MAC addresses, IP addresses, ports, and domain names
By the end of this module you will be able to:
- Explain what DNS hostnames, IP addresses, MAC addresses, and port numbers each identify
- Describe where each identifier operates and how they work together in a single request
- Explain how ARP and IPv6 Neighbor Discovery bridge network-layer addresses to link-layer delivery on the local segment
Real-world incident · October 21, 2016
100,000 hacked cameras took down Twitter, Reddit, Netflix, and Amazon.
In October 2016, a botnet called Mirai infected roughly 100,000 IoT devices (security cameras, baby monitors, home routers) using default passwords. The botnet launched a massive DDoS attack against Dyn, a company that provided DNS services for Twitter, Reddit, Netflix, Amazon, PayPal, Spotify, and thousands more.
The web servers for all those sites were still running. Their IP addresses were still reachable. But users could not get past the first step of any request: resolving the hostname. When Dyn's DNS servers went down, browsers could not translate "twitter.com" into an IP address. No IP address means no TCP connection. No TCP connection means no website.
The attack exposed DNS as a critical single point of failure. It also demonstrated why understanding the four network identifiers matters: the target was not the websites themselves but the naming system that makes them reachable.
All these websites used different servers in different locations. How did one attack take them all down at the same time?
Identifiers answer different scope questions
Six rows narrow from URL through domain name, IP address, MAC address and port to socket, each indented inside the one above. That is why an IP address resolved by DNS settles reachability yet says nothing about which service answers, while only the socket names one conversation.
An identifier is only useful at its scope. Do not ask one identifier to answer a question from another scope.
Some identifiers stay end to end; others change at every hop
MAC is tagged REWRITTEN from the local switch onward while IP holds UNCHANGED until the NAT rewrites it, so an address lifted from a capture identifies a hop rather than a host until you say which column it came from.
MAC addresses change at every link. IP addresses survive end-to-end unless a NAT rewrites them. Ports survive unless port-translation is in play.
5.1 Four identifiers, four jobs
Every network request uses four types of identifier. Each one operates at a different layer and has a different scope. Confusing them leads to troubleshooting in the wrong place.
DNS hostname (Layer 7). A human-readable like "www.example.com". Its job is to give people something memorable instead of a number. DNS translates it into an IP address before anything else can happen. Scope: global. Changes when: the domain owner updates the DNS record.
(Layer 3). A numeric address like 93.184.216.34 (IPv4) or 2606:2800:21f:cb07::1 (IPv6). Its job is end-to-end routing: getting the packet from your machine to the destination, across however many routers sit in between. Scope: end-to-end (stays the same through every router). Changes when: the device moves to a different network or the DHCP lease renews.
(Layer 2). A 48-bit link-layer address like DC:A6:32:12:34:56. The first three bytes often identify the organisation that registered the address block, but modern clients can use locally administered randomised addresses for privacy. Its job is local delivery: getting the frame from one device to the next device on the same network segment. Scope: local segment only. Changes at: every router hop (as you learned in Module 2).
number (Layer 4). A 16-bit number from 0 to 65,535. Its job is multiplexing: allowing one device to run many services at the same IP address. Your laptop might have connections to port 443 (HTTPS), port 22 (SSH), and port 53 (DNS) all running simultaneously. Scope: per-host.
The diagram below shows where each identifier lives in the request path. Notice that DNS resolves first (hostname to IP), then ARP for IPv4 or Neighbor Discovery for IPv6 resolves the next-hop link address on the local segment, then TCP connects (IP:port pair creates a ).
Only one of the four is a name rather than a number, and it is the one that has to act first. Nothing further along the sequence can begin until the hostname has been turned into an address, which is why the resolution step is worth following in detail.
5.2 How DNS resolution works
When you type "www.example.com" in a browser, your operating system needs to find the IP address. Here is the sequence:
1. The OS checks its local DNS cache. If a recent query already resolved this name, the cached answer is used immediately.
2. If the cache is empty, the OS sends a recursive query to a configured (your ISP's resolver, Google's 8.8.8.8, or Cloudflare's 1.1.1.1).
3. The resolver performs iterative queriesacross the DNS hierarchy. It asks a root server, which points to the .com TLD servers. Then it asks the .com servers, which point to example.com's . Then it asks those nameservers for the actual IP address.
4. The authoritative server returns the A record (IPv4 address) or AAAA record (IPv6 address).
5. The resolver caches the answer (respecting the TTL, Time to Live, set by the domain owner) and returns it to your OS.
6. Your browser connects to the returned IP address.
The key distinction: your OS makes a recursive query (asking the resolver to do all the work). The resolver then makes iterative queries (following referrals step by step through the hierarchy).
What arrives at the end of that chain is an address, and an address is a smaller promise than most people assume. It is worth being precise about what 93.184.216.34 actually represents, and why plenty of addresses are not reachable from the public internet at all.
