AP Networking 2.2: MAC Address vs IP Address

A MAC address is a permanent 48-bit hardware identifier burned into a device's network card at the factory. An IP address is a logical 32-bit address assigned by the network, and it changes between networks. MAC is who the device is; IP is where it is right now. This guide covers the structure of both, the five IPv4 address types, and how technicians use them to document a network.

This is Topic 2.2 of AP Networking Unit 2. In Topic 2.1 you troubleshot the computer lab without a map, and every fix took longer for it. Documentation is built on these two identifiers. Learn to read them and a router's client table tells you who made each device, whether DHCP is working, and whether something is on your network that should not be.

• MAC vs IP: the difference
• What is a MAC address?
• What is an IPv4 address?
• The five IPv4 address types
• Find your MAC and IP address
• Documenting the computer lab
• Spotting an intruder
• Practice: Address Detective
• Using AI safely
• Key terms
• Frequently asked questions

MAC address vs IP address: the difference

The two addresses answer different questions. The MAC answers "who is this device?" and never changes. The IP answers "where is it right now?" and changes with every network. A map needs both.

	MAC address	IPv4 address
What it is	Physical hardware identifier	Logical network identifier
Size and format	48 bits, six hex pairs (A4:5E:60:B2:19:7C)	32 bits, four octets 0-255 (192.168.1.24)
Who assigns it	The manufacturer, at the factory	The network the device joins (usually DHCP)
Does it change?	No; it travels with the device for life	Yes; each network assigns its own
Internal structure	OUI (manufacturer) + interface identifier	Network portion + host portion
Where it operates	The local link: switch or access point	Across networks, LAN to internet

Think of the MAC as a car's VIN and the IP as its parking spot. One never changes; the other changes every trip.

What is a MAC address?

A MAC (media access control) address is a 48-bit identifier assigned to a network interface card, or NIC, when it is manufactured. It is written as six pairs of hexadecimal digits, like A4:5E:60:B2:19:7C; each pair encodes 8 bits. Burned in at the factory, it follows the device everywhere. Same NIC, same MAC.

OUI and interface identifier

The address splits down the middle. The first three pairs are the Organizationally Unique Identifier, or OUI, registered to the manufacturer; the last three identify the specific interface. In A4:5E:60:B2:19:7C, the OUI is A4:5E:60. Two lab desktops from the same batch usually share an OUI and differ in the second half. The split is practical: an OUI lookup names the maker of a mystery device in your client table.

MAC addresses operate at the local-link level: they identify a device to the switch or access point it touches directly. Stretching across networks is the IP address's job.

What is an IPv4 address?

An IPv4 address is a 32-bit logical address, written as four decimal numbers from 0 to 255 separated by dots, such as 192.168.1.24. Each number is an octet because it represents 8 bits. Unlike a MAC, an IP is not built into hardware. The network assigns it, usually through DHCP, when the device joins. Move your laptop from lab to kitchen and it gets a different IP; each network hands out its own.

Network portion and host portion

Every IP has two parts: a network portion that says which network the device is on, and a host portion that identifies it within that network. In the lab, every device shares 192.168.1 and differs in the final octet: router at .1, printer at .30, desktops from .20 upward. Computing the split with subnet masks is Unit 3; for now, the shared front is the network, the differing end is the host.

The five IPv4 address types

The type of any IPv4 address tells a story before you run a single test. Memorize these ranges.

Type	Range or address	What it tells you
Private	10.0.0.0/8, 172.16.0.0/12 (172.16-172.31), 192.168.0.0/16	Normal inside a LAN. Not routable on the public internet; millions of networks reuse these ranges.
Public	Everything outside the reserved ranges	Globally routable, ISP-assigned. One public address usually represents your entire LAN online.
Loopback	127.0.0.1	The device talking to itself. A successful ping proves the local TCP/IP stack works, nothing more.
APIPA (link-local)	169.254.x.x	Self-assigned after DHCP never answered. A sign of failure, not success.
Broadcast	Highest address on the network (192.168.1.255), or 255.255.255.255	Delivered to every device on the network at once.

The type with the most troubleshooting value is APIPA. A device showing 169.254.31.8 configured itself because DHCP never answered. Stop testing the far end and check everything between this device and the DHCP server: cable, switch port, router.

How to find your MAC and IP address

Documentation starts with reading the addresses off each device.

Device	How to find both addresses
Windows	Run ipconfig /all. Physical Address is the MAC; IPv4 Address is the IP. getmac lists MACs alone.
Mac / Linux	Run ifconfig or ip a. The ether line is the MAC; the inet line is the IP.
Chromebook	Click the clock, open Settings, choose the network, then Network details.
Phone or tablet	Settings, Wi-Fi, then the network's details. Phones often show a randomized per-network MAC for privacy; the hardware MAC is listed separately.

Step-by-step: documenting the computer lab

The Unit 2 deliverable is a documentation table: one row per device, joining permanent identity to current location.

