What is a MAC address, and how is it different from an IP address?¶

A Media Access Control (MAC) address is an identifier that a network interface presents on a local network. An IP address is addressing information used to move data within or between IP networks. A router, DHCP server or Wi-Fi controller may record both, but they answer different questions.

One phone can present several addresses¶

Dave joins his home Wi-Fi with an iPhone and later joins a café network. The phone can present one Private Wi-Fi Address to the home network and another to the café. Its hardware Wi-Fi address and Bluetooth address are separate values again.

People sometimes call this MAC “tumbling”. The more accurate terms are private, randomised or locally administered addressing. Locally administered means that the address was selected for that context rather than being the manufacturer's globally assigned value. It does not necessarily mean that the phone invents a new address every time it reconnects. The address may remain fixed for one network or rotate, depending on the device's setting and software behaviour.

The example values are fictional. Their form does not reveal which person held the phone.

MAC and IP records describe different layers¶

The mobile-device identifier overview explains why hardware, subscription, wireless-interface, account and application identifiers must remain separate. The local-network records explainer shows how a presented MAC address may be joined to a DHCP lease, private IP address, Wi-Fi association and time.

Will an iPhone use the same address when it returns?¶

Often, but not always. Apple's current behaviour for iOS 18 or later offers three settings for each Wi-Fi network:

• Off — the iPhone uses its hardware Wi-Fi MAC address.
• Fixed — it uses a private address for that network and does not rotate it. Apple says this is the default for a new network using WPA2 or stronger security.
• Rotating — it uses a private address that changes every two weeks. Apple says this is the default for a new network using weak security or no security.

An iPhone returning to a remembered network in Fixed mode should therefore normally present the same private address. In Rotating mode, the value is deliberately time-limited. Resetting network settings or erasing the phone causes a different private address to be used on the next join. On iOS 18 or later, forgetting a network also forgets its private address, unless the network was forgotten less than 24 hours earlier.

The network name, called the SSID, is not a unique identifier for the underlying access point or premises. Different places can use the same name, and access points can be replaced or copied. “Same SSID” is therefore not enough on its own to prove that the phone returned to the same physical network, even if the address is unchanged. Compare the network record, access-point identifier, security context and time where those details are available.

What can the phone itself retain?¶

Normal iPhone settings let a user inspect a current or known Wi-Fi network and its Private Wi-Fi Address setting. A remembered network can therefore retain network-specific configuration after the phone disconnects. Those settings are not a historical ledger of every MAC address the phone has ever presented.

A specialist device examination may distinguish a remembered network, a nearby-network observation and an actual association. Depending on the available data and extraction, records may include an SSID, access-point identifier, assigned address, security information or connection timing. What can Wi-Fi records show? explains those distinctions. It does not establish that every handset or extraction contains a complete history of private addresses, so that question must be tested against the actual device, OS version, extraction method and artefacts recovered.

The external network holds a different side of the evidence. A router, DHCP server or Wi-Fi controller may retain the presented MAC address, private IP address, device name, access point and association or lease times. Interpret the value at that observation point: these records may be short-lived, and their labels do not guarantee that the address is the hardware value.

Read the address as a time-bound association¶

Compare like with like: record the address exactly, identify whether it came from the handset, router, DHCP lease or Wi-Fi controller, and preserve the relevant time. A match between the phone's current network-specific address and a contemporaneous router record can be useful corroboration. A mismatch may reflect another interface, another network, rotation, a reset or incomplete records rather than automatically proving a different handset.

Practise with a simulated iPhone¶

Which MAC Address Belongs to This iPhone? is a browser-only introductory activity. It lets you inspect hardware Wi-Fi and Bluetooth identifiers, compare two network-specific private addresses and interpret a fictional router record without touching a real phone or network.