Documenting my network
Every device on a network has at least two identifiers: a hardware address burned into its network interface card, and a logical address assigned by the network. Understanding how both addresses are structured, what they identify, and how networking hardware uses them to direct traffic is essential for managing and documenting any network.
Why addressing matters
A network without addresses is like a city without street names. When a device sends data, the network infrastructure needs to know which device should receive it — and how to get there. Two distinct addressing systems work together to make this happen: MAC addresses identify the physical hardware at the local level, and IP addresses identify devices at the logical, routable level.
Knowing the structure of each address type allows you to read diagnostic output, document network inventory accurately, and understand why data moves the way it does through switches and routers.
What this topic covers
- › 2.2.A — How MAC addresses are structured, read, and used to identify physical devices
- › 2.2.B — How IP addresses are structured and used to identify devices across networks
- › Nodes vs. hosts — The distinction between all network devices and those that send or receive data
- › CAM tables — How switches learn and use MAC addresses to forward traffic efficiently
Network nodes and hosts
Before addressing individual devices, it helps to understand the vocabulary used to describe them. Not every device on a network plays the same role, and networking terminology distinguishes between them clearly.
Network node
A node is any device connected to a network — regardless of what role it plays. This is the broadest category. Every device that participates in a network, whether it moves data for others or generates its own traffic, is a node.
Examples: computers, printers, smartphones, switches, routers, wireless access points, smart TVs, thermostats.
Host (endpoint)
A host is a specific type of node — one that sends or receives data on the network. Hosts are the source or destination of network traffic. They are often called endpoints because they represent the ends of a communication path.
Examples: computers, printers, smartphones, tablets, servers. Hosts access content or provide it.
Not hosts: switches, routers, wireless access points. These devices move traffic for others but are not the originator or final destination of that traffic.
The key distinction
All hosts are nodes, but not all nodes are hosts. A switch is a node because it is connected to and participates in the network, but it is not a host because switching equipment does not originate or consume the data it forwards. When documenting network devices, hosts require IP addresses; infrastructure nodes like switches may have management IPs but they are not endpoints in the data communication sense.
Network interface cards and MAC addresses
To connect to a network, a device needs a network interface card (NIC). The NIC is the hardware component — either built into the motherboard or installed separately — that handles the physical transmission and reception of data. Every NIC ships from the factory with a permanently assigned identifier called a MAC address.
What a MAC address is
- MAC stands for Media Access Control.
- Also called a physical address or hardware address.
- Assigned directly to the NIC at the time of manufacture.
- The address is hardcoded into the NIC — it does not change when the device moves to a different network.
- Every NIC ever produced is intended to have a globally unique MAC address.
MAC address permanence
Because a MAC address is burned into the hardware, it identifies the specific NIC — not the device's location or network assignment. A laptop with a MAC address of 6F:72:69:6F:6E:2A has the same MAC address whether it is connected to a home network, a corporation's network, or a campus guest network.
This is different from an IP address, which is assigned based on the network the device is currently connected to and can change from one connection to the next.
MAC address structure
A MAC address is a 48-bit identifier. That means it is stored as 48 binary digits (0s and 1s) in the hardware. Because 48 binary digits are unwieldy for humans to work with directly, MAC addresses are typically displayed in hexadecimal notation, which compresses the information into a much more readable format.
The OUI (first 24 bits)
The first half of a MAC address — the first 24 bits, or first 6 hexadecimal characters — is called the Organizationally Unique Identifier (OUI). The OUI identifies the manufacturer of the NIC. Every company that produces NICs is assigned one or more OUIs by the IEEE. Network administrators and forensic analysts can look up any OUI to determine which company made the hardware.
Example: In 6F:72:69:6F:6E:2A, the OUI is 6F:72:69.
The device identifier (last 24 bits)
The second half of the MAC address — the last 24 bits — is assigned by the manufacturer to uniquely identify each individual NIC they produce. Different NICs from the same manufacturer share the same OUI but have different device identifiers. Combined with the OUI, this creates a globally unique 48-bit address.
Example: In 6F:72:69:6F:6E:2A, the device identifier is 6F:6E:2A.
MAC address notation formats
All three formats below represent the same MAC address. Different operating systems and tools display MAC addresses in different formats, so you need to recognize all three.
| Format | Example | Common usage |
|---|---|---|
| No separator (continuous) | 6F72696F6E2A | Router ARP tables, some vendor tools |
| Colon-separated | 6F:72:69:6F:6E:2A | Linux, macOS, most network documentation |
| Hyphen-separated | 6F-72-69-6F-6E-2A | Windows (ipconfig /all) |
Understanding hexadecimal
MAC addresses are displayed in hexadecimal because it is a practical way to represent large binary numbers compactly. A working understanding of hexadecimal helps you identify MAC address components and verify values in diagnostic output.
