What Is a MAC Address and What Is Its Evidential Value? MAC, IP and Port Records in Offences Committed via Wi-Fi
Last updated: 17.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer
Short answer: A MAC address is a 48-bit network interface identifier assigned to the Wi-Fi, Ethernet or Bluetooth card in a phone or computer. It is visible only on the local network (a modem, an institutional network, café or hotel Wi-Fi); in traffic going out to the internet it does not reach the website and, in most cases, does not reach the internet service provider either. For this reason, the MAC address is strong supporting evidence that helps to narrow down the device making the connection in the access logs of the local network. However, since it can be changed by software and, on modern phones, may be randomly generated under the default settings, it does not on its own conclusively identify the perpetrator. The Court of Cassation accepts that an IP address alone is not sufficient for a conviction and that it must be supported by port, MAC and device examination.
What Is a MAC Address, and How Does It Differ from an IP Address?
A MAC (Media Access Control) address is the hardware address by which a network card identifies itself on the local network, and it is usually written in the form AA:BB:CC:11:22:33. The first half usually indicates the manufacturer. A phone may have more than one MAC address: one for Wi-Fi, one for Bluetooth and, if present, another for Ethernet.
An IP address, by contrast, is the logical address used when going out to the internet. The modem in your home receives a public IP from the internet service provider, and all devices in the home share this single IP. The devices behind the modem are distinguished from one another by internal IP and MAC addresses. Consequently, the IP address appearing in a website's log often indicates not a person but a subscription, modem or network. We have discussed this topic in detail in our article Are IP Address and CGNAT Records Evidence?.
| Identifier | What does it show? | Where is it recorded? | Can it be changed? |
|---|---|---|---|
| Public IP + port | The subscription / modem; where CGNAT is used, the user via the port | Access provider (traffic data under Law No. 5651), website/application logs | IP is dynamic; can be concealed with a VPN or proxy |
| Internal IP | The device on the local network | DHCP records of the modem/network device | May change with each connection |
| MAC address | The network interface connecting to the local network | Access logs of modems, institutional networks, hotel/café Wi-Fi | Yes: random MAC and MAC spoofing |
| IMEI | The device on the cellular network | Mobile operator records (HTS/base station) | Changing it without the authorisation of the Information and Communication Technologies Authority (BTK) is prohibited (Law No. 5809, Article 55; Article 63(9): a judicial fine of one thousand to fifteen thousand days); cases of cloning occur |
How many bits is a MAC address, what is a random MAC, and can it be changed?
- How many bits? A MAC address is 48 bits (6 bytes) long and is written as 12 hexadecimal digits.
- What is a random MAC? It means that the device connects to a Wi-Fi network with a software-generated address instead of its real hardware address.
- Can it be changed? Yes; the address reported to the network can be changed through the settings or by software.
How Does a MAC Address Come Up in a Criminal Case File?
Since a MAC address is not carried over the internet, it is not possible for the prosecutor's office to obtain a MAC address from a social media company or a bank. MAC data is obtained from the logs of the local network through which the connection was made: the DHCP and connection history of a home modem, the network management system of a company or school, and the access logs of shared Wi-Fi in places such as cafés, hotels and shopping centres. The Regulation on Internet Mass Use Providers (İnternet Toplu Kullanım Sağlayıcıları Hakkında Yönetmelik), which is based on Law No. 5651 on the Regulation of Internet Publications, expressly lists the MAC address when defining the access logs that mass use providers must keep:
Regulation on Internet Mass Use Providers – Article 3(1)(e) and Article 4(1)(b)
e) Access logs: information showing the IP address details distributed within their own internal networks, the start and end time of use and the unique network device number (MAC address) of the computers using these IP addresses, the destination IP address, and, in internet access services provided by the method of sharing one or more IP addresses among users through ports, the real IP and port information allocated to the user,
b) To record access logs in their own systems in electronic form and to retain them for two years.
The traffic data kept by access providers (internet service providers), on the other hand, is defined differently in the Law and does not include the MAC address:
Law No. 5651 – Article 2(1)(j) and Article 6(1)(b)
j) (Amended: 26/2/2014-6527/15 art.; further amended by 29/7/2020-7253/1 art. and 24/7/2026-7590/27 art.) Traffic data: the IP addresses of the parties, source and destination port information, the start and end time of the service provided, the type of service used, the amount of data transferred and, if available, subscriber identity information,
b) To retain the traffic data specified in the regulation relating to the services it provides for the period to be determined in the regulation, being not less than six months and not more than two years, and to ensure the accuracy, integrity and confidentiality of such data,
The words “source and destination” in the definition were added by Law No. 7590 dated 24.07.2026; the MAC address, however, is still not included in the definition. Since the provision of the 2007 regulation that set the retention period was annulled by the Council of State (Danıştay), a request for records from the access provider should be made early. Mass use providers that offer internet access to people at a particular place (cafés, hotels), on the other hand, keep access logs and retain them for two years pursuant to Article 7 of Law No. 5651.