Common misconception
“DNS is just a phone book that maps names to IP addresses.”
DNS also handles email routing (MX records), load balancing (round-robin, geo-aware responses), CDN routing (directing users to the nearest edge server), security policy (SPF, DKIM, DMARC records in TXT), service discovery (SRV records), and domain ownership verification. It is one of the most heavily used protocols on the internet.
5.3 IP addresses: public, private, and running out
IPv4 uses 32-bit addresses (4.3 billion possible). IPv6 uses 128-bit addresses (3.4 x 10^38 possible, or roughly 340 undecillion).
Private address ranges (RFC 1918) are reserved for internal networks and are not routable on the public internet. If you have ever seen 192.168.1.x on your home router, that is RFC 1918 at work. The three ranges are:
10.0.0.0/8 (16.7 million addresses), 172.16.0.0/12 (1 million addresses), and 192.168.0.0/16 (65,536 addresses).
IANA's central pool of IPv4 addresses ran out on February 3, 2011. Regional registries exhausted their allocations between 2011 and 2015. Today, (Network Address Translation) lets many devices share one public IP by rewriting addresses at the network edge. NAT solved the address shortage but broke the internet's original end-to-end design. Peer-to-peer applications, VoIP, and online gaming now need complex NAT traversal workarounds (STUN, TURN, ICE protocols).
One thing an IP address never does is put a frame on a wire. Even when the destination is 93.184.216.34, the first thing that has to leave the laptop is a frame addressed to the local router, and the laptop does not know the router's link-layer address yet. Two protocols exist to fill that gap.
Common misconception
“IP addresses identify devices.”
IP addresses identify network interfaces. A laptop connected to both Wi-Fi and Ethernet has two different IP addresses. A router has a different IP on each of its interfaces. A phone switching from Wi-Fi to cellular gets a completely different IP. If you need to identify a device regardless of which network it is on, you need something else (a certificate, a user account, or device management).
5.4 MAC addresses, ARP, and IPv6 Neighbor Discovery
MAC addresses are 48-bit identifiers assigned to network interface cards. They look like DC:A6:32:12:34:56, where the first three bytes (DC:A6:32) are the OUI (Organizationally Unique Identifier), assigned by the IEEE to identify the manufacturer.
When your laptop sends a packet to a server on a different network, it already knows the server's IP address (from DNS). But to send the Ethernet frame to the local router, it needs the router's MAC address. That is where ARP comes in.
ARP (Address Resolution Protocol, RFC 826)works like this: your laptop broadcasts an ARP request to every device on the local segment saying "Who has IP 192.168.1.1? Tell me your MAC address." The broadcast uses the special MAC address FF:FF:FF:FF:FF:FF, which every device on the segment receives. Only the router (which owns that IP) replies, sending its MAC address back as a unicast frame directly to your laptop. Your laptop caches this mapping and uses it for subsequent frames.
IPv6 does not use ARP. It uses Neighbor Discovery, defined in RFC 4861, carried in ICMPv6 messages. Neighbor Discovery lets nodes find routers, resolve IPv6 addresses to link-layer addresses, detect duplicate addresses, and test whether a neighbour is still reachable. The purpose is similar to ARP for local delivery, but the protocol is different and also carries router-advertisement behaviour.
Between them, DNS, IP and local link resolution deliver bytes to the correct machine and stop there. None of them has anything to say about which of the programs listening on that machine should be handed those bytes, which is the fourth identifier's entire job.
Common misconception
“MAC addresses are permanent and cannot be changed.”
MAC addresses can be changed in software on most operating systems. Apple documents private Wi-Fi addresses that identify each network with a different Wi-Fi address, and Android documents MAC randomisation as enabled by default in Android 10 for client mode. MAC-based access control such as Wi-Fi MAC filtering is weak because attackers can observe a legitimate MAC and clone it. Use 802.1X with certificates for real network access control.
5.5 Port numbers and sockets
Port numbers let one device run multiple services on the same IP address. RFC 6335 divides the 65,536 possible ports into three ranges:
System ports (0-1,023): assigned by IANA for well-known services. SSH is 22, DNS is 53, HTTP is 80, HTTPS is 443. On most operating systems, binding to these ports requires elevated privileges.
Registered ports (1,024-49,151): assigned by IANA on request for specific applications. MySQL is 3306, PostgreSQL is 5432, RDP is 3389.
Ephemeral ports (49,152-65,535): used by the operating system for outbound connections. When your browser connects to a web server on port 443, your OS picks a random ephemeral port (like 52,847) as the source port. Each connection gets a different ephemeral port.
A socket is the combination of an IP address and a port number (e.g., 93.184.216.34:443). A TCP connection is uniquely identified by a 4-tuple: source IP, source port, destination IP, destination port. That is how your browser can have dozens of connections to the same server: each uses a different source port, creating a unique 4-tuple.
Try the port and protocol explorer below to look up common services and their port numbers.
