What is MAC?
Media Access Control address
A MAC (Media Access Control) address is the 48-bit hardware address of a network interface, used to deliver frames between devices on the same LAN.
A MAC address is written as six pairs of hexadecimal digits, such as 1a:dc:74:6a:45:dc. Every Ethernet frame carries a destination and a source MAC address, and switches use the source addresses to learn which device sits behind which port (their FDB). For addresses burnt in by the manufacturer, the first three bytes are an Organisationally Unique Identifier (OUI) assigned to that vendor by the IEEE, and the vendor numbers the rest. Two bits in the first byte have special meanings. The lowest bit marks a group (multicast) address; the all-ones address ff:ff:ff:ff:ff:ff is the broadcast address, delivered to every device on the LAN. The next bit marks a "locally administered" address, one set by software rather than the manufacturer. Virtual machines, containers and phones using randomised Wi-Fi addresses all use locally administered MACs, which is why the first byte of the example above, 1a, has that bit set.
The key thing to remember is that MAC addresses only matter within one LAN or VLAN. When a packet is routed, the IP addresses stay the same end to end, but each router rewrites the MAC addresses for the next link. To find the MAC address for an IP address on the local network, IPv4 hosts use ARP and IPv6 hosts use NDP. Engineers often confuse the switch's MAC table with the ARP table, or expect to see a remote server's MAC address, when they will only ever see their gateway's. MAC addresses are also not a security boundary, since they are easy to change. The Switching basics lesson shows MAC learning and flooding on a real switch.
Lessons that use MAC
- Switching basics: layer 2, VLANs and IP addressingBeginner · 40 min
How a switch learns MAC addresses and floods broadcasts, how IP subnets and default gateways decide where packets go, how VLANs split a switch into separate networks, and how trunks and a router connect them. Built on a real switch, three PCs and a VyOS router.
- EVPN and VXLAN: layer 2 over a routed fabricAdvanced · 45 min
Stretch a layer-2 segment across a routed leaf-spine fabric: VXLAN for the data plane, BGP EVPN for the control plane. Built with FRR: the underlay, VNIs, type-2 and type-3 routes, route targets, and the VXLAN packets on the wire.
- Packets That Never Come BackIntermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.
- Building a network lab on an Apple Silicon MacBeginner · 45 min
Run real network labs on an M-series Mac: native FRR and Linux containers, x86-only images through Rosetta, and full x86 VyOS VMs under QEMU in Docker, with the pitfalls that stop most people and a starter lab that mixes all three.
- Office gateway: DHCP, DNS and VRRP on VyOSBeginner · 40 min
Two VyOS routers serving one office LAN: VRRP for a gateway that survives a router failure, DHCP with split pools and a printer reservation, and DNS forwarding. Then a real failover, the DNS outage it exposed, and the fix.
- Linux Network ConnectivityBeginner · 80 min
Find out why a Linux machine can't reach something, layer by layer: interfaces and addresses, routes and ip route get, ARP and the neighbour table, ping and traceroute, DNS, and listening sockets — with real output from a three-host lab.
- IPv4 over an IPv6-only core (RFC 8950)Intermediate · 40 min
Carry IPv4 routes over IPv6 BGP sessions with IPv6 next hops, so core routers need no IPv4 addresses at all. Built on VyOS: the missing router ID, what breaks without the extended next hop capability, native IPv4 on the wire, and why traceroute shows 192.0.0.8.
- IPv6 on VyOS: setup and routingBeginner · 55 min
Number a site from an ISP's /48 on VyOS: WAN and blackhole routes, SLAAC with Router Advertisements, handing a /56 to a downstream router statically and with DHCPv6 prefix delegation, and the forward firewall IPv6 needs because there's no NAT. Every output comes from a real two-router VyOS lab.