Important information: By Law No. 7590, adopted on 24.07.2026, many duties under Law No. 5651 have been transferred to the Cyber Security Directorate (Siber Güvenlik Başkanlığı); the obligations of access providers to deliver and report traffic records are now owed to the Directorate. The 2017 regulation on mass use providers, however, has not yet been adapted to this amendment and retains its references to the BTK and to local civil administrators (mülki idare amirleri). Moreover, with operators that use CGNAT (carrier-grade address sharing), a large number of subscribers use the same public IP at the same time. In this case, without source port information and a timestamp accurate to the second, identification by IP does not point to a single subscriber.
How Does the Court of Cassation Approach the MAC Address and Port Identification?
In offences committed over the internet, the Court of Cassation regards rendering a judgment solely by looking at the subscriber of the IP address as incomplete investigation, and requires that local network logs and MAC and port information be investigated. In a decision concerning a complaint amounting to false accusation (iftira) made via BİMER, the former name of CİMER (Presidential Communication Centre), the Chamber required that it be determined by means of the MAC address from which computer the complaint coming from a school network had been made:
... without taking into account that, by writing to ... Primary School, which is under an obligation to keep logs pursuant to Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications, and to the Information and Communication Technologies Authority, it should have been established from the internet provider company, from IP number ..., from the computer with which MAC address a login was made on the date ... at ... to file the complaint with Bimer, and it should have been asked ... whether this computer had a usage password and to whom it was allocated, and the legal status of the defendant determined and assessed according to the outcome, establishing the judgment in the written manner with incomplete investigation is contrary to the Law, ...
— Court of Cassation, 16th Criminal Chamber, E. 2015/6859, K. 2016/1871, 25.03.2016
... without taking into account that the defendant's legal status should have been assessed according to the outcome after establishing whether others could access this site with the IP number used by the defendant and how access could be achieved, identifying the computers that made the access, and determining whether the line was open to the outside and whether access by others was possible through the computer with that IP number by breaking its password via the internet, whether there was a multiple IP and, in the case of a multiple IP, determining the PORT and MAC numbers from Türk Telekom and obtaining, from a board of experts composed of specialists in the functioning of information systems, a detailed report enabling review, establishing the judgment in the written manner as a result of incomplete investigation has necessitated reversal, ...
— Court of Cassation, 2nd Criminal Chamber, E. 2016/14786, K. 2018/15164, 11.12.2018
A technical note: the access provider, as a rule, cannot see the MAC address of the phone or computer behind the subscriber; at most it knows the identity of the modem it supplied itself. Device-level MAC information is mostly obtained from the modem itself or from the local network administrator. For this reason, the board of experts should be asked to explain where and by which method the record was obtained.
... since, even if there is only an internet subscriber at the address identified using the IP number, a conviction cannot be rendered against that person solely on the basis of the IP number unless that person confesses or it is supported by other evidence, in such cases a search should be carried out at the address, devices such as computers, or tablets and smartphones having the characteristics of a computer, should be identified, and a content search of these devices should be carried out pursuant to Article 134 of the CCP ...
— Court of Cassation, 2nd Criminal Chamber, E. 2020/18709, K. 2021/12418, 16.06.2021
The conviction of a defendant who argued that others also used the password-free internet connection at his workplace was reversed as follows:
"... since it could not be determined whether other users had also connected to the internet through the internet line, rendering a decision in the written manner convicting the defendant instead of acquitting him, without taking into account that there was no conclusive and convincing evidence, free from all doubt, sufficient for his conviction of the offence charged, has been found contrary to law."
Court of Cassation, 8th Criminal Chamber, E. 2020/17644, K. 2023/417, 09.02.2023
How Do Random MAC Addresses and MAC Spoofing Affect Evidential Value?
For privacy purposes, current versions of iOS, Android and Windows can connect to each Wi-Fi network with a randomly generated MAC address that differs from the device's real hardware address. On the iPhone this feature is called “Private Wi-Fi Address” and on Android “random MAC”, and on many devices it may come enabled by default. In addition, the MAC address can be changed with simple software so as to imitate that of another device (MAC spoofing).
For this reason, statements frequently encountered on the internet such as “the link between the IMEI and the MAC address is fixed” or “the MAC address conclusively identifies the perpetrator” are not technically correct. As a rule, operator records do not match the IMEI with the Wi-Fi MAC address; the two identifiers can only be linked by showing that they belong to the same device when the device is seized and examined. This, in turn, can only be done by a judge's decision under Article 134 CCP or, where delay would be prejudicial, by a decision of the public prosecutor; the prosecutor's decision is submitted to a judge for approval within twenty-four hours, and if it is not approved, the copies obtained are destroyed immediately.
- If the MAC evidence is strong: If the log record was obtained with its integrity preserved (by hash), the timestamp matches the website record to the second, and the seized device contains a connection record for the same network.
- If the MAC evidence is weak: If the network has no password or the password has been shared with many people, random MAC is enabled on the device, the record consists merely of a screenshot, or the modem clock is wrong.
