Overview of MAC address Principle and Application

Everyone knows that in real life, each of us has our own ID number-ID card number. You can go to the police station to change your name, however, your ID card number cannot be changed as your name changes. In the online world, we often hear the concept of IP addresses. However, MAC addresses are rarely mentioned. We often only know IP addresses, while MAC addresses are the heroes behind the scenes. In our daily communication, we often call others' names instead of their ID card numbers.

　　IP address and MAC address

In daily computer usage, we all know that you can change the IP address as long as the IP address is properly planned. The modification method is also relatively simple. You only need to double-click the TCP/IP protocol of the corresponding Nic and modify the parameters. So what are the similarities and differences between MAC addresses and IP addresses? Let's take a look at the differences and similarities to better understand them. In the OSI (Open System Interconnection) layer-7 Network Protocol Reference Model (1), the second layer is the Data Link ). A mac address is also called a physical address, hardware address, or link address. It is written into the hardware when produced by a network device manufacturer. Both the IP address and MAC address are in binary format on the computer. The IP address is 32 bits, while the MAC address is 48 bits. The MAC address is 48 characters long (6 bytes). It is usually expressed as 12 hexadecimal numbers. Each two hexadecimal numbers are separated by colons, for example: 08: 00: 20: 0A: 8C: 6D is a MAC address. The first six hexadecimal digits 08:00:20 represent the number of the network hardware manufacturer) distribution, and the last three hexadecimal numbers 0A: 8C: 6D represent the serial number of a network product (such as a NIC) manufactured by the manufacturer. As long as you do not change your MAC address, your MAC address is the only one in the world.

　　MAC address

The IP address is like a job, while the MAC address is like a talent to apply for this job. The job can either let Jia sit or let Yi sit, in the same sense, the IP address of a node is not required for the NIC. Basically, it can be used by any manufacturer. That is to say, there is no binding relationship between the IP address and the MAC address. In itself, some computers are more mobile, just as talents can work for different units, the mobility of talents is relatively strong. The relationship between positions and talents is like the relationship between IP addresses and MAC addresses. For example, if a network card breaks down, it can be replaced without getting a new IP address. If an IP host is moved from one network to another, you can give it a new IP address instead of a new Nic. Of course, in addition to this function, the MAC address is not enough. We can use the analogy between human society and network. Through the analogy, we can find the similarities, better understand the role of MAC addresses. Communication between computers in the LAN or Wide Area Network eventually means that data packets are transmitted from one node to another from the initial node on a certain form of link, finally transmitted to the target node. ARP (Address Resolution Protocol: Address Resolution Protocol) is responsible for ing IP addresses to MAC addresses. In fact, the human society and the network are similar. In the interpersonal relationship network, if a wants to send a message to ding, it will pass through B and C, and finally Party B will send a message to ding. In the network, this message is like a packet in a network. Data packets are constantly asked about the MAC address of neighboring nodes during transmission. This process is like a message transmission process in human society. We believe that through these two examples, we can further understand the role of the MAC address.

　　Commands and software related to MAC addresses

In human social networking, we often only know a person's name, while ID card numbers are ignored in general interpersonal relationships. In the same network, we often only know the IP addresses of colleagues or netizens, and do not care about the MAC addresses of other users. To become a network expert, we can use some methods to understand the MAC address of the other party. Here we will introduce two common methods, which can be obtained by WinIPcfg in Windows 9x and by IPconfig-all in Windows 2000/XP (2 ).

You can only obtain a single MAC address using the command, and it is also very troublesome to use it. For network administrators, we hope to have a simple software. We can use the "MAC scanner" to remotely obtain MAC addresses in batches. It is a network management software used to obtain the physical addresses of Remote Computer NICs in batches. The software runs on a machine in the network (both LAN and Internet) to monitor the connection of the entire network, detects the IP address, MAC address, host name, and user name of each user in real time and records them for query (3). You can add remarks on your own and perform cross-network segment scanning, it can be compared with the IP address and MAC address in the database. If an IP address is modified or a fake mac address is used, an alarm is triggered.

Figure 1 OSI Network Protocol Reference Model



Figure 2 view the physical address of the local Nic in Windows 2000/XP

Figure 3 the MAC scanner can obtain the physical addresses of computer NICs in batches Change MAC address

Generally, the MAC address is fixed in the NIC, and some network experts may find a way to modify their MAC address. There are two ways to modify your MAC address: one is hardware modification and the other is software modification. The hardware method is to directly operate the NIC, modify the MAC address saved in the EPROM of the NIC, and change the address in the memory through the modification program provided by the NIC manufacturer. So what is EPROM? EPROM is a storage term used in electronics. It is erasable. That is to say, you can use a pen to write a piece of white paper, and then you cannot use an eraser, the EPROM can be erased after being written in a pencil, and the data storage can be changed repeatedly. Of course, the software modification method is much simpler. In Windows, the MAC of the NIC is saved in the registry, and the actual use is also extracted from the registry, therefore, you only need to modify the Registry to change the MAC. Modify in Windows 9x: Open the Registry Editor and go to HKEY_LOCAL_MACHINESYSTEMCurrentControlSet.
0002, in ServiceClassNet.

Modify in Windows 2000/XP: also open the Registry Editor, HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControl
DriverDesc in Class4D36E970-E325-11CE-BFC1-08002BE10318, 0002, 0000, if found in 0000, add a string variable under 000102030405 named "NetworkAddress" with a value for the MAC address to be set, for example:

After completing the preceding operations, restart the instance. Generally, the source MAC address of the packet sent by the network adapter is not written by the network adapter, but provided by the application. In general implementation, the application obtains the MAC address from the network adapter first, this MAC is used as the source MAC for each sending, And the MAC address in the registry is read from the NIC during Windows installation. As long as your operating system is not reinstalled, it should not be a problem.

MAC address application

The ID card does not play a very important role on weekdays, but at some critical moments, the ID card is used to prove your identity. For example, if you want to withdraw cash from a bank, you need to use your ID card. Then, binding a MAC address to an IP address is just like carrying your ID card in our daily life to do important things. Sometimes, in order to prevent IP addresses from being stolen, we can bind them through a simple switch port (the MAC table of the port uses static table items ), you can prevent MAC address tampering when each vswitch port is connected to only one host. For a layer-3 device, you can also bind the port, IP address, and mac of the vswitch, prevents mac ip address theft. Generally, the bound MAC address is configured on the vswitch and vro, and can only be accessed by network administrators. Generally, computer users only need to understand the binding function. For example, if you change your laptop to another dormitory on the campus network, you cannot access the Internet. This is caused by the binding of the MAC address and IP address (port.