A networked computer commonly uses both a MAC address and an IP address. They can appear together in the same packet capture, but they serve different layers and different scopes.

An IP address identifies a network-layer endpoint and supports delivery across interconnected networks. A MAC address identifies an interface for frame delivery on the current local link.

For traffic sent to a remote server, the destination IP address identifies that server. The destination MAC address usually identifies a local gateway. Putting the remote server's MAC address in the first Ethernet frame would not help because that address has no delivery meaning on the sender's local network.

Understanding this separation explains why a captured Ethernet frame can contain four addresses, why some addresses change along a path, and why a device can have more than one address of either type.

MAC and IP addresses belong to different protocol headers.

An Ethernet header contains source and destination MAC addresses. The IP packet inside that frame contains source and destination IP addresses.

Each pair answers a different question:

The IP layer can operate over Ethernet, Wi-Fi, point-to-point links, tunnels, and other link technologies. Some of those technologies use 48-bit MAC addresses, while others use different identifiers or no MAC address at all. IP provides a common addressing layer across those differences.

The following comparison uses Ethernet MAC-48 addresses, the form most often displayed on laptops, servers, and packet captures.

These are protocol roles rather than permanent properties of a physical device. A MAC address belongs to a link-layer interface or a virtual interface. An IP address belongs to an IP configuration on an interface. One computer can have several of each.

MAC stands for Media Access Control. Ethernet uses a 48-bit MAC address in each source and destination address field.

A 48-bit value contains six bytes and is normally written as six hexadecimal octets:

Windows tools often use hyphens:

The notation differs, but both strings represent the same 48-bit value.

A MAC address identifies a link-layer interface within the network where the address is in use. A laptop can have one address for its Ethernet interface and another for its wireless interface. Virtual machines, containers, and virtual network adapters can have their own MAC addresses even though they share one physical host.

MAC addresses support frame delivery. They do not identify an application process, contain an IP network prefix, or describe a route to a remote system.

A MAC address can be universally administered or locally administered.

A universally administered address comes from an address block assigned by the IEEE to an organization. A hardware vendor commonly assigns an address from its block to a network interface. This process aims to make the value globally unique.

The address contains an organizational prefix followed by bits managed by that organization. The traditional 24-bit prefix is commonly called an Organizationally Unique Identifier, or OUI. The IEEE also allocates address blocks with other prefix lengths, so every modern allocation does not follow a strict 24-bit vendor plus 24-bit device split.

A locally administered address is selected by software, an administrator, a hypervisor, or another local system. Virtual environments commonly generate such addresses. Operating systems can also randomize MAC addresses to reduce tracking across wireless networks.

The operating system uses the active address regardless of whether hardware stored a different factory-assigned value. A factory value therefore does not make the effective MAC address permanent or trustworthy as a device identity.

The two least significant bits of the first byte describe how a MAC address should be interpreted.

The I/G bit indicates an individual or group address:

The U/L bit indicates who administered the address:

For example, the first byte a4 is binary 10100100. Its two low-order bits are 00, so an address beginning with a4 is an individual, universally administered address.

Changing the first byte to a6 produces binary 10100110. The low-order bits are 10, so the address is still individual but is now locally administered.

The broadcast address sets every bit to one:

It is a group destination for every participant in the local broadcast scope. Ethernet never uses it as a valid source address.

The value in an Ethernet destination field matters only within the Layer 2 network carrying that frame.

A sender connected to an Ethernet network can direct a frame to:

The address does not tell the network how to cross an IP routing boundary. A remote system can use the same MAC value as a local system without creating a conflict, provided the two addresses never appear in the same Layer 2 scope.

Globally administered addresses reduce the chance of duplication, but Ethernet does not perform a global registration check before using an address. Manual configuration, cloning, faulty virtual-machine templates, or vendor mistakes can still create duplicates.

Duplicate MAC addresses within one local Layer 2 network can make frame delivery unstable because network devices cannot maintain one consistent location for the same source. The same duplicate values on isolated networks cause no Layer 2 ambiguity.

An IP address identifies an endpoint at the network layer.