- In any case: The MAC address must be evaluated together with HTS records (historical traffic search – call detail records), device examination, witnesses and other evidence. To identify the actual user of a line, the HTS record is also decisive in most case files.
Note on Article 134 CCP: The examination of the MAC address and connection history on a device is subject to Article 134 CCP. By its decision E. 2023/128, K. 2026/36 (12.02.2026), the Constitutional Court annulled Article 134 CCP in its entirety. The decision was published in the Official Gazette dated 25.05.2026 and numbered 33264, and the annulment will enter into force on 25.02.2027; until that date, the article remains applicable. As of 14.10.2026, no new legislation has been enacted. For details, see the text of Article 134 CCP.
How Is a Defence Built If an Offence Was Committed from a Shared Wi-Fi Network?
- Establish the structure of the network: Was the modem password-protected, who had the password, was the guest network enabled, were other devices connected at the same time?
- Question the source of the record: From whom, on what date and by what method was the MAC information obtained? Are the raw log and hash value in the case file?
- Match the times: Are the time zones and seconds in the website, access provider and modem records consistent with one another?
- Request the port information: Where CGNAT is used, subscriber identification made without the source port may point to the wrong person.
- Obtain an expert opinion: Pursuant to Article 67(6) CCP, a technical opinion may be submitted against the expert report.
For the role of MAC and IP evidence in offences of accessing information systems and data offences, see the article text on the offence of accessing an information system under Article 243 TPC, and, for cases of unauthorised access to bank accounts, our article on fraud through the use of information systems.
Through Which Steps Is MAC Evidence Assessed in Court?
As a rule, a MAC record acquires evidential value when it is verified through the following steps and combined with other evidence:
- Source: It is determined from which network (home modem, institutional network, café or hotel) the record was obtained.
- Integrity: The raw record, the official record of the procedure (tutanak) and the hash value are requested; a screenshot is not sufficient.
- Time and port: The IP, source port and second in the website record are matched against the access provider and local network records.
- Network structure: The characteristics of the modem, the password and whether other users connected to it are inquired into (Court of Cassation, 8th Criminal Chamber, E. 2019/19020, K. 2020/10577, 27.02.2020).
- Device examination: The connection record and MAC setting on the device are examined under Article 134 CCP; a copy of the backup is given to the suspect or to their legal representative.
- Expert and other evidence: An expert opinion is submitted; the record is assessed together with the other evidence, and any doubt benefits the defendant.
Challenging MAC and Network Records with an Istanbul Cybercrime Lawyer
In case files based on MAC and network records, the outcome is often determined by three points: the source of the record, whether the timestamp matches the port information, and whether a device examination is requested early. Av. Coşkun Genç Law Office provides legal support in Istanbul at the stages of preparation before a statement, examination requests and objections to expert reports; as an Istanbul cybercrime lawyer, our aim is to prevent a network record from turning, on its own, into an accusation.
In case files based on IP, port, MAC and device records, the outcome often depends on the correct reading of the technical records. As Coşkun Genç Law Office, we provide defence counsel and legal representation services in Istanbul, particularly at the Anadolu Courthouse (Anadolu Adliyesi) in Kartal and the Istanbul Courthouse (İstanbul Adliyesi), in the field of cybercrimes and digital evidence examination. For an assessment of your case file, you can contact us.
Those wishing to obtain support from an Istanbul cybercrime attorney may request a preliminary assessment through our contact page, together with the summons to give a statement, the indictment or the expert report; for the process, see our article on the cybercrime lawyer.
Sources
- Law No. 5651 on the Regulation of Internet Publications, Articles 2(1)(j), 6(1)(b), 7 (as amended by Law No. 7590) – mevzuat.gov.tr · Art. 6 · Art. 7
- Regulation on Internet Mass Use Providers (Official Gazette 11.04.2017), Articles 3, 4 – mevzuat.gov.tr
- Code of Criminal Procedure (CCP, Law No. 5271), Articles 67, 134 – mevzuat.gov.tr · Art. 134
- Law No. 5809, Articles 55, 63 – mevzuat.gov.tr · Art. 55
- Constitutional Court, E. 2023/128, K. 2026/36, 12.02.2026 (annulment of Article 134 CCP; Official Gazette 25.05.2026, No. 33264; entry into force 25.02.2027)
- Council of State, 13th Chamber, E. 2013/239, K. 2019/4266, 12.12.2019
- Court of Cassation, 16th Criminal Chamber, E. 2015/6859, K. 2016/1871, 25.03.2016
- Court of Cassation, 2nd Criminal Chamber, E. 2016/14786, K. 2018/15164, 11.12.2018
- Court of Cassation, 2nd Criminal Chamber, E. 2020/18709, K. 2021/12418, 16.06.2021
- Court of Cassation, 8th Criminal Chamber, E. 2020/17644, K. 2023/417, 09.02.2023
- Court of Cassation, 8th Criminal Chamber, E. 2019/19020, K. 2020/10577, 27.02.2020
Important: This article is for general information purposes only and does not replace legal advice. For your specific case file, we recommend that the technical records be examined by a cybercrime lawyer and, where necessary, by a specialist expert.