Within the field of networking, there are two models that network professionals often refer to during their troubleshooting. These models are known as the Open Systems Interconnection (OSI) reference model and the Transmission Control Protocol/Internet Protocol (TCP/IP) stack.
The following table outlines the layers of each model and displays the OSI model, Protocol Data Units (PDUs), and the TCP/IP protocol suite:
Often, the terms packets and frames will be used interchangeably, but there is a difference between them. Let's focus a bit more on the characteristics of a frame and its composition.
In this section, we are going to focus on the data link layer (layer 2) of the OSI model. The data link layer is responsible for moving data between the software applications on devices to the physical layer of a network. This is done by the NIC. Additionally, before the data is placed on the physical layer, the data layer inserts the physical address of the NIC, that is, the media access control (MAC) address, into the frame. This address is sometimes referred to as the burned-in address (BIA).
The MAC address of a device is 48 bits in length and is written in hexadecimal format; therefore, each character ranges between 0-9 and A-F. The first 24 bits are known as the organizationally unique identifier (OUI) and are assigned by the Institute of Electrical and Electronics Engineers (IEEE) to vendors and manufacturers. By having knowledge of the first 24 bits of any valid MAC address, you can determine the vendor/manufacturer of the NIC and/or device. The last 24 bits are unique and assigned by the vendor, thereby creating a unique MAC address for each device.
The following is a breakdown of a MAC address:
To view the MAC address on Windows, use the ipconfig /all command:
However, on a Linux-based OS, you need to use the ifconfig command:
We now have a better idea of the purpose of the MAC address on a device and network. Now, let's take a deep dive into learning how to change (spoof) our MAC address in Kali Linux.