IPv4 addresses are 32 bits and use dotted-decimal notation:

IPv6 addresses are 128 bits and use hexadecimal groups:

An IP address has a hierarchical structure. One part identifies an IP network, and the remaining part identifies an address within that network. Routers can use network prefixes to forward packets without storing a separate entry for every host in the world.

This hierarchy gives IP addresses a relationship to the network where they are assigned. A laptop that moves from an office network to a home network normally receives a different IP configuration because it has entered a different part of the IP topology.

IP addresses can come from automatic configuration, an administrator, an internet provider, or a cloud platform. Some remain fixed for long periods. Others change when a lease expires, an interface reconnects, a workload restarts, or a service moves.

An IP address also belongs to an interface configuration rather than permanently to a physical machine. One interface can hold several IPv4 and IPv6 addresses. A system with multiple interfaces can use different source addresses depending on the selected route.

A flat 48-bit MAC address does not reveal which network currently contains the interface. Forwarding traffic globally by individual MAC addresses would require the network to track enormous numbers of unrelated endpoint locations.

IP prefixes aggregate many endpoint addresses into network ranges. A forwarding device can maintain a route for a prefix instead of a separate route for every address inside that prefix.

The network prefix supplies routing structure. The MAC address supplies local frame-delivery information after the packet reaches an Ethernet link. These separate layers allow IP to cross networks built from different link technologies.

Before creating an Ethernet frame, a host determines whether the destination IP address belongs to a directly reachable network or requires a next hop.

For a local IP destination, the Ethernet destination is the local target's MAC address.

For a remote IP destination, the host sends the first frame to a local next hop, normally its default gateway.

The destination IP remains the remote server's address. Replacing it with the gateway's IP would change the network-layer destination. The Ethernet destination uses the gateway's MAC because the gateway is the next receiver on the current link.

The host obtains the required local mapping from a neighbor cache. If no usable entry exists, it uses a local address-resolution protocol to discover the link-layer address. IPv4 and IPv6 use different resolution protocols, but both solve the same immediate problem: create a local frame for a known next-hop IP address.

The source and destination IP addresses usually describe the communicating endpoints throughout an ordinary routed path. Each Layer 2 network supplies its own frame addresses.

The following example omits address-translation and tunneling systems so the layer boundary remains clear.

On the first Ethernet network:

On the final Ethernet network:

The intermediate network might use Ethernet, another link-layer format, or a tunnel. The endpoint IP packet does not require Ethernet at every step.

When the server responds, it creates a new packet in the reverse direction. The server's IP becomes the source, the client's IP becomes the destination, and every Ethernet link selects source and destination MAC addresses appropriate to that direction.

A diagram often pairs one MAC address with one IP address for clarity. Deployed systems can have more complex relationships.

One MAC address can be associated with several IP addresses. An interface can have multiple IPv4 addresses, multiple IPv6 addresses, or both protocol versions active at once.

One device can have several MAC addresses. Ethernet, Wi-Fi, virtual adapters, containers, and virtual machines can each contribute interfaces.

One IP address can move between interfaces or systems. High-availability services and virtual networking platforms can move an address while preserving service reachability.

One MAC address can change over time. Administrators can override it, virtualization software can generate it, and privacy features can randomize it.

A local IP-to-MAC mapping can expire. Neighbor state reflects current local reachability. It is a cache entry, not a permanent global directory.

The relationship therefore depends on an interface, a local network, and a point in time. Learning a MAC address for an IP address on one network says nothing about the MAC used for that IP from another network.

Saying "the computer's IP" or "the server's MAC" is convenient when a system has one interface and one address. The protocol configuration belongs to interfaces.

Consider a backend server with:

The server can have a separate MAC address on each Ethernet-like interface and several IP addresses across those interfaces. When it opens a connection, the operating system selects an outgoing interface and a source IP address that fit the route.

The MAC source comes from the link-layer interface used for that transmission. A connection sent through another interface can therefore use a different source IP, a different source MAC, or both.

Cloud platforms preserve the same logical model even when software implements much of the network. A virtual machine sees virtual interfaces with MAC and IP addresses. The platform can enforce or translate those values beneath the guest, but applications still use IP endpoints and the guest network stack still prepares link-layer traffic.

