Rachelle Rathbone

Networking - IP and MAC addresses

What they are and why they matter

May 18, 2023

There are many parts of a network that are necessary to make sure data can travel from its source to its destination. Two of these crucial pieces are IP addresses and MAC addresses, both of which help to identify a network device but in different ways.

MAC Addresses

When devices on your network, such as computers and laptops, are manufactured, they are assigned a physical MAC (Media Access Control) address. This address is often referred to as a 'burned in address' because it is literally burned into the network card of the device and can't be changed. This physical address is used to identify where to send information across a network or through multiple networks.

MAC addresses are typically made up of 48 bits which are divided into 2 groupings of 24 bits each. The first 24 bits are called the Organisationally Unique Identifier (OUI) or vendor code as they are unique to the specific vendor or manufacturer. The remaining 24 bits are called an extension identifier and are used to assign unique addresses to devices.

But what does a MAC address actually look at? While computers work with bits, us humans tend to work with letters and numbers. So if you were to locate the MAC address on one of your devices it would look something like this: `00:1A:C2:7B:00:47` - a series of 12 hexadecimal characters (letters A-F and numbers 0-9) where the first 6 are the vendor code and the remaining are the extension identifier.

IP Addresses

Undoubtedly, you've probably had plenty of experience typing URLs into a browser to visit various websites. But have you ever stopped to think what happens once you hit enter?

Finding a DNS Record

Although what you type into an address bar is readable to you, it's not exactly computer friendly. For this reason, every website URL essentially has two versions:
  • the human-readable version e.g. https://rachellerathbone.com
  • and the computer-readable version, known as an IP (Internet Protocol) address e.g.

But you may have already identified a problem here: when you type a human-readable URL into an address bar, how does it get mapped to its IP address? That's where DNS records come in.

DNS (Domain Name System) is a list of URLs and their IPs. How it works is similar to how you would use a phone book: you have a name you want to look up (in this case a human-readable URL) and you want to find the corresponding phone number (IP address). Each entry in the 'phone book' (DNS) is called a DNS record.

DNS records can be stored in a number of different spots and the browser will check one after another, always in the same order, until it finds what it is looking for.

  1. Browser cache: every browser stores a repository of DNS records, for a set duration, of sites you have previously visited. If the browser doesn't find a match there, it moves onto the next spot.
  2. OS cache: Think Windows, Mac etc. At this step, the browser makes a system call to get the operating system (OS) of your device to checks its cache of DNS records.
  3. Router cache: Next up, if the OS doesn't find anything, the browser asks the network's router to check its cache for a match for the URL. If no match is found, it will move onto asking the ISP cache.
  4. ISP cache: ISPs (Internet Service Providers) such as AT&T, Telstra, Comcast extra all keep their own caches of, you guessed it, DNS records.

If the browser gets through all 4 of the above steps and still hasn't had any luck, the ISPs DNS server will kick off a DNS query to find the IP address of the server that hosts whatever URL you typed into your address bar.

What Are the Parts of an IP Address?

There are 2 separate IP protocols: IPv4 and IPv6.


IPv4 was created in 1980 and IP addresses in this version are written with a dotted decimal notation e.g The entirety of the address is 32 bits in length, grouped into 4 groups of 8 bits. Each of these groupings is called an octet.

A subnet mask separates the 32-bits into two 16-bit parts. The first part is used to identify the network where the IPv4 address belongs and the second is used to identify the host.

Since the creation of IPv4, there has been an explosion of devices and the number of address you can create from this formatting just doesn't cut. Enter IPv6.


Launched in 1998, IPv6 was designed to resolve the problem of IPv4 exhaustion. Although its ultimate goal was to replace IPv4, the two now coexist. So some URLs will map to the format we just looked at. While others (a lot more others) will map to something like this: 2001:db8:3333:4444:5555:6666:7777:8888.

An IPv6 address consists of 32 hexadecimal numbers (0-9 and A-F) with 8 quartets of 4 hexadecimal digits, all separated by a colon. Similar to IPv4, the first half of these groupings is used to identify the network, while the second half is used to identify the host. The main differences with IPv6, what IPv4 calls a subnet mask, IPv6 calls a Prefix Length (they work a little different, but you get the gist). Additionally, the first half is called the Prefix.
© 2023, Rachelle Rathbone