use WPA3-Enterprise or 802.1X authentication, and treat MAC filtering as inventory control at most.

What is the difference between the permanent and the current MAC address?

The permanent address is the value stored in the network card at the factory. The current address is what the interface uses right now, which may be an override. On Linux, ethtool -P shows the permanent address and ip link show shows the current one.

Do virtual machines have MAC addresses?

Yes. The hypervisor generates one for each virtual network card, for example with the 52:54:00 prefix on KVM or a VMware OUI such as 00:50:56. Cloning a VM without regenerating the MAC can create duplicates on the same network.

Does a MAC address leave my local network?

No. Routers rewrite the Ethernet header at every hop, so remote servers see your public IP address, not your MAC. The exception was older IPv6 autoconfiguration that embedded the MAC in the address, which most current operating systems no longer do by default.

References

• IEEE Registration Authority: Guidelines for Use of EUI, OUI, and CID
• IEEE Registration Authority: Registries (MA-L, MA-M, MA-S, CID)
• Android Open Source Project: MAC randomization behavior
• Apple Support: Use private Wi-Fi addresses on Apple devices
• Microsoft Support: Connect to a Wi-Fi network in Windows (random hardware addresses)
• NetworkManager: 802-11-wireless settings (cloned-mac-address)
• RFC 5798: Virtual Router Redundancy Protocol (VRRP) Version 3
• RFC 8064: Recommendation on Stable IPv6 Interface Identifiers
• RFC 7217: Semantically Opaque Interface Identifiers with IPv6 SLAAC