MAC and IP addresses change for different reasons.

A MAC address can originate from:

An IP address can originate from:

The origin does not determine how long the address remains active. A statically configured IP can remain stable, while an automatically assigned address can remain the same across many renewals. A hardware interface can keep its factory MAC for years, while software can replace the active value at any time.

IPv6 deserves one caution. Some IPv6 interface identifiers were historically derived from a 48-bit MAC address using a modified EUI-64 procedure. Modern systems commonly use privacy or stable-random identifiers instead. An IPv6 address therefore does not provide a dependable way to infer the interface's MAC address.

Linux can display link-layer and IP configuration with:

In ip link show, a line beginning with link/ether contains the interface's active Ethernet MAC address:

In ip address show, lines beginning with inet and inet6 contain IPv4 and IPv6 addresses:

On macOS, ifconfig displays both kinds of addresses:

The ether line contains the MAC address, while inet and inet6 lines contain IP addresses.

These commands can report several interfaces. Loopback, physical, VPN, bridge, and virtual interfaces represent different communication paths, so the interface name matters as much as the displayed value.

The operating system maintains a neighbor cache that associates local next-hop IP addresses with link-layer addresses.

Linux exposes it with:

An entry can resemble:

The fields identify:

The entry applies through eth0 on the current local network. It does not claim that the same IP address uses that MAC on every network.

macOS can display IPv4 neighbor mappings with:

The cache may not contain an entry until the host has attempted local communication with that address. Entries can also expire or change as local conditions change.

The -e option makes tcpdump print the link-layer header. The following command captures IPv4 and IPv6 traffic:

Replace en0 with the active interface. A line for an outbound connection can resemble:

Read the line from the outside inward:

If 203.0.113.20 is remote, 00:11:22:33:44:55 should represent a local next hop rather than that server. A capture near the server would show different Ethernet addresses around a packet with the same endpoint IP addresses, assuming no address translation changed them.

Packet analyzers can filter the layers independently. In Wireshark:

An Ethernet filter selects frames containing a MAC address. An IP filter selects packets containing an IP address. Their results differ because each address has a different scope.

MAC and IP addresses provide delivery metadata. Neither proves the identity of a person, device, or application.

Software can change a MAC address. A duplicated or forged source MAC can still form a syntactically valid Ethernet frame.

Software can also construct a packet with a forged source IP address. Whether replies return to the sender and whether the network permits the packet are separate questions. Proxies, shared gateways, and other intermediaries can also cause a service to observe an address different from the original client's address.

Security systems may use addresses as one input, especially for local policy or rate limiting, but address checks alone provide weak authentication. Cryptographic credentials and application-level authorization bind requests to identities more reliably.

A MAC address can change. Hardware often supplies a factory value, while software controls the address active on the interface.

An IP address can remain stable. Administrators and platforms can reserve or statically configure IP addresses for long-lived services.

A remote server's MAC address is not needed on the client's LAN. The client needs the MAC address of its local next hop for the first frame.

A device can have several addresses. Multiple physical and virtual interfaces, multiple IP versions, and multiple IP assignments create one-to-many relationships.

Globally unique does not mean globally routed. A universally administered MAC address aims to avoid duplication, but Ethernet still uses it within local Layer 2 scope.

An address is not an authenticated identity. Both MAC and IP source values can differ from the physical device or user responsible for the traffic.

MAC addresses identify interfaces for frame delivery within a local Layer 2 network, while IP addresses identify network-layer endpoints and support routing across IP networks. An Ethernet frame carries MAC addresses around an IP packet that carries its own source and destination IP addresses.

Local traffic uses the target interface's MAC address; remote traffic uses the next hop's MAC address. The IP endpoint addresses usually remain stable along a routed path, but each Layer 2 network supplies new frame addresses. Neighbor mappings between the two are local and temporary.

MAC addresses may be universally or locally administered, replaced, or randomized. Interfaces may have multiple IP addresses, and systems may have multiple MAC addresses across physical and virtual interfaces. Neither address type proves identity.

Separating local frame addressing from network-layer addressing allows one IP packet to cross many different links.