精华内容
下载资源
问答
  • MAC地址格式详解

    2020-06-22 10:08:18
    MAC地址格式详解 以太网编址 在数据链路层,数据帧通常依赖于MAC地址来进行数据交换,它如同公网IP地址一样要求具有全球唯一性,这样才可以识别每一台主机。那么MAC地址如何做到这点?它的格式又是什么? MAC地址...

    MAC地址格式详解

    以太网编址

    在数据链路层,数据帧通常依赖于MAC地址来进行数据交换,它如同公网IP地址一样要求具有全球唯一性,这样才可以识别每一台主机。那么MAC地址如何做到这点?它的格式又是什么?

    MAC地址,英文全称Medium Access Control,直译为介质访问控制,它通常被固化在每个以太网网卡(NIC,Network Interface Card)。MAC(硬件)地址长48位(6字节),采用十六进制格式,下图说明了48位的MAC地址及其组成部分。

            wKiom1b_iH_wIfYLAAANgxjVt2Y068.png 

                 示例: 00-01-6C-06-A6-29 或 00:01:6C:06:A6:29

    组织唯一标识符(OUI)由IEEE(电气和电子工程师协会)分配给厂商,它包含24位。厂商再用剩下的24位(EUI,扩展唯一标识符)为其生产的每个网卡分配一个全球唯一的全局管理地址,一般来说大厂商都会购买多个OUI。

    I/G(Individual/Group)位,如果I/G=0,则是某台设备的MAC地址,即单播地址;如果I/G=1,则是多播地址(组播+广播=多播)。

    G/L(Global/Local,也称为U/L位,其中U表示Universal)位,如果G/L=0,则是全局管理地址,由IEEE分配;如果G/L=1,则是本地管理地址,是网络管理员为了加强自己对网络管理而指定的地址。

     

    对于I/GG/L位的位置,目前有两种说法,或者说两种格式。

    对于数据传输来说,数据是按每个字节中一位一位地传输的,一个字节传输完了才到下一个字节。

      wKioL1b_iYuj3-3vAAC3uAdUEoY206.png

     

    第一种,每个字节的高位在前,低位在后,I/GG/L分别在字节中的最低位和次低位,最高位先发送,到了对端还是最高位

    第二种,每个字节的低位在前,高位在后,I/G位和G/L分别在字节中的最低位和次低位,最低位先发送,到了对端还是最低位

    两种看似不一样,但是结果还是一样的,如果还是弄不懂可以再草稿纸上画一画,不难理解。

    展开全文
  • 3.1 实验目的 1了解MAC帧首部的格式 2理解MAC帧固定部分的各字段含义 3根据MAC帧的内容确定是单播广播 3.2 实验设备 WinpcapWireshark等软件工具 3.3 相关背景 1据包捕获的原理为了进行数据包,网卡必须被设置为混杂...
  • mac地址格式

    2017-03-02 11:29:04
    为了能使某网卡发出的帧被正确的网卡接收并处理,IEEE规定:每块网卡都有一个唯一的以太网地址----MAC地址(IEEE之所以将其称为MAC地址,是因为编址细节是由诸如802.3等MAC协议定义的)。MAC地址有48位(6字节),...

    (转载)http://blog.chinaunix.net/uid-20788636-id-2892320.html

    为了能使某网卡发出的帧被正确的网卡接收并处理,IEEE规定:每块网卡都有一个唯一的以太网地址----MAC地址(IEEE之所以将其称为MAC地址,是因为编址细节是由诸如802.3等MAC协议定义的)。MAC地址有48位(6字节),通常用十六进制来表示,如0000.0c12.3456是一个合法的以太网地址。

