{"id":55176,"date":"2020-01-14T00:00:00","date_gmt":"2020-01-13T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vsyo-chto-vy-hoteli-znat-o-mas-adrese"},"modified":"2020-02-18T14:03:16","modified_gmt":"2020-02-18T11:03:16","slug":"vsyo-chto-vy-hoteli-znat-o-mas-adrese","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/vsyo-chto-vy-hoteli-znat-o-mas-adrese","title":{"rendered":"Everything you wanted to know about the MAC address","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"EverythingIt is well known that these six bytes, usually displayed in hexadecimal format, are assigned to the network card at the factory and appear random at first glance. Some know that the first three bytes of the address are the manufacturer's identifier, while the other three bytes are assigned to it. It's also known that you can assign yourself a random<\/em> address. Many have also heard of «random addresses» in Wi-Fi.<\/p>\n

<\/p>\n

Let's figure out what this is. <\/p>\n

<\/p>\n

A MAC address (media access control address) is a unique identifier assigned to a network adapter, used in networks adhering to IEEE 802 standards, primarily Ethernet, Wi-Fi, and Bluetooth. It is officially called the 'EUI-48 identifier.' From the name, it is obvious that the address is 48 bits long, or 6 bytes. There is no universally accepted standard for writing the address (unlike IPv4 addresses, where octets are always separated by dots). It is usually written as six hexadecimal numbers separated by colons: 00:AB:CD:EF:11:22, although some equipment manufacturers prefer the format 00-AB-CD-EF-11-22 and even 00ab.cdef.1122.<\/p>\n

<\/a><\/noindex><\/p>\n

Historically, addresses were burned into the chipset's firmware without the possibility of modification without a flash programmer, but currently, the address can be changed programmatically from the operating system. You can manually set a MAC address on a network card in Linux and MacOS (always), Windows (almost always, if allowed by the driver), Android (only rooted); on iOS (without rooting), such a trick is impossible.<\/p>\n

<\/p>\n

Address Structure<\/h3>\n

<\/p>\n

The address consists of a part of the manufacturer's identifier, OUI, and the identifier assigned by the manufacturer. The assignment of OUI identifiers (Organizationally Unique Identifier) is working on<\/a><\/noindex> is managed by the IEEE organization. In fact, its length can be not just 3 bytes (24 bits), but 28 or 36 bits, from which blocks (MAC Address Block, MA) of addresses of types Large (MA-L), Medium (MA-M), and Small (MA-S) are formed, respectively. The size of the issued block, in such cases, will be 24, 20, and 12 bits or 16 million, 1 million, and 4 thousand addresses. Currently, about 38 thousand blocks have been allocated, which can be viewed using various online tools, for example, at IEEE<\/a><\/noindex> or Wireshark<\/a><\/noindex>.<\/p>\n

<\/p>\n

Who Owns the Addresses<\/h3>\n

<\/p>\n

Simple processing of publicly available extraction database<\/a><\/noindex> from IEEE provides quite a lot of information. For example, some organizations have claimed many OUI blocks. Here are our heroes:<\/p>\n

<\/p>\n

Vendor
\nNumber of blocks\/entries
\nNumber of addresses, millions.<\/p>\n

Cisco Systems Inc
\n888
\n14208<\/p>\n

Apple
\n772
\n12352<\/p>\n

Samsung
\n636
\n10144<\/p>\n

Huawei Technologies Co.Ltd
\n606
\n9696<\/p>\n

Intel Corporation
\n375
\n5776<\/p>\n

ARRIS Group Inc.
\n319
\n5104<\/p>\n

Nokia Corporation
\n241
\n3856<\/p>\n

Private
\n232
\n2704<\/p>\n

Texas Instruments
\n212
\n3392<\/p>\n

zte corporation
\n198
\n3168<\/p>\n

IEEE Registration Authority
\n194
\n3072<\/p>\n

Hewlett Packard
\n149
\n2384<\/p>\n

Hon Hai Precision
\n136
\n2176<\/p>\n

TP-LINK
\n134
\n2144<\/p>\n

Dell Inc.
\n123
\n1968<\/p>\n

Juniper Networks
\n110
\n1760<\/p>\n

Sagemcom Broadband SAS
\n97
\n1552<\/p>\n

Fiberhome Telecommunication Technologies Co. LTD
\n97
\n1552<\/p>\n

Xiaomi Communications Co Ltd
\n88
\n1408<\/p>\n

Guangdong Oppo Mobile Telecommunications Corp.Ltd
\n82
\n1312<\/p>\n

<\/p>\n

Google has only 40, and it's not surprising: they themselves don't produce that many network devices.<\/p>\n

<\/p>\n

MA blocks are not provided for free; they can be purchased for reasonable prices (without a subscription fee) at $3000, $1800, or $755 respectively. Interestingly, for additional money (per year), you can purchase a \"hiding\" of public information about the allocated block. Currently, as seen above, there are 232 such blocks.<\/p>\n

