Ethernet, MAC Addressing, and Layer 2

#Ethernet, MAC Addressing, and Layer 2#link

Now that you understand IP addressing at Layer 3, we drop down to Layer 2 — the Data Link layer — where Ethernet and MAC addresses operate. This is the layer that governs how devices communicate on the same local network segment, and it is one of the most fertile grounds for offensive attacks like ARP spoofing, MAC flooding, and VLAN hopping.

MAC Addresses — The Hardware Identity

A MAC (Media Access Control) address is a 48-bit (6-byte) hardware identifier assigned to every network interface. It is typically written in hexadecimal, separated by colons or hyphens (e.g., 00:1A:2B:3C:4D:5E). The first 3 bytes are the Organizationally Unique Identifier (OUI), which identifies the manufacturer. The last 3 bytes are device-specific.

Ethernet Frames

At Layer 2, data is encapsulated into Ethernet frames. Each frame contains a source MAC address, a destination MAC address, an EtherType field (indicating the payload protocol, e.g., 0x0800 for IPv4), the payload itself, and a Frame Check Sequence (FCS) for error detection.

Ethernet Frame Structure:
┌──────────────┬──────────────┬──────────┬─────────┬─────┐
│ Dest MAC (6B)│ Src MAC (6B) │ Type (2B)│ Payload │ FCS │
│ ff:ff:ff:ff  │ 00:1a:2b:3c  │ 0x0800   │ 46-1500B│ 4B  │
└──────────────┴──────────────┴──────────┴─────────┴─────┘

Broadcast frame: ff:ff:ff:ff:ff:ff (all devices on segment)

How Switches Work — And How to Abuse Them

Network switches operate at Layer 2 and maintain a MAC address table (also called a CAM table) that maps MAC addresses to physical ports. When a frame arrives, the switch looks up the destination MAC and forwards the frame only to the appropriate port. This is more efficient than hubs, which broadcast to every port.

However, switches have a critical weakness: if you flood the CAM table with fake MAC addresses, the switch enters a 'fail-open' state and starts broadcasting all traffic to all ports — essentially turning into a hub. This is called MAC flooding, and it allows an attacker to sniff all traffic on the segment.

MAC Address Spoofing

MAC addresses can be changed in software — a technique called MAC spoofing. Attackers use this to bypass MAC-based access controls, impersonate other devices, or evade detection. On Linux, this is trivially easy:

Layer 2 Attack Surface Summary