802.3 · LAN

The MAC address the first bit onto the wire

Six octets you have read a thousand times, and almost every course explains them the same wrong way. This plate follows one address bit by bit as it leaves onto the wire — starting with the bit that goes first, and why it is that bit and no other.

Sequence diagram poster of the WPA2 4-way handshake

Requesting scene from the content service…

bit 0

I/G leaves first onto the wire

2014

MA-M/MA-S break 'OUI = vendor'

48 bits

six octets, no guaranteed uniqueness

I/G and U/L bitsOUI + extension identifierbroadcast is a multicastlocally administered (U/L = 1)

What you'll learn

Why the I/G bit is the very first bit of the address to reach the wire: each octet is transmitted least significant bit first, so the receiver learns 'one device or a group?' before the first octet is even over.
Why 'the first three bytes are the vendor' has been false since 2014: with MA-M and MA-S blocks those 24 bits are an OUI belonging to the IEEE, not to the manufacturer.
That the IEEE does not guarantee MAC addresses are unique — a universal address is only intended to be unique, and the registry says so itself.
Why broadcast is not a category next to multicast but one particular multicast address — and why FF-FF-FF-FF-FF-FF is formally 'locally administered'.
Why a whole block of reserved group addresses is not forwarded by a conforming 802.1D bridge, which is the technical reason LLDP stops at the first switch.
How hyphens, colons and dots differ — including the trap that, by clause 8 of IEEE Std 802-2014, the colon form means bit-reversed.

The bit that goes first

A MAC address is 48 bits, but they do not leave the interface all at once, and they do not leave in the order you read them. IEEE 802.3 requires each octet of the address fields to be transmitted least significant bit first — and the least significant bit of the first octet is the I/G bit, the one that says whether the frame is addressed to a single device or to a group. (The preamble and the SFD run ahead of the address; they are not part of the frame.)

Two rules, one consequence. The IEEE states that each octet of the address fields goes out least significant bit first, and that the least significant bit of Octet 0 is the I/G. What follows is that the individual/group distinction is the first thing of the whole address to reach the wire — a receiver can begin deciding whether a frame concerns it after exactly one bit, without waiting for the first octet to finish. The IEEE states both rules; it does not state that the bit was placed there in order to arrive first.

Two things almost everyone gets wrong

The first is the OUI. Since 1 January 2014 the IEEE sells three block sizes: MA-L (24 bits assigned), MA-M (28 bits) and MA-S (36 bits). The familiar 24 + 24 split is the MA-L case only — an MA-M leaves 20 bits to the buyer and an MA-S 12. In MA-M and MA-S the first 24 bits are an OUI assigned to the IEEE itself, shared among many buyers and never reassigned. The IEEE's own canonical example, AC-DE-48-23-45-67, could have come from any of the three — the address alone does not tell you. Looking up 24 bits is no longer an answer; it is the first of three questions.

The second is uniqueness. The IEEE Registration Authority states in a footnote of its own tutorial that it makes a concerted effort to avoid duplicate assignments but does not guarantee that duplicate assignments have not occurred. A universal address is only intended to be unique. And a locally administered address — the kind modern phones invent for themselves — is not globally unique at all: the standard puts that responsibility on the network administrator, within the span of use.

What that means at work

These are not trivia. An inventory that classifies devices by their first three bytes has been producing unreliable categories since 2014. A network that decides who gets in by MAC address is leaning on an identifier the client is free to change — Cisco lists MAC filtering, web-auth using MAC filtering, iPSK, static DHCP binding and Wi-Fi location among the things randomized addresses break. And two addresses written in different notations are not automatically the same address, because by the letter of IEEE Std 802-2014 the colon form means bit-reversed.

The plate plays all of this as a sequence: one frame leaving host A, examined at three magnifications — one bit, two bits, all forty-eight — and delivered; then a group address, the broadcast address and its delivery, a reserved address that a conforming 802.1D bridge does not forward, an address a device made up for itself, and a closing frame that returns to the first bit. Three narration depths, in English and Spanish.

← Previous plate

The Ethernet frame · where it starts and where it stops

Next plate →

Autonegotiation · the duplex mismatch

Atlas index