<\/p>\n

When will MAC addresses run out?<\/h3>\n

<\/p>\n

We are all rather tired of the never-ending stories for the past 10 years that \"IPv4 addresses are about to run out.\" Yes, obtaining new IPv4 blocks is already difficult. It is known that IP addresses are distributed extremely unevenly<\/a><\/noindex>; there are giant and underutilized blocks belonging to large corporations and US government institutions, though there is little hope for their redistribution in favor of those in need. The spread of NAT, CG-NAT, and IPv6 has made the shortage of public addresses less acute.<\/p>\n

<\/p>\n

A MAC address is 48 bits, of which 46 can be considered \"useful\" (why? read on), which gives 246 or 1014 addresses, which is 214 times larger than the IPv4 address space.
\nCurrently, about half a trillion addresses are allocated, or only 0.73% of the total volume. We are very far from exhausting MAC addresses.<\/p>\n

<\/p>\n

Randomness of bits<\/h3>\n

<\/p>\n

It can be assumed that OUI are distributed randomly, and the vendor then also randomly assigns addresses to individual network devices. Is that so? Let's take a look at the distribution of bits in the MAC address databases for 802.11 devices that I have compiled using authorization systems in wireless networks. WNAM<\/a><\/noindex>. The addresses belong to real devices that connected to Wi-Fi over several years in three countries. In addition, there is a small database of 802.3 wired LAN devices.<\/p>\n

<\/p>\n

We will break down each MAC address (six bytes) from each sample into bits byte by byte and examine the frequency of occurrence of the bit \"1\" in each of the 48 positions. If the bit is set completely randomly, the probability of getting a \"1\" should be 50%.<\/p>\n

<\/p>\n

Wi-Fi Sample No. 1 (Russia)
\nWi-Fi Sample No. 2 (Belarus)
\nWi-Fi Sample No. 3 (Uzbekistan)
\nLAN Sample (Russia)<\/p>\n

