How to identify one user by MAC Address

one simple question. I assume, that the MAC Address is stored in the IP packets, even when the IP packet is received by the host at the other end. I do know that the IP Address can be changed using a VPN service. But what is about the MAC Address? Is it possible to identify one user using the MAC comparing even when the IP address changes?


Every packet is encapsulated in a frame, which has both a source and destination MAC address.

Both the source and the destination MAC addresses are removed once it crosses out of the local broadcast domain (moves across a router), and are replaced with the appropriate addresses in the next broadcast domain.

In most cases, this means that the MAC will be changed many times along the way.

Source: https://arstechnica.com/civis/viewtopic.php?t=318213

So, to answer your question, yes and no. It should be achievable if the network is fairly flat - i.e. any device on a switch/switches within the same subnet. The moment a router has to do any traversing of packets outside of the broadcast domain the source and destination devices are then the packets will have their source and destination headers changed by the router so that it becomes the source and the next hop becomes the destination.


I assume, that the MAC Address is stored in the IP packets, even when the IP packet recieves by the host at the other end.

No, that's an incorrect assumption.

They have the opposite relationship. The MAC layer works under IP – so the IP packets are actually stored within the MAC frame, not the other way around.

The MAC layer has a narrower scope: it deals with the local link (medium) between two devices, such as a single Ethernet/WiFi subnet. When packets travel through routers, they travel from one link to another to yet another, and receive a different MAC header on every hop. (Some links are point-to-point and don't even have MAC-layer addresses.)

And of course, on your everyday PCs attached to Ethernet/WiFi networks, the user has full control of their MAC address and can change it everyday. (Recent operating systems, even mobile ones, have begun to randomize the MAC addresses automatically – specifically to prevent tracking.)