    为确保MAC地址的唯一性,以太网卡制造商将MAC地址固化到网卡中。地址的前半部分(24位)标识网卡的制造商,由IEEE分配,称为OUI(组织唯一标识符);地址的后半部分由网卡制造商为其网卡分配一个唯一的编号。
    用于标识某一块网卡的地址叫做“单播地址”(Unicast),该地址又叫做BIA(Burned-in Address)、UAA(Universally administered address)。无论使用BIA还是其它名称,很多人都将单播地址称为LAN地址、以太网地址或MAC地址。
    “组地址”(group address)用于标识多个以太网卡,IEEE定义了两类以太网组地址:
    ● 广播地址(broadcast):标识LAN内所有的设备,值为FF-FF-FF-FF-FF-FF(即全为1时表示是广播地址);
    ● 组播地址(multicast):标识LAN中的部分设备。有些应用程序需要同多台设备通信,通过发送一个组播帧,所有想接收该应用程序发送的数据的设备都可以对这个帧进行处理,而其它的设备则忽略它。组播MAC地址的形式为:01-00-5e-xx-xx-xx,其中X可为任意值。组播地址似乎有复杂的规定,留着以后解决。。。。。如下图所示,6个字节的MAC地被分成两段,各三个字节,前面三个字节用来标识生产厂商(OUI-Organistionally Unique Identifier),后三个字节则用来标识这个厂商的不同的网络设备,这后三个字节的内容则由生产厂商按照自己的喜好来安排了,所以大的生产厂商就会去申请很多个OUI。

    而这个6个字节中的最高有效字节中的最低有效位(b1)用来标识 unicast,和mulcast,即单播 和多播

    而次最低有效位(b2)则用来标识 universally administered address

    locally administered address

    其中:universally administered address 是指烧录在固件中由厂商指定的地址,也也即大家通常所理解的MAC地址,

    locally administered address 则是指由网络管理员为了加强自己对网络管理而指定的地址,由定义可知, locally administered address的U/L位要设置成1.所以 要表示 locally administered address的话,那
    MAC 地址的第一个字节应该是
    0x02, 因此不能够把MAC地址改成其它已经被厂商占用的 universally administered address了。但是通常情况下,很多人都不会遵守上面的约定。因为
    MAC地址通常只能在局域网里发挥作用,因为在网络上传输,MAC地址是会被不断的替换掉的。所以即使你用了
    已经被厂商占用的 universally administered address也不用担心会产生冲突。

    说到着就更清楚了吧。说到底, locally administered address 和 universally administered address的区别在于是直接由生产的时候确定的还是由你自己修改过的。而它们两者理论是U/L位来区别的,但是在实际应用中,却没有人管这些。所以

    locally administered address 的范围是:

     

    1: 0000 0000 0001 - FFFF FFFF FFFD

     2:在1中定义的,还不要用第一个字节中的最低有效位为1的地址,因为它们是多播的

     3:同时还不要用全是0的和全是1的


    http://www.intel.com/support/network/adapter/pro100/sb/CS-029402.htm#laa


     


    http://www.synapse.de/ban/HTML/P_LAYER2/Eng/P_lay207.html


    U/L = 1

    Locally administered address: the adapter uses a logical address (assigned by network administrator). U/L=1 may result in a hex code of 0x02 in the first byte. The U/L bit is always set when a logical address is assigned (even if the assigned address doesn't follow this convention). Therefore, it is impossible to imitate a burned-in address; but other logical address may be imitated at any time.


    而且一旦 locally administered address地址由网管设定,它就会取代(overridding) universally administered address地址代发挥作用了。

    至于为什么要设定 locally administered address 地址,则不清楚,留着以后再查。

     