Number of records in the database
\n5929000
\n1274000
\n366000
\n1000<\/p>\n

Bit number:
\n% bit «1»
\n% bit «1»
\n% bit «1»
\n% bit «1»<\/p>\n

1
\n48.6%
\n49.2%
\n50.7%
\n28.7%<\/p>\n

2
\n44.8%
\n49.1%
\n47.7%
\n30.7%<\/p>\n

3
\n46.7%
\n48.3%
\n46.8%
\n35.8%<\/p>\n

4
\n48.0%
\n48.6%
\n49.8%
\n37.1%<\/p>\n

5
\n45.7%
\n46.9%
\n47.0%
\n32.3%<\/p>\n

6
\n46.6%
\n46.7%
\n47.8%
\n27.1%<\/p>\n

7
\n0.3%<\/strong>
\n0.3%<\/strong>
\n0.2%<\/strong>
\n0.7%<\/strong><\/p>\n

8
\n0.0%<\/strong>
\n0.0%<\/strong>
\n0.0%<\/strong>
\n0.0%<\/strong><\/p>\n

9
\n48.1%
\n50.6%
\n49.4%
\n38.1%<\/p>\n

10
\n49.1%
\n50.2%
\n47.4%
\n42.7%<\/p>\n

11
\n50.8%
\n50.0%
\n50.6%
\n42.9%<\/p>\n

12
\n49.0%
\n48.4%
\n48.2%
\n53.7%<\/p>\n

13
\n47.6%
\n47.0%
\n46.3%
\n48.5%<\/p>\n

14
\n47.5%
\n47.4%
\n51.7%
\n46.8%<\/p>\n

15
\n48.3%
\n47.5%
\n48.7%
\n46.1%<\/p>\n

16
\n50.6%
\n50.4%
\n51.2%
\n45.3%<\/p>\n

17
\n49.4%
\n50.4%
\n54.3%
\n38.2%<\/p>\n

18
\n49.8%
\n50.5%
\n51.5%
\n51.9%<\/p>\n

19
\n51.6%
\n53.3%
\n53.9%
\n42.6%<\/p>\n

20
\n46.6%
\n46.1%
\n45.5%
\n48.4%<\/p>\n

21
\n51.7%
\n52.9%
\n47.7%
\n48.9%<\/p>\n

22
\n49.2%
\n49.6%
\n41.6%
\n49.8%<\/p>\n

23
\n51.2%
\n50.9%
\n47.0%
\n41.9%<\/p>\n

24
\n49.5%
\n50.2%
\n50.1%
\n47.5%<\/p>\n

25
\n47.1%
\n47.3%
\n47.7%
\n44.2%<\/p>\n

26
\n48.6%
\n48.6%
\n49.2%
\n43.9%<\/p>\n

27
\n49.8%
\n49.0%
\n49.7%
\n48.9%<\/p>\n

28
\n49.3%
\n49.3%
\n49.7%
\n55.1%<\/p>\n

29
\n49.5%
\n49.4%
\n49.8%
\n49.8%<\/p>\n

30
\n49.8%
\n49.8%
\n49.7%
\n52.1%<\/p>\n

31
\n49.5%
\n49.7%
\n49.6%
\n46.6%<\/p>\n

32
\n49.4%
\n49.7%
\n49.5%
\n47.5%<\/p>\n

33
\n49.4%
\n49.8%
\n49.7%
\n48.3%<\/p>\n

34
\n49.7%
\n50.0%
\n49.6%
\n44.9%<\/p>\n

35
\n49.9%
\n50.0%
\n50.0%
\n50.6%<\/p>\n

36
\n49.9%
\n49.9%
\n49.8%
\n49.1%<\/p>\n

37
\n49.8%
\n50.0%
\n49.9%
\n51.4%<\/p>\n

38
\n50.0%
\n50.0%
\n49.8%
\n51.8%<\/p>\n

39
\n49.9%
\n50.0%
\n49.9%
\n55.7%<\/p>\n

40
\n50.0%
\n50.0%
\n50.0%
\n49.5%<\/p>\n

41
\n49.9%
\n50.0%
\n49.9%
\n52.2%<\/p>\n

42
\n50.0%
\n50.0%
\n50.0%
\n53.9%<\/p>\n

43
\n50.1%
\n50.0%
\n50.3%
\n56.1%<\/p>\n

44
\n50.1%
\n50.0%
\n50.1%
\n45.8%<\/p>\n

45
\n50.0%
\n50.0%
\n50.1%
\n50.1%<\/p>\n

46
\n50.0%
\n50.0%
\n50.1%
\n49.5%<\/p>\n

47
\n49.2%
\n49.4%
\n49.7%
\n45.2%<\/p>\n

48
\n49.9%
\n50.1%
\n50.7%
\n54.6%<\/p>\n

<\/p>\n

Where does such unfairness in bits 7 and 8 come from? There are almost always zeros there.<\/p>\n

<\/p>\n

Indeed, the standard defines these bits as special (Wikipedia<\/a><\/noindex>):
\n\"Everything<\/p>\n

<\/p>\n

The eighth (from the beginning) bit of the first byte of the MAC address is called the Unicast\/Multicast bit and determines the type of frame being transmitted from this address, whether it is normal (0) or broadcast (1) (multicast or broadcast). For normal, unicast interactions of the network adapter, this bit is set to '0' in all packets sent to it.<\/p>\n

<\/p>\n

The seventh (from the beginning) bit of the first byte of the MAC address is called the U\/L (Universal\/Local) bit and determines whether the address is globally unique (0) or locally unique (1). By default, all 'factory-fused' addresses are globally unique, so the overwhelming majority of collected MAC addresses have the seventh bit set to '0'. In the table of assigned OUI identifiers, only about 130 entries have the U\/L bit set to '1', and apparently, these are blocks of MAC addresses for special needs.<\/p>\n

<\/p>\n

Bits six through one of the first byte, bits two and three of the OUI identifiers, and especially bits in bytes four to six assigned by the manufacturer are distributed more or less evenly. <\/p>\n

<\/p>\n

Thus, in a real MAC address of a network adapter, the bits are essentially equivalent and do not carry technological meaning, except for two service bits of the most significant byte.<\/p>\n

<\/p>\n

Prevalence<\/h3>\n

<\/p>\n

Interesting, which wireless equipment manufacturers are the most popular? Let's combine the search in the OUI database with the data from Sample No. 1.<\/p>\n

<\/p>\n

Vendor
\nShare of devices, %<\/p>\n

Apple
\n26,09<\/p>\n

Samsung
\n19,79<\/p>\n

Huawei Technologies Co. Ltd
\n7,80<\/p>\n

Xiaomi Communications Co Ltd
\n6,83<\/p>\n

Sony Mobile Communications Inc
\n3,29<\/p>\n

LG Electronics (Mobile Communications)
\n2,76<\/p>\n

ASUSTek COMPUTER INC.
\n2,58<\/p>\n

TCT mobile ltd
\n2,13<\/p>\n

zte corporation
\n2,00<\/p>\n

not found in the IEEE database
\n1,92<\/p>\n

Lenovo Mobile Communication Technology Ltd.
\n1,71<\/p>\n

HTC Corporation
\n1,68<\/p>\n

Murata Manufacturing
\n1,31<\/p>\n

InPro Comm
\n1,26<\/p>\n

Microsoft Corporation
\n1,11<\/p>\n

Shenzhen TINNO Mobile Technology Corp.
\n1,02<\/p>\n

Motorola (Wuhan) Mobility Technologies Communication Co. Ltd.
\n0,93<\/p>\n

Nokia Corporation
\n0,88<\/p>\n

Shanghai Wind Technologies Co. Ltd
\n0,74<\/p>\n

Lenovo Mobile Communication (Wuhan) Company Limited
\n0,71<\/p>\n

<\/p>\n

Practice shows that the wealthier the subscribers of a wireless network in a given location, the higher the share of Apple devices.<\/p>\n

<\/p>\n

Uniqueness<\/h3>\n

<\/p>\n

Are MAC addresses unique? In theory, yes, since every device manufacturer (owner of the MA block) is required to provide a unique address for each of their network adapters produced. However, some chip manufacturers, namely:<\/p>\n

<\/p>\n