Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was logged on to my router and filling out some information. I clicked a button and a field was automatically filled in with my computer's MAC address. How is this possible? Does it present a security risk?

I'm connected through VPN and my computer is up to date and running Microsoft Security Essentials (MSE). Is there JavaScript code that can get the MAC address? Is the MAC address sent in an IP header? I was surprised I wasn't at least prompted to share this information.

share|improve this question
1  
Computer's MAC address or your router's? –  SilverlightFox Jun 18 at 9:29
    
@SilverlightFox it was the computers MAC address –  Celeritas Jun 18 at 17:49
8  
Ethernet (802.3) and Wi-Fi (802.11) use MAC addresses to route data packets, so it's not surprising the router knows your MAC address. The fact that this webpage is running/hosted on the router is key. –  Cornstalks Jun 19 at 3:55

2 Answers 2

This is not a security risk.

The router looks in its ARP table to find the MAC address of your IP address. The reason it can do this, is because you are connected to the router via layer 2 in the OSI model. The router simply looks up your IP address in the ARP cache to find its MAC address. A website on the Internet is not connected to your LAN and will not be able to determine your MAC address.

In the same way, you from your computer determine the MAC address of your router by looking in the ARP cache of your computer. If you open up your command prompt (cmd.exe on Windows) and type "arp -a", you will see your router's MAC address. This does not pose a security risk, and is required for IP traffic to work on an Ethernet network.

share|improve this answer
4  
Which also means only your router (or any device on your local network, for that matter) can do this, but not a web server on the Internet. –  user149408 Jun 18 at 13:27
    
How did the site find the computer's MAC address though? –  SilverlightFox Jun 18 at 17:59
7  
@SilverlightFox: The site is running on the router itself, not on a faraway server. –  Jan Fabry Jun 18 at 18:08
    
@JanFabry: Thanks for the clarification - I thought the OP meant they were logged onto a webpage via their router's connection. Long day! –  SilverlightFox Jun 18 at 18:20

There is no risk here.

The Internet is not just one protocol, but a series of protocols that stack up on top of each other. The exact definitions of each part of the stack differ somewhat from person to person, but the two we're concerned about here are fairly well-defined: the link layer and the network layer. Depending on who you ask, these layers have different numbers, so I'm going to use the names instead.

The link layer defines how to get a signal across two computers that are directly connected in some way. Ethernet is one example, and so is is the 802.11 family of wireless protocols; I list these because they use MAC addresses. PPP, which is often used by modems, is another example of a link-layer protocol, but it does not use MAC addresses. There are other link-layer protocols too, but I won't get into them here.

The network layer defines how to get a signal across two computers that are NOT directly connected, using computers that ARE directly connected in some way. This is where IP lives, and it doesn't use MAC addresses.* Data still has to be passed between machines that are directly connected to each other, but even if this is done using only protocols that use MAC addresses, it uses the MAC addresses of the two machines that are passing information between them at the moment, not the MAC address that started it all. Your MAC address is only visible to the very first link in the chain -the one between your computer and the router- and it legitimately needs that, because that's how it tells data from your computer apart from data from other computers connected to it. But after that, your address is gone.

The reason that your router knows your MAC address is that you are directly connected to it, using the link layer (it can also see you in the network layer, which is how it's presenting its interface to you, but that doesn't matter here). It cannot see the MAC addresses of anyone who is not directly connected to it in this way, because that information gets lost in the network layer.** The same is true of other machines. So yes, your router can see your MAC address, but no one else can.

*: IPv4 doesn't use MAC addresses, and if you're not sure what IP version you're using, it is probably IPv4. IPv6 allows (but doesn't require) computers to use MAC addresses in certain ways, and some implementations do this, but it has caused a lot of controversy.

**: Again, this assumes you're not using an IP version that leaks MAC address information.

share|improve this answer
    
+1 for mentioning IPv6 embedding. –  Taemyr Jun 19 at 8:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.