What hexadecimal is
Hexadecimal is a base-16 number system. While the familiar decimal system uses ten digits (0–9), hexadecimal uses sixteen: the digits 0–9 and the letters A–F. The letter A represents 10, B represents 11, and so on through F representing 15.
Because 16 is a power of 2 (24 = 16), each hexadecimal digit directly represents 4 binary bits. Two hex digits represent exactly one byte (8 bits), making hex a compact and exact representation of binary data.
| Decimal | Hex | Binary |
|---|---|---|
| 0–9 | 0–9 | 0000–1001 |
| 10 | A | 1010 |
| 11 | B | 1011 |
| 12 | C | 1100 |
| 13 | D | 1101 |
| 14 | E | 1110 |
| 15 | F | 1111 |
Converting decimal to hexadecimal
To convert a decimal number to hexadecimal, divide by 16 repeatedly and track the remainders. The remainders, read from last to first, form the hexadecimal number.
Example: decimal 79 → hex
79 ÷ 16 = 4 remainder 15 (F)
4 ÷ 16 = 0 remainder 4
Result: 4F
Reading the remainders from last to first gives 4F. To verify: (4 × 16) + 15 = 64 + 15 = 79. ✓
Why this matters: the values in each MAC address pair (e.g., 6F) represent single byte values. Being able to read and compare hex values is a practical skill for network documentation and forensic work.
How switches use MAC addresses: the CAM table
When a switch first powers on, it knows nothing about which devices are connected to which of its ports. As devices send data, the switch learns their MAC addresses and builds a lookup table that lets it send traffic only to the correct port rather than flooding every port.
The CAM table
Switches store MAC address–to–port mappings in their Content Addressable Memory (CAM) table. When a frame arrives at the switch, the switch reads the destination MAC address and checks its CAM table. If a match is found, the frame is forwarded only to the correct port. If no match is found, the frame is flooded to all ports so the destination can respond and the switch can learn its location.
Example CAM table
| MAC Address | Port |
|---|---|
| 6D:6F:72:69:61:68 | 1 |
| 4F:72:69:6F:6E:2A | 2 |
| 70:6C:61:72:24:58 | 3 |
When Device A (port 1) sends a frame to Device B (4F:72:69:6F:6E:2A), the switch looks up the destination MAC, finds port 2, and forwards the frame only to port 2. Device C on port 3 never sees the frame — this is what makes switches more efficient than hubs.
IP addresses
While MAC addresses identify physical hardware, IP (Internet Protocol) addresses identify devices at the logical, software-assigned level. IP addresses are used to route data across networks — including the internet — where devices need a routable identity that can change based on their network location.
IPv4 structure
The most common IP addressing version is IPv4. An IPv4 address is a 32-bit number, typically displayed in dotted-decimal notation — four groups of decimal numbers separated by dots.
192.168.1.105
Each group is called an octet because it represents 8 bits. Since 8 bits can hold values from 0 to 255, each octet ranges from 0 to 255. The four octets together form the 32-bit address. Administrators split those 32 bits between a network portion and a host portion using prefix notation such as /24 — see the IPv4 subnetting tutorial for a full walkthrough.
IP vs. MAC addressing
- MAC addresses are permanent hardware identifiers; IP addresses are logical and can change.
- MAC addresses work within a single local network; IP addresses work across many interconnected networks.
- A device retains its MAC address when it moves networks, but it receives a new IP address from the new network's DHCP server.
- Switches use MAC addresses for local forwarding; routers use IP addresses to move traffic between networks.
IP address categories
| Category | Range examples | Used for |
|---|---|---|
| Private (RFC 1918) | 192.168.x.x 10.x.x.x 172.16–31.x.x | SOHO and enterprise internal networks; not routable on the internet |
| Public | All others not in private ranges | Assigned by ISPs; routable on the internet |
| APIPA | 169.254.0.0–169.254.255.255 | Self-assigned when DHCP fails; not routable beyond the local link |
| Loopback | 127.0.0.1 | Internal OS testing; traffic never leaves the device |
Putting it all together
Every device that communicates on a network uses two addresses: a permanent hardware address (MAC) and a logical network address (IP). These work at different layers of the network and serve different purposes.
MAC address (48-bit, hexadecimal, hardcoded in NIC)
→ First 24 bits = OUI (identifies manufacturer)
→ Last 24 bits = device identifier
→ Stored in switch's CAM table for local forwarding
→ Does not change when device moves networks
IP address (32-bit, dotted-decimal, assigned by DHCP or manually)
→ 4 octets, each 0–255
→ Private (192.168.x.x, 10.x.x.x) for internal use
→ Changes when device moves to a different network
→ Used by routers to move traffic across networks