1. Inventory the devices. Walk the room and list everything that touches the network: desktops, printer, access point, the router itself.
2. Record each MAC. This column is the fingerprint; it will still be correct next year.
3. Record each current IP. Note it next to its MAC and mark its type. Every row should be private; a 169.254 entry is a DHCP problem to fix now.
4. Cross-check against the router. Compare its client table to your list, row by row.
5. Investigate every mismatch. A MAC in the router's table but not yours is an unknown device. Look up its OUI, identify it, add it or remove it.

Keep the table where the whole team can update it. Documentation that lives in one person's head fails exactly when that person is absent.

Worked example: spotting an intruder

The evidence. Your inventory lists 18 devices. The router's client table shows 19. The extra row reads MAC 5C:02:14:77:A0:3B at IP 192.168.1.61.

Read the IP first. 192.168.1.61 is a normal private lab address. An intruder on your Wi-Fi gets a perfectly ordinary IP, so the address type cannot flag them.

Read the MAC second. The MAC is the alarm: every legitimate interface is in your documentation, and this one is not. An OUI lookup on 5C:02:14 names the maker, say a phone vendor. Someone joined the lab wireless with a personal device.

Respond. Identify the owner, or remove and block the device, then update the documentation and Wi-Fi credentials if needed. Without the table, device 19 stays invisible. Topics 2.5 and 2.6 build on this.

Practice: Address Detective

Warm up with three sample questions, then work the case file. Everything here reasons the way the exam does: an address pattern plus a second fact.

Three free sample questions

1. A device shows 00:1B:44:11:3A:B7. Which part identifies the manufacturer?

Show answer

The first three pairs, 00:1B:44, are the OUI (EK 2.2.A.3). The last three identify the specific interface.

2. A laptop moves from the school lab to a home network. What happens to its two addresses?

Show answer

The MAC stays; the home network assigns a new IP (EK 2.2.A.4, 2.2.B.4).

3. A desktop that cannot reach the file server shows 169.254.116.7. What type of address is this?

Show answer

APIPA (link-local): the desktop got no DHCP answer and addressed itself (EK 2.2.C.4).

Now the full case file, shuffled every run so you reason from the evidence.

Using AI to draft documentation, safely

An AI assistant is genuinely good at the tedious half of documentation: paste in raw ipconfig /all output from twenty machines and it drafts a tidy table in seconds. Use that. Then verify every row, because a fluent table with format errors is worse than no table.

The verification pass is mechanical. Check formats: hex pairs belong in the MAC column, dotted decimal in the IP column; a row reading "MAC: 192.168.4.31" has the fields swapped. Check ranges: labeling 172.33.9.150 private is the 172 trap. Check claims: calling an IP "permanent" confuses it with the MAC. AI drafts; the technician verifies. That division of labor is a graded skill here.

Key terms

MAC address

A permanent 48-bit hardware identifier assigned to a NIC at the factory, written as six hexadecimal pairs.

NIC (network interface card)

The hardware that connects a device to a network. Every NIC carries its own MAC.

OUI (Organizationally Unique Identifier)

The first three pairs of a MAC, registered to the manufacturer.

IPv4 address

A 32-bit logical address of four octets from 0 to 255, assigned by the network a device joins.

Octet

One of the four 8-bit numbers in an IPv4 address.

DHCP

The service that assigns IP addresses automatically. When it fails, devices fall back to APIPA.

APIPA (link-local address)

A self-assigned 169.254.x.x address; evidence of a DHCP failure.

Loopback

127.0.0.1, the device talking to itself. Tests only the local TCP/IP stack.

Broadcast address

Delivers one message to every device on the network, such as 192.168.1.255 on 192.168.1.0/24.

Frequently asked questions

What is the difference between a MAC address and an IP address?

A MAC address is a permanent 48-bit hardware identifier set at the factory. An IP address is a logical 32-bit address the network assigns, and it changes between networks. MAC identifies the device; IP locates it on the current network.

What does the first half of a MAC address mean?

The first three pairs are the OUI, registered to the manufacturer; the last three identify the specific interface. An OUI lookup tells you who made an unknown device.

Why does my IP address change between home and school?

Each network assigns its own addresses, usually through DHCP, so a new network means a new IP. The MAC stays the same.

Is 192.168.1.1 a private IP address?

Yes. 192.168.0.0/16 is private, with 10.0.0.0/8 and 172.16.0.0/12. Private addresses are not routable on the public internet, so millions of routers can all use 192.168.1.1.

Are all addresses that start with 172 private?

No. Only 172.16.0.0 through 172.31.255.255 is private. 172.32.1.10 is public. Check the second octet.

What does a 169.254.x.x address mean?

It is an APIPA, or link-local, address: the device got no answer from DHCP and assigned itself one. Troubleshoot the path between the device and the DHCP server.

What is 127.0.0.1 used for?

It is the loopback address, the device talking to itself. A successful ping proves the local TCP/IP stack works and nothing more.

How does network documentation help catch intruders?

Documentation maps every known device to its MAC and IP. A client-table entry with no matching inventory row is an unknown device; an OUI lookup names its maker so you can investigate or remove it.

AP is a trademark of the College Board, which was not involved in the production of, and does not endorse, this resource.