That is all four accounted for: a name, a routable address, a link-layer address and a process number. Held separately they are four definitions. Watched in order, inside one request, they become a diagnostic sequence with a checkpoint at every step.
5.6 How all four identifiers work together
When you type https://www.example.com in a browser, all four identifiers come into play in sequence:
1. DNS hostname resolves to IP address. The browser asks DNS for the A record of www.example.com. DNS returns 93.184.216.34.
2. IP determines the next hop. Local resolution finds the link address.The OS sees that 93.184.216.34 is not on the local subnet. Traffic must go through the default gateway (for example, 192.168.1.1). For IPv4, the OS checks its ARP cache for the gateway's MAC. If missing, it sends an ARP broadcast. For IPv6, Neighbor Discovery performs the equivalent local link resolution using ICMPv6.
3. TCP connects using IP:port. The OS opens a TCP connection to 93.184.216.34:443. It picks ephemeral source port 52,847. The 4-tuple (192.168.1.50:52847, 93.184.216.34:443) uniquely identifies this connection.
4. TLS may use the hostname again.In many TLS deployments, the browser sends the hostname "www.example.com" in the SNI (Server Name Indication) extension so the server can pick the correct certificate. , standardised in RFC 9849, can hide the real client hello and SNI where it is deployed.
5. HTTP sends the request. The browser sendsGET / HTTP/1.1 with Host: www.example.com. The server returns the page.
Four identifiers, four layers, one request. DNS gives you the IP. ARP gives you the MAC or IPv6 link-layer neighbour. Ports give you the process. The hostname often comes back around in TLS for certificate selection, with ECH changing what passive observers can see.
A packet crosses three routers on its way to a web server. Which identifier changes at every hop?
During the Dyn DDoS attack in 2016, websites like Twitter and Netflix became unreachable. Their web servers were still running. What was actually targeted?
Your laptop has the IP address 192.168.1.50 on Wi-Fi and 10.0.0.12 on Ethernet. How many IP addresses does your laptop have?
Why do modern phones randomize their MAC address when connecting to Wi-Fi?
Core distinctions
- Four identifiers, four layers: DNS hostname (L7, global), IP address (L3, end-to-end), MAC address (L2, local segment), port number (L4, per-host).
- DNS resolves hostnames to IPs. ARP resolves IPv4 next hops to MACs on the local segment; IPv6 uses Neighbor Discovery. Ports multiplex multiple services on one IP.
- IP addresses identify interfaces, not devices. MAC addresses can be spoofed. DNS does far more than name resolution. Port 80 is convention, not law.
- Attacking DNS (like the 2016 Dyn DDoS) can take down thousands of sites at once because it is the first step in every request.
Standards and sources cited in this module
RFC 1034/1035, Domain Names: Concepts and Implementation
DNS hierarchy, query types, record formats
Defines DNS architecture and resolution process. Referenced in Section 5.2.
RFC 9499, DNS Terminology (BCP 219)
Published March 2024
Current authoritative glossary for DNS terms. Referenced for accuracy.
RFC 1918, Address Allocation for Private Internets
Section 3, Private Address Space
Defines the three private IP ranges (10/8, 172.16/12, 192.168/16). Referenced in Section 5.3.
RFC 826, An Ethernet Address Resolution Protocol
Full specification
Defines ARP. Referenced in Section 5.4.
RFC 4861, Neighbor Discovery for IP version 6
Section 3, Protocol Overview
Defines IPv6 Neighbor Discovery, including address resolution, router discovery, and neighbour reachability. Referenced in Section 5.4.
RFC 6335, Internet Assigned Numbers Authority (IANA) Procedures for Port Numbers
Section 6, Port Number Ranges
Defines system, registered, and ephemeral port ranges. Referenced in Section 5.5.
Dyn analysis summary of the 21 October 2016 attack
Dyn incident analysis
Real-world demonstration of DNS as a single point of failure. Used as the opening case study.
Apple Support, Use private Wi-Fi addresses on Apple devices
Privacy behaviour for Wi-Fi addresses
Documents current Apple behaviour for per-network private Wi-Fi addresses. Referenced in Section 5.4.
Android Open Source Project, Implement MAC randomization
MAC randomization behaviour
Documents Android MAC randomisation behaviour and default enablement. Referenced in Section 5.4.
RFC 9849, TLS Encrypted Client Hello
Abstract and protocol overview
Defines ECH, which changes the assumption that passive capture can always see the real SNI value. Referenced in Section 5.6.
CompTIA Network+ N10-009 Exam Objectives
Domain 1.0 (Objectives 1.1, 1.4, 1.5) and Domain 4.0 (Security)
Tests DNS, IP, MAC, port knowledge, plus security implications of each identifier.
Identifiers give devices their names and addresses. Module 6 explains how subnetting divides those addresses into local and remote, and why getting the mask wrong can silently break everything.
Module 5 of 45 · Foundations