Mac address commands: why two of them disagree

On a Mac, the hardware MAC address of the Wi-Fi card comes from networksetup -getmacaddress Wi-Fi. The address the Mac is presenting to the network right now comes from system_profiler SPAirPortDataType or ifconfig en0. Those two values are often different, and both are correct. The first is fixed at the factory. The second is a private Wi-Fi address that macOS generates per network. Most of the confusion around this search comes from sending one when the other was wanted. The commands below were run on macOS 27.0.1 on October 8, 2026, with the last three bytes of every real address masked.

The commands, and which question each one answers

Every guide lists commands. Fewer say which question each one actually answers, and that is the part that decides whether a registration works.

Command	What it reports	Use it for
networksetup -getmacaddress Wi-Fi	Hardware address of the Wi-Fi port	Registering a device with an administrator or a router's allow list
networksetup -listallhardwareports	Every port, its device name, its hardware address	Finding out which port is which before registering
system_profiler SPAirPortDataType	Address the Wi-Fi card is using now	Matching what the router sees today
system_profiler SPNetworkDataType	Hardware address of each network service	A readable list with service names
ifconfig en0	Address on the interface, as this process is allowed to see it	Quick checks inside scripts
route -n get default	Which interface carries traffic	Picking the right port on a Mac with adapters
arp -a	Addresses of other devices this Mac has talked to	Printers, cameras, anything without a screen

On the test machine, networksetup -getmacaddress Wi-Fi returned 70:8c:f2:xx:xx:xx. In the same minute, system_profiler SPAirPortDataType returned da:26:3d:xx:xx:xx for the same card on the same network. system_profiler SPNetworkDataType, a different report from the same tool, returned the 70:8c:f2 value again. So one utility can give both answers depending on which report is read. Reading the label above the value matters more than the name of the command.

For anything that will be registered and kept, use networksetup. For anything that has to match what the router logged a minute ago, use the current address.

Why the hardware address and the live address differ

The difference is a deliberate privacy feature. Apple's support article on private Wi-Fi addresses, checked on October 8, 2026, states that by default a device "improves privacy by using a different MAC address for each Wi-Fi network". From macOS Sequoia 15 onward the setting has three positions:

• Off. The Mac uses its hardware MAC address on that network.
• Fixed. The Mac uses a private address for that network and does not rotate it. Apple says this is the default when joining a network with WPA2 or stronger security.
• Rotating. The private address changes every 2 weeks. This is the default on networks with weak security or none.

The same article notes that erasing all content and settings, or resetting network settings, makes the device use a different private address the next time it joins. That covers the ticket nobody can explain: an address that was registered correctly three weeks ago and now fails. Nothing was misconfigured. The address rotated.

To change it on a Mac, the path Apple gives is short. Open the Apple menu, choose System Settings, click Wi-Fi in the sidebar, then click the Details button next to the network name. The menu next to Private Wi-Fi Address offers Off, Fixed and Rotating. Changing it applies to that network only, so a home network and an office network can be set differently.

Administrators who manage many Macs have a cleaner option. Apple's article says organisations can turn the feature off for enrolled devices through a network profile pushed by device management. That is better than asking each person to find the setting.

Reading an address without running another command

Any MAC address can be classified from its first byte, which helps when a value arrives in a chat message with no context.

The second hex digit is the one to look at. If it is 2, 6, A or E, the address is locally administered, meaning software generated it. On a Mac that almost always means a private Wi-Fi address. If it is anything else, the address was assigned by a manufacturer.

Applied to the test machine: 70 has a second digit of 0, so it is a hardware address. da has a second digit of A, so it is generated. That matches what the two commands reported.

For hardware addresses, the first three bytes identify the maker. The IEEE publishes the full registry as a plain text file at standards-oui.ieee.org. Looking up the two hardware prefixes on the test machine gave a useful surprise. 70-8C-F2 is registered to Apple, Inc., as expected for the built in Wi-Fi card. The wired connection, however, began with 64-4B-F0, which is registered to CalDigit, Inc. That Mac reaches the wired network through a CalDigit dock, so the wired MAC address belongs to the dock and not to the computer.

When a laptop connects through a dock, the wired address travels with the dock. Register it and then use the laptop at a different desk, and the registration no longer applies. Generated addresses do not appear in the registry at all, which is another quick way to tell them apart.

