1. Why a Phone Uses a Different MAC Address for Each Wi-Fi Network
Apple's support page explains that devices like the iPhone, iPad, Mac, and Apple Watch use different addresses for each Wi-Fi network. This is because if the same address were used continuously, network providers could easily link the device's movements and location [7]. Android devices use random MAC addresses by default for Wi-Fi connections on version 10 and later [6].
If communication continues even when the name tag changes, there must be a separate "destination" for the communication that is not the name tag. That is the IP address. So, what do these two things refer to?
2. How a MAC Address (Name Tag) and an IP Address (Address) Differ
Let us compare this to a delivery service. The IP address is the "address" of the final destination for the package. The MAC address identifies the device receiving the package on the current part of its journey. However, the analogy and reality differ slightly. The IP standard (RFC 791) distinguishes between "what a name searches for," "where the address is located," and "how the route is taken" [1]. The MAC address is not a "name" but a number used to identify devices within the range connected by the same line.
IPv4 addresses are 32 bits long and are treated as divided into a part indicating the network and a part indicating the device within that network [1]. This is similar to a town name and a house number. However, where the division occurs (the prefix length) is determined by settings and is not fixed [9].
MAC addresses (EUI-48) are 48 bits long. In the MA-L allocation, they are created by adding 24 bits determined by an organization to a 24-bit identifier (OUI) assigned by the IEEE to that organization [2]. Not all addresses follow this structure. For addresses in this allocation, the first half identifies the organization assigned the number range.
3. How a Device Finds the Recipient's MAC Address Inside the Same Network
When sending to a recipient within the same network, the label stuck on the box is the recipient's name tag (MAC address). However, you often only have the recipient's IP address on hand. Therefore, ARP (Address Resolution Protocol) is used. ARP was created to distribute the correspondence between addresses like IP and 48-bit Ethernet addresses as needed [3]. It is a mechanism for asking, "What is the MAC address of the owner of this IP?" within the range connected by the same line.
If the answer is known, you can stick that name tag on and hand over the box. So, what happens when the recipient is in a different town?
4. How a Router Replaces the MAC Address but Keeps the IP Address When Forwarding
This is the most important point of this note. When a router forwards a package, it first removes the link layer header received (the part containing the MAC address destination and source), adjusts the IP header, and attaches a new link layer header for the next recipient [4].
In other words, during the journey, the MAC address changes at each step of the journey. On the other hand, in standard router forwarding, the IP source and destination are maintained [4]. If a home router uses NAT (address translation), the IP is also rewritten. The "adjusted" IP header includes a limit on the number of trips (TTL). Routers discard data when the TTL reaches 0 [4]. This prevents data from looping through the network forever.
If the name tag changes every time, is the name tag itself that is replaced not very important?
5. How Changing MAC Addresses Makes Location Tracking Harder
MAC addresses are sent without encryption. Therefore, Android documentation explains that they can be used for location tracking [6]. In Android, the locally administered bit is set to 1, the unicast (one-to-one destination) bit is set to 0, and the remaining 46 bits are randomized [6]. This means even the part determined by the manufacturer is randomized.
The same idea applies to IP addresses. The method for automatically generating addresses in IPv6 (SLAAC) can include identifiers that do not change over time, which can be used for correlation (linking communications to the same device). Therefore, "temporary addresses" that change over time were proposed to limit the period during which tracking is possible [8]. By the way, IPv6 increased the number of address bits from 32 to 128. While the number of bits is 4 times larger, the total number of addresses is not 4 times larger, but 2 to the power of 96 times larger [5].
6. How to Check Your Phone's Wi-Fi Addresses Yourself
How to Check Your Phone's Wi-Fi Addresses Open the Wi-Fi settings screen on your smartphone and look at the details of the network you are currently connected to. The goal is to check if the name tag is random by looking at the items on the screen. There may be items named "Private Address" or "Random." The display names differ by device, so do not worry if you cannot find them. Just look, and do not change any settings. It is reassuring to look together with an adult.
If you want to read the materials: Apple's support page provides an explanation of Private Wi-Fi addresses [7]. If you use Android, the AOSP documentation summarizes the behavior [6].