Ethernet and MAC addressing - what is on the wire · Linux

Ethernet is the most common layer-2 technology in production data centres and office networks. It defines how bits are framed, addressed, and detected for errors on a single broadcast domain.

MAC address format

A MAC (Media Access Control) address is a 48-bit identifier assigned to every Ethernet-capable NIC. The format is six pairs of hex digits separated by colons or hyphens:

00:1A:2B:3C:4D:5E
aa:bb:cc:dd:ee:ff

The first three octets are the OUI (Organisationally Unique Identifier) assigned to the manufacturer. The last three are the device-specific part assigned by the manufacturer. Some modern NICs randomise the MAC for privacy.

Hypervisors do not all behave the same way here, and the common shortcut “a VM has a locally-administered MAC” is wrong:

Platform	Prefix	Locally administered?
KVM / libvirt	`52:54:00`	Yes — `0x52` is `0101 0010`, U/L bit set
VMware ESXi	`00:50:56`, `00:0C:29`	No — VMware’s own registered OUI
Xen	`00:16:3E`	No — Xensource’s registered OUI
Hyper-V	`00:15:5D`	No — Microsoft’s registered OUI

So you cannot tell a physical host from a virtual one by the U/L bit alone. Look the OUI up instead. This matters when you are reading a DHCP lease file or a switch MAC table during an incident and trying to work out what a device actually is.

Inspect the local NIC

ip -br link show
ip -d link show eth0
ethtool eth0
ip neigh show

The ip -d view shows the MAC, MTU, and link state. ethtool shows the negotiated speed and duplex. ip neigh shows the MAC addresses the host has learned on this link.

Frame format

An Ethernet frame carries:

+--------+--------+--------+--------+----------+--------+
| Preamble| Dest   | Source | EtherType | Payload |  FCS   |
|        | MAC    | MAC    |          |          |        |
+--------+--------+--------+--------+----------+--------+

Preamble: 7 bytes of alternating 1s and 0s, used for clock synchronisation.
Destination MAC: who the frame is for.
Source MAC: who sent it.
EtherType: the protocol of the payload (0x0800 for IPv4, 0x86DD for IPv6, 0x0806 for ARP).
Payload: up to 1500 bytes for standard Ethernet; 9000 for jumbo frames.
FCS (Frame Check Sequence): 32-bit CRC for error detection.

Jumbo frames require every switch and NIC in the path to be configured for them; if any link reverts to standard MTU, packets are silently dropped.

Unicast, broadcast, multicast

Unicast: a frame sent to one specific MAC. Most traffic is unicast.
Broadcast: ff:ff:ff:ff:ff:ff is the broadcast address; every device on the LAN processes the frame. ARP requests are broadcast.
Multicast: the low bit of the first octet is 1 (01:00:00:00:00:00 and up). Used for IPv6 neighbour discovery, OSPF, and some service-discovery protocols.

A host never forwards broadcast frames to other interfaces. That is the entire job of a switch vs a router: a switch keeps broadcast frames on the same broadcast domain; a router stops them.

How frames traverse a LAN

When host A sends to host B:

A constructs an IP packet with B’s IP.
A checks its ARP cache. If B’s MAC is unknown, A broadcasts an ARP request: “who has 10.0.0.5? Tell 10.0.0.1”.
B replies with its MAC: “10.0.0.5 is at aa:bb:cc:dd:ee:ff”.
A caches the binding and sends the IP packet encapsulated in an Ethernet frame with destination aa:bb:cc:dd:ee:ff.
The switch delivers the frame to B’s port only (unicast).

If A and B are on different subnets, A sends the frame to its default gateway’s MAC instead, and the router takes it from there.

Inspect and tune

ip link set eth0 mtu 9000
ethtool -s eth0 speed 10000 duplex full autoneg off
ethtool -k eth0     # show offloads
ip link set eth0 address 02:00:00:00:00:01   # set a local MAC

Be cautious changing these in production. A wrong MTU causes silent packet loss; turning off autonegotiation can take a link down entirely.