A value that is not an address at all

On the same machine, ifconfig en0 and ifconfig en7 both printed ether 02:00:00:00:00:00 when run from a shell launched by an automation tool, while system_profiler and ioreg -l | grep IOMACAddress in that same shell returned real values. 02:00:00:00:00:00 is a placeholder. It has the locally administered bit set and every other bit empty. If a script collects that value, the process running it was not handed the real one. Run the same command from Terminal directly, or switch the script to networksetup, before trusting the result.

Picking the right port on a Mac with adapters

Interface names are not fixed. en0 is the Wi-Fi card on most recent Macs, but a guide that tells the reader to run ifconfig en0 assumes a single connection, and many desks have three.

networksetup -listallhardwareports on the test machine listed a Thunderbolt Ethernet port on en7, three generic Ethernet adapters on en4, en5 and en6, a Thunderbolt Bridge, Wi-Fi on en0, and several Thunderbolt ports. Each line carries its own address. Registering the first one in the list would have registered an adapter that carries no traffic.

The command that settles it is:

$ route -n get default
    gateway: 192.168.1.1
  interface: en7

That Mac sends its traffic over en7, the dock's Ethernet port, even though Wi-Fi on en0 is also connected. The interface named here is the one whose address the router sees for internet traffic. With that name in hand, the matching hardware address can be read from the listallhardwareports output.

In System Settings, the same information is under Network. Select the service, such as Ethernet or a dock's Thunderbolt Ethernet, click Details, and the Hardware section shows its MAC address. For Wi-Fi, the address shown in the Wi-Fi details for a network is the one in use on that network, which is why it can differ from the hardware value.

Finding the MAC address of another device on the network

Several of the top Japanese results for this search are about a different task: finding a device on the network, often one that is misbehaving. The Mac can do this with ping and arp.

arp -a lists the IP to MAC mappings the Mac has cached. It only knows about devices it has exchanged traffic with recently, so a quiet printer will not be there. Contact the device first:

$ ping -c 1 192.168.1.50
$ arp -a | grep 192.168.1.50

Each line of arp -a shows the host name if one resolves, the IP address, the MAC address and the interface it was seen on. arp -an skips name lookups and returns faster on a large network. The interface column also confirms which side of a dual connection the device is on.

If the IP address is unknown, ping the subnet's broadcast address once, then read the whole table. Not every device answers a broadcast ping, so a missing entry does not prove the device is absent. The router's own client list, usually under a DHCP or connected devices page in its admin screen, is the other reliable source. Comparing the two is how a misbehaving device gets identified: match the IP address in the router log to a MAC address, then match the maker prefix to a physical object in the room.

The same commands on Windows

When the task involves a Windows machine as well, the equivalents are documented by Microsoft. getmac prints the MAC address of each network adapter. ipconfig /all lists every adapter with a Physical Address line. arp -a works much as it does on the Mac, listing the cached IP to physical address table. Microsoft's command references for getmac and arp cover the options. Windows has its own random hardware address setting per Wi-Fi network, so the same split between hardware and in use addresses applies there too.

On a Linux machine, ip link prints each interface with a link/ether line holding its address. Across all three systems the rule is the same: find which interface carries the traffic first, then read that interface's address, and note whether the value is generated before writing it down anywhere permanent.

Keeping the answer next to the work

The commands above are short, and the trouble is rarely the typing. It is the switching. Someone reads a request in one app, opens Terminal, works out which interface matters, copies a value, then goes back to the folder where the device inventory or the registration form lives. Each hop is a chance to paste the wrong one of three similar strings.

A file manager with a built-in terminal shortens that loop. The terminal opens in the folder already on screen, so the inventory file and the command output sit side by side. The Features page shows a terminal tied to each folder, and the Mac side is free with no time limit, as listed on the Pricing page. For a one off lookup it makes no difference. For someone who registers devices every week, keeping the record and the shell in one window removes most of the copying errors described above.

Whatever tool is used, the habit that prevents rework is writing down three things together: the hardware address, the interface or port it belongs to, and whether a dock was involved. With those three, the next person can tell whether a mismatch is a rotation, a different desk, or a genuine problem.

What to change first

Before sending a MAC address to anyone, run route -n get default to find the interface that matters, then read its hardware address with networksetup -listallhardwareports. If a network needs the Mac's real address, set Private Wi-Fi Address to Off for that network only. For a folder and a terminal in the same window, Atriens is one option.