    Locally administered address主要有以下作用:

      http://www.irongeek.com/i.php?page=security/changemac


    1. To get past MAC address filtering on a router. Valid MAC addresses can be found by sniffing them and then the deviant user could assume the MAC of a valid host. Having two hosts on the same network can cause some network stability problems, but much of the time it's workable. This is one of the reasons why MIC Address filtering on a wireless router is pointless. An attacker can just sniff the MAC address out of the air while in monitor mode and set his WiFi NIC to use it. Interestingly, a lot of hotels use MAC filtering in their "pay to surf" schemes, so this method can be an instant in for cheap skate road warriors. 
    2. Sniffing other connections on the network. By assuming another host's MAC as their own they may receive packets not meant for them. However, ARP poisoning is generally a better method than MAC spoofing to accomplish this task.
    3. So as to keep their burned in MAC address out of IDS and security logs, thus keeping deviant behavior from being connected to their hardware. For example, two of the main things a DHCP server logs when it leases an IP to a client is the MAC address and host name. If you have a wireless router look around on it's web interface for where it logs this info. Luckily there are tools to randomize this information (MadMACs ).
    4. To pull off a denial of service attack, for instance assuming the MAC of the gateway to a sub net might cause traffic problems. Also, a lot of WiFi routers will lock up if a client tries to connect with the same MAC as the router's BSSID.

    对于 l ocally administered address地址,有些交换机和网桥不会转发包含了这样地址的帧。

    而单播和多播就不多说了。
    Address details
    在上图中,我们可以看到U/L位和  G/I 位并不是在我们平时看到的样式的最高位和次高位,比如说 01-00-5e-xx-xx-xx(0000 0001-00-5e-xx-xx-xx)G/I位是1而不是0。之所以这样子设计,是因为我们的电脑发送数据是按位发送的(面向位数的,它要一位一位的接受数据),并且我们的大多PC机采用的是小端(Small-edian),因此要想让电脑先能接受到一个帧的G/I位和 U/L位,那就要把这两个位放到最高字节的最低有效位。这时就可以把它们轻松发出去了。


    The original IEEE 802 MAC address comes from the original Xerox Ethernet addressing scheme.[1] This 48-bit address space contains potentially 248 or 281,474,976,710,656 possible MAC addresses.

    All three numbering systems use the same format and differ only in the length of the identifier. Addresses can either be "universally administered addresses" or "locally administered addresses".

    A universally administered address is uniquely assigned to a device by its manufacturer; these are sometimes called "burned-in addresses" (BIA). The first three octets (in transmission order) identify the organization that issued the identifier and are known as the Organizationally Unique Identifier (OUI).[2] The following three (MAC-48 and EUI-48) or five (EUI-64) octets are assigned by that organization in nearly any manner they please, subject to the constraint of uniqueness. The IEEE expects the MAC-48 space to be exhausted no sooner than the year 2100;[3] EUI-64s are not expected to run out in the foreseeable future.

    A locally administered address is assigned to a device by a network administrator, overriding the burned-in address. Locally administered addresses do not contain OUIs.

    Universally administered and locally administered addresses are distinguished by setting the second least significant bit of the most significant byte of the address. If the bit is 0, the address is universally administered. If it is 1, the address is locally administered. In the example address 06-00-00-00-00-01 the most significant byte is 06 (hex), the binary form of which is 00000110, where the second least significant bit is 1. Therefore, it is a locally administered address.[4] Consequently, this bit is 0 in all OUIs.

    If the least significant bit of the most significant octet of an address is set to 0 (zero), the frame is meant to reach only one receiving NIC .[citation needed ] This type of transmission is called unicast . A unicast frame is transmitted to all nodes within the collision domain , which typically ends at the nearest network switch or router . Only the node with the matching hardware MAC address will accept the frame; network frames with non-matching MAC-addresses are ignored, unless the device is in promiscuous mode .[citation needed ]

    If the least significant bit of the most significant address octet is set to 1, the packet will still be sent only once; however, NICs will choose to accept it based on different criteria than a matching MAC address: for example, based on a configurable list of accepted multicast MAC addresses. This is called multicast addressing.

    展开全文
  • MAC 地址格式

    万次阅读 2015-04-13 14:17:08
    原帖:不详 ... 为了能使某网卡发出的帧被正确的网卡接收并处理,IEEE规定:每块网卡都有一个唯一的以太网地址----MAC地址(IEEE之所以将其称为MAC地址,是因为编址细节是由诸如802.3等MAC协议定义的

    原帖:不详

    参考

    http://en.wikipedia.org/wiki/MAC_address

    http://baike.baidu.com/view/69334.htm


      为了能使某网卡发出的帧被正确的网卡接收并处理,IEEE规定:每块网卡都有一个唯一的以太网地址----MAC地址(IEEE之所以将其称为MAC地址,是因为编址细节是由诸如802.3等MAC协议定义的)。MAC地址有48位(6字节),通常用十六进制来表示,如0000.0c12.3456是一个合法的以太网地址。

    为确保MAC地址的唯一性,以太网卡制造商将MAC地址固化到网卡中。地址的前半部分(24位)标识网卡的制造商,由IEEE分配,称为OUI(组织唯一标识符);地址的后半部分由网卡制造商为其网卡分配一个唯一的编号。
    用于标识某一块网卡的地址叫做“单播地址”(Unicast),该地址又叫做BIA(Burned-in Address)、UAA(Universally administered address)。无论使用BIA还是其它名称,很多人都将单播地址称为LAN地址、以太网地址或MAC地址。
    “组地址”(group address)用于标识多个以太网卡,IEEE定义了两类以太网组地址:
    ● 广播地址(broadcast):标识LAN内所有的设备,值为FF-FF-FF-FF-FF-FF(即全为1时表示是广播地址);
    ● 组播地址(multicast):标识LAN中的部分设备。有些应用程序需要同多台设备通信,通过发送一个组播帧,所有想接收该应用程序发送的数据的设备都可以对这个帧进行处理,而其它的设备则忽略它。组播MAC地址的形式为:01-00-5e-xx-xx-xx,其中X可为任意值。组播地址似乎有复杂的规定,留着以后解决。。。。。如下图所示,6个字节的MAC地被分成两段,各三个字节,前面三个字节用来标识生产厂商(OUI-Organistionally Unique Identifier),后三个字节则用来标识这个厂商的不同的网络设备,这后三个字节的内容则由生产厂商按照自己的喜好来安排了,所以大的生产厂商就会去申请很多个OUI。

    而这个6个字节中的最高有效字节中的最低有效位(b1)用来标识 unicast,和mulcast,即单播 和多播

    而次最低有效位(b2)则用来标识 universally administered address 

    locally administered address

    其中:universally administered address 是指烧录在固件中由厂商指定的地址,也也即大家通常所理解的MAC地址,

     locally administered address 则是指由网络管理员为了加强自己对网络管理而指定的地址,由定义可知, locally administered address的U/L位要设置成1.所以 要表示 locally administered address的话,那
    MAC 地址的第一个字节应该是
     
    0x02, 因此不能够把MAC地址改成其它已经被厂商占用的 universally administered address了。但是通常情况下,很多人都不会遵守上面的约定。因为
    MAC地址通常只能在局域网里发挥作用,因为在网络上传输,MAC地址是会被不断的替换掉的。所以即使你用了
     
    已经被厂商占用的 universally administered address也不用担心会产生冲突。

    说到着就更清楚了吧。说到底, locally administered address 和 universally administered address的区别在于是直接由生产的时候确定的还是由你自己修改过的。而它们两者理论是U/L位来区别的,但是在实际应用中,却没有人管这些。所以

    locally administered address 的范围是:

     

    1: 0000 0000 0001 - FFFF FFFF FFFD

     2:在1中定义的,还不要用第一个字节中的最低有效位为1的地址,因为它们是多播的

     3:同时还不要用全是0的和全是1的


    http://www.intel.com/support/network/adapter/pro100/sb/CS-029402.htm#laa 


     


    http://www.synapse.de/ban/HTML/P_LAYER2/Eng/P_lay207.html


    U/L = 1

    Locally administered address: the adapter uses a logical address (assigned by network administrator). U/L=1 may result in a hex code of 0x02 in the first byte. The U/L bit is always set when a logical address is assigned (even if the assigned address doesn't follow this convention). Therefore, it is impossible to imitate a burned-in address; but other logical address may be imitated at any time.


