为何仅在镜像端口或作为网络管理员时可获取远程主机MAC地址？

Great question—this gets right to the core of how switched Ethernet networks function, which is super foundational for penetration testing. Let’s break this down clearly:

First, Why Regular Ports Can’t Grab Remote MACs #

Switches are the main reason you can’t just sniff MAC addresses from any spot on the network:

• Switch Forwarding Logic: Unlike old-school hubs that flood every packet to every port, modern switches use a MAC address table to route traffic efficiently. When a frame comes in, the switch checks the destination MAC, looks up which port that device is connected to, and sends the frame only to that port. Unless the switch doesn’t know the destination MAC (a rare scenario for active devices), it won’t send traffic from a remote host to your non-mirrored port. So you’ll never see frames from a remote device that aren’t explicitly meant for your capture machine.
• ARP’s Unicast Response: You might think ARP requests (which broadcast "who has this IP address?") would reveal remote MACs, but ARP responses are unicast—they only go back to the device that sent the original request. So unless you’re the one sending the ARP query to the remote host (and even then, you only get its MAC in the response sent directly to you), you won’t capture that traffic on a regular port.

Why Mirror Ports (SPAN Ports) Work #

Mirror ports are purpose-built to solve this visibility problem:

• Traffic Replication: A mirror port (often called a SPAN port, short for Switch Port Analyzer) is configured to copy all traffic from specified target ports or VLANs and send that duplicate traffic to the mirror port. This includes every frame going to or from the remote host—even traffic that’s not destined for your capture device. That means you’ll see the full Ethernet header, which contains the remote host’s MAC address.
• Pen Testing & Admin Use Case: This is why network admins and pen testers rely on mirror ports: they let you monitor traffic across parts of the network without disrupting normal operations, giving you visibility into devices that aren’t communicating directly with your capture machine.

To wrap it up: Regular ports only receive traffic intended for your device, but mirror ports are designed to replicate all specified network traffic—so you can capture MAC addresses (and other frame-level data) from remote hosts that would otherwise be invisible to you.

内容的提问来源于stack exchange，提问作者rjkrsngh