Ethernet

Conceptually Ethernet can be seen as a single bus where each host connects to. In modern Ethernet networks, each device connects to a switch. Each host can send a frame to any other host.

MAC Address

Every Ethernet host is uniquely identified by its media access control (MAC) address. This is a 48bit address that is typically represented as a hexadecimal string:

02:42:5f:d2:10:ab

This MAC address is hard-coded into the network interface controller (NIC), your network device. It consists of two parts:

OUI:

The organizationally unique identifier (first 24 bytes) encodes the vendor of the network device

Host:

A unique host identifier from each vendor (last 24 bytes)

Modern NICs allow changing the MAC address programmatically.

Broadcasts

Ethernet also supports broadcasting a frame to every host in a network. Broadcasts are addressed to a special MAC address ff:ff:ff:ff:ff:ff. For this reason an Ethernet network is also sometimes called a broadcast domain.

Frames

When a NIC receives a frame, it checks whether the frame is addressed to its own MAC address or a broadcast. If it is neither, it will discard the frame. To change this default behavior, NICs can be configured into a promiscuous mode, which will pass along all frames. This is useful for capturing network traffic, even if it wasn’t addressed to the host that is capturing the frames.