    而且一旦 locally administered address地址由网管设定,它就会取代(overridding) universally administered address地址代发挥作用了。

    至于为什么要设定 locally administered address 地址,则不清楚,留着以后再查。

     

    Locally administered address主要有以下作用:

      http://www.irongeek.com/i.php?page=security/changemac


    1. To get past MAC address filtering on a router. Valid MAC addresses can be found by sniffing them and then the deviant user could assume the MAC of a valid host. Having two hosts on the same network can cause some network stability problems, but much of the time it's workable. This is one of the reasons why MIC Address filtering on a wireless router is pointless. An attacker can just sniff the MAC address out of the air while in monitor mode and set his WiFi NIC to use it. Interestingly, a lot of hotels use MAC filtering in their "pay to surf" schemes, so this method can be an instant in for cheap skate road warriors. 
    2. Sniffing other connections on the network. By assuming another host's MAC as their own they may receive packets not meant for them. However, ARP poisoning is generally a better method than MAC spoofing to accomplish this task.
    3. So as to keep their burned in MAC address out of IDS and security logs, thus keeping deviant behavior from being connected to their hardware. For example, two of the main things a DHCP server logs when it leases an IP to a client is the MAC address and host name. If you have a wireless router look around on it's web interface for where it logs this info. Luckily there are tools to randomize this information (MadMACs ).
    4. To pull off a denial of service attack, for instance assuming the MAC of the gateway to a sub net might cause traffic problems. Also, a lot of WiFi routers will lock up if a client tries to connect with the same MAC as the router's BSSID.

    对于 l ocally administered address地址,有些交换机和网桥不会转发包含了这样地址的帧。

    而单播和多播就不多说了。
    Address details
    在上图中,我们可以看到U/L位和  G/I 位并不是在我们平时看到的样式的最高位和次高位,比如说 01-00-5e-xx-xx-xx(0000 0001-00-5e-xx-xx-xx)G/I位是1而不是0。之所以这样子设计,是因为我们的电脑发送数据是按位发送的(面向位数的,它要一位一位的接受数据),并且我们的大多PC机采用的是小端(Small-edian),因此要想让电脑先能接受到一个帧的G/I位和 U/L位,那就要把这两个位放到最高字节的最低有效位。这时就可以把它们轻松发出去了。


    The original IEEE 802 MAC address comes from the original Xerox Ethernet addressing scheme.[1] This 48-bit address space contains potentially 248 or 281,474,976,710,656 possible MAC addresses.

    All three numbering systems use the same format and differ only in the length of the identifier. Addresses can either be "universally administered addresses" or "locally administered addresses".

    A universally administered address is uniquely assigned to a device by its manufacturer; these are sometimes called "burned-in addresses" (BIA). The first three octets (in transmission order) identify the organization that issued the identifier and are known as the Organizationally Unique Identifier (OUI).[2] The following three (MAC-48 and EUI-48) or five (EUI-64) octets are assigned by that organization in nearly any manner they please, subject to the constraint of uniqueness. The IEEE expects the MAC-48 space to be exhausted no sooner than the year 2100;[3] EUI-64s are not expected to run out in the foreseeable future.

    A locally administered address is assigned to a device by a network administrator, overriding the burned-in address. Locally administered addresses do not contain OUIs.

    Universally administered and locally administered addresses are distinguished by setting the second least significant bit of the most significant byte of the address. If the bit is 0, the address is universally administered. If it is 1, the address is locally administered. In the example address 06-00-00-00-00-01 the most significant byte is 06 (hex), the binary form of which is 00000110, where the second least significant bit is 1. Therefore, it is a locally administered address.[4] Consequently, this bit is 0 in all OUIs.

