MAC Address: Universally or Locally Administered Bit and Individual/Group Bit

This post is going to be about a topic I have breezed over in the past when reading about MAC addresses but decided to do a little more research on. There are two bits in the first octet of a MAC address that are used to define certain aspects of the MAC address. The least significant bit of the first octet of the MAC address is the Individual/Group(I/G) address bit and the next to least significant bit of the first octet of the MAC address is the Universally or Locally(U/L) administered address bit.

The Individual/Group address bit is used to signify if the destination MAC address is a unicast or a multicast/broadcast Layer 2 address. If the bit is set to 0 then it is an Individual MAC address and is a unicast address. If the bit is set to 1 then it is a Group address and is a multicast/broadcast address. I have not verified this but the logic is reasonable that if a MAC address is unicast then the first octet will never be an odd number when in decimal format.

The Universally Administered or Locally Administered address bit is used to tell if the MAC address is the burned-in-address(BIA) or a MAC address that has been changed locally. Maybe this bit served a purpose in the past but with modern applications on Windows or *nix systems you can change the MAC address to almost anything and this bit does not have to be set to tell the system that you are no longer using the manufacturer’s BIA. If the bit is set to 0 then the MAC address is recognized as a BIA MAC address. When the bit is set to 1 then the MAC address is recognized as being changed from the BIA to a unique MAC address that is locally setup.

Some Wireshark packet captures showing the above mentioned items:

Unicast and BIA

Multicast and BIA

Broadcast and Locally Administered

8 responses to “MAC Address: Universally or Locally Administered Bit and Individual/Group Bit

  • Keith Miller

    Nice blog post… I never knew this about MAC addresses but this is very interesting. Especially having the ability of knowing right off whether the MAC address is unicast or multicast/broadcast. A few things though:

    You could assume that every other mac address is going to be even because the last bit (1) is the only odd number. No need for verifcation 🙂

    Also, the screenshot that you labeled “Broadcast and BIA” looks like broadcast and locally administered to me.


    • wirerat

      Thank you.

      For the odd number, it was late and I was thinking that was they way it was but did not feel liking completely thinking it out.

      The screenshot descriptions are underneath each individual image so the Broadcast and BIA description is for the image above it. It is a little confusing and I’ll figure a better way out to align the descriptions for the images.

  • Keith Miller

    I can understand that… I’m worthless when I’m tired.

    I realize that the screenshot descriptions are underneath the images, but look at the image above “Broadcast and BIA”. The U/L bit is “1”. 🙂


  • Keith Miller

    No problem. Again, nice post. I’ve subscribed and will be expecting to see more like this. By the way, my handle is “swagger” from NF. 🙂


  • Leon

    I seems to be stupid, but I cannot catch what is the clue with these “local administered” addresses! What will happen if the address is duplicated and marked as local? And why one will change his universal address to local? What advantages are there in local?
    Many thanks if somebody can explain this.

  • addertooth

    Why change the MAC? The reasons are many. One, to affect the hashing calculation for an endpoint. This way traffic from a specific server will make use of the most underutilized fiber in an LACP pairing. Two, to build a schema of MAC addresses which allows you to rapidy find and isolate traffic at the MAC layer; this can make fault isolation easier. It also helps with inventory tracking where the end user may find a way (or has the genuine need) to adjust IP address periodically. With a simplified MAC schema, ACLs are easier to manage. Three, as part of a process to trick a frame recipient into thinking it is talking to a specific manufacturer’s device. ETC.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: