Normalising hardware addresses

MAC addresses

Lesson 17 of 20 · 9 min · Module 5: Logs and evidence

A MAC address identifies a network card on the local network. Different vendors write the same 48 bits in different ways.

Start this lesson →

Free. No installation: you write and run the code in your browser, and it is checked automatically.

By the end, you’ll be able to…

Recognise common MAC formats
Normalise data before comparing it
Validate hexadecimal text

The idea

The same address can appear as 52:54:00:12:34:56, 52-54-00-12-34-56, or Cisco-style 5254.0012.3456. Removing the separators leaves 12 hexadecimal digits. int(text, 16) checks that they are valid hex.

raw = "5254.0012.3456"
digits = raw.replace(".", "")
print(digits, len(digits))

01One address, many spellings

Linux prints 52:54:00:12:34:56, Windows 52-54-00-12-34-56, and Cisco switches 5254.0012.3456. Comparing them as raw strings would say they are different devices.

02Normalise, then compare

Strip separators, lowercase, and regroup. After that, two spellings of the same address become identical strings, ready to use as dictionary keys.

print(normalize_mac("52-54-00-AB-CD-EF"))

Output

52:54:00:ab:cd:ef

03The first half names the vendor

The first three bytes (52:54:00 here) are the Organizationally Unique Identifier. Network tools use it to guess who made a device.

Your turn

Write normalize_mac(text) that accepts colons, hyphens, or Cisco-style dots, in any letter case, and returns the address as lowercase pairs separated by colons. Raise ValueError unless the result has exactly 12 hexadecimal digits.

What the checks look for

Normalises colon and hyphen formats
Normalises Cisco-style dots and upper case
Rejects wrong lengths
Rejects non-hex characters

Try it in the editor →

Take this with you

Normalise identifiers into one canonical form before you store or compare them.

Go a little further

Write vendor_prefix(text) that returns the first three bytes in normalised form.