А вот из FAQ выдержка (текст простой, ИМХО, переводить не надо):
How do I interpret MAC address entries in my logs? Why do my logs reflect a 7-byte long MAC address?
The first 6 bytes form the source MAC address, the following 6 bytes form the destination MAC address and the remaining two bytes describe the protocol (most commonly 00:08 which is IP Over Ethernet).