    If the least significant bit of the most significant octet of an address is set to 0 (zero), the frame is meant to reach only one receiving NIC .[citation needed ] This type of transmission is calledunicast . A unicast frame is transmitted to all nodes within the collision domain , which typically ends at the nearest network switch or router . Only the node with the matching hardware MAC address will accept the frame; network frames with non-matching MAC-addresses are ignored, unless the device is in promiscuous mode .[citation needed ]

    If the least significant bit of the most significant address octet is set to 1, the packet will still be sent only once; however, NICs will choose to accept it based on different criteria than a matching MAC address: for example, based on a configurable list of accepted multicast MAC addresses. This is called multicast addressing.

    展开全文
  • 但修改无线网卡时,经常碰到百分百按照教程方法修改,可就是无法见效,原因是修改的MAC地址格式有问题, 一般来讲,采用02或0A开头即可成功。亲测有效,至于原因,猜测应该是驱动里有什么限制。 转载于:...

    在很多情况下会碰到需要修改网卡物理地址,也就是MAC地址,如何修改,百度一下会有很多方法。

    通常我们修改有线网卡地址时可以很顺利的成功见效。

    但修改无线网卡时,经常碰到百分百按照教程方法修改,可就是无法见效,原因是修改的MAC地址格式有问题,

    一般来讲,采用02或0A开头即可成功。亲测有效,至于原因,猜测应该是驱动里有什么限制。

    转载于:https://www.cnblogs.com/caibirdy1985/p/10372387.html

    展开全文
  • MAC 地址格式 解说

    千次阅读 2014-01-17 16:22:53
    为了能使某网卡发出的帧被正确的网卡接收并处理,IEEE规定:每块网卡都有一个唯一的以太网地址----MAC地址(IEEE之所以将其称为MAC地址,是因为编址细节是由诸如802.3等MAC协议定义的)。MAC地址有48位(6字节),...
  • MAC地址格式小结

    万次阅读 2014-10-20 22:35:35
    mac地址对于每块网卡是固定的,每块网卡被生产出来后,都会有一个全球唯一的编号来标识自己,不会重复, 这个编号就是MAC地址,也就是网卡的物理地址。MAC地址是由48位的二进制数组成,即6个字节。在通信中是用16...
  • 这个问题首先得考虑的就是...如果是卷标序列号,要注意的是每次格式化硬盘的时候这个序列号都会变 代码可以参考: http://www.csdn.net/Develop/Read_Article.asp?Id=25196 如果是物理序列号: String HDid; Managem...
  • 前言不同的Linux发行版显示网卡配置信息时有不同的格式,如果我们通过shell脚本读取这些网卡信息时,可能需要较长时间编写这些脚本以满足需求.比如使用以下命令获取ip地址ifconfig | grep 'inet addr:'| grep -v '...
  • delphi获得网卡MAC地址

    千次阅读 2009-11-16 09:10:00
    获得网卡MAC地址在很多地方都有很大的用处,下面的函数以XX-XX-XX-XX-XX-XX 的格式返回远程或本地机器的MAC地址。Function to return the MAC address of a remote or local machine in the format XX-XX-XX-XX-XX-...
  • 前言不同的Linux发行版显示网卡配置信息时有不同的格式,如果我们通过shell脚本读取这些网卡信息时,可能需要较长时间编写这些脚本以满足需求.比如使用以下命令获取ip地址ifconfig | grep 'inet addr:'| grep -v '...
  • http://www.winsim.com/diskid32/diskid32.html 这个问题首先得考虑的就是你的硬盘是不是SCSI硬盘 如果是,那么根本不存在"物理序列号",只可能取得卷标的序列号 如果是卷标序列号,要注意的是每次格式化硬盘的时候...
  • 在知道IP地址的情况下,如何查看主机名和MAC网卡地址?我们可以利用nbtstat命令来查看 格式为:nbtstat -aIP 例如:要查看IP地址为192.168.1.13的主机名 PS:不要和我说,...

空空如也

空空如也

1 2 3 4 5 ... 20
收藏数 471
精华内容 188
关键字:

网卡mac地址格式