In this section, we will discuss the format of the MAC address of an Ethernet frame. Let's take a look at a capture of an Address Resolution Protocol (ARP) message using the Wireshark tool:
As we can see in the preceding screenshot, both the source and destination Ethernet (MAC) addresses are included. The MAC address is a 48-bit (six-byte) address which is hard coded into the NIC of a device. A MAC address consist of hexadecimal values ranging from 0 to 9, and from A to F.
IEEE assigns the first three bytes (24 bits) of the MAC address to a vendor. This part of the address is known as the Organizationally Unique Identifier (OUI). The OUI helps network and security professionals determine the manufacturer of a MAC address.
Remembering the OUI value for each vendor can be a very challenging task; however, there are various OUI databases available online for...