MAC Address Vendor (OUI) Lookup

What a MAC address tells you

Every network interface has a 48-bit MAC address split in two halves. The first 24 bits (OUI — Organizationally Unique Identifier) identify the manufacturer. The IEEE assigns these. The second 24 bits are the per-device serial within that manufacturer.

Example: 00:50:56:AB:CD:EF — the OUI 00:50:56 is registered to VMware, Inc. So this MAC is a VMware virtual NIC.

Why this matters in practice

• DHCP table analysis — looking at your router's DHCP leases and identifying which devices are which.
• Wi-Fi audit — seeing what's connecting (or attempting to connect) to your network.
• Inventory — large networks use OUI lookups to auto-classify devices by vendor.
• Forensics — packet captures contain MACs; OUIs help identify what generated traffic.

Local vs universal MACs

The second-least-significant bit of the first byte indicates if a MAC is locally administered (set by software, e.g. for privacy) or universally administered (assigned by IEEE). If it's set, the OUI isn't an IEEE-registered vendor — common with modern phones and laptops doing MAC randomization.

Why MAC vendor lookups matter

A MAC address (Media Access Control address) is a 48-bit identifier assigned to a network interface at manufacture time. The first three bytes identify the manufacturer — this portion is called the Organizationally Unique Identifier (OUI), and it's assigned by the IEEE. The last three bytes are chosen by the manufacturer to be unique within their allocated block.

Because the OUI is standardized, you can look up a manufacturer from just the first three bytes of a MAC address. This turns out to be practically useful in a bunch of situations, mostly involving figuring out what devices are on a network you don't fully control.

When I use this in real work

Identifying unknown devices on a customer's network

Every customer network I inherit has a handful of devices nobody remembers. They show up in the DHCP lease table or the switch's MAC address table with a name like DESKTOP-A8F2B or no name at all, and nobody can tell me what they are. Running the MAC through a vendor lookup usually gives me a strong hint — Espressif Inc. means it's an ESP-based IoT device (smart plug, smart bulb, sensor). Hikvision means it's a security camera. Nintendo means it's a game console someone plugged in without asking. Apple, Inc. could be many things but at least tells me it's an Apple product.

This narrows down what a device probably is much faster than trying to fingerprint it via port scanning or waiting for it to make an obvious network request. When I'm auditing a network for security purposes, unknown devices are the highest priority, and vendor lookup is the first triage step.

Finding rogue devices

Every once in a while someone plugs a personal router into a corporate network — usually not maliciously, just because they want stronger WiFi at their desk. This creates a whole host of problems: the personal router might hand out IP addresses to devices on the corporate network, might route traffic in unexpected ways, might introduce a new attack surface. A MAC vendor lookup will flag it as a NETGEAR, Inc., ASUSTek Computer, or TP-LINK Technologies device, which is a fast signal.

Correlating devices across access points

When a mobile device moves between WiFi access points, its MAC address (usually) stays the same. In an audit or investigation, the MAC lets you follow a specific device's movement across the network. The vendor identification helps you understand what kind of device you're tracking — a phone, a laptop, a tablet, an IoT gadget.

Modern phones increasingly randomize their MAC addresses per network to protect against this kind of tracking. iOS enables this by default; Android has a per-network setting. So the MAC vendor lookup on modern mobile devices usually returns a private/randomized indicator rather than a real vendor.

Confirming warranty and support paths

If a customer needs support on a specific device but can't identify the model, the MAC lets me determine at least the manufacturer, which narrows down whose support portal to call. This isn't the primary use of MAC lookups but it's a nice side benefit.

The OUI database, briefly

The IEEE maintains the master OUI database. It's publicly available and gets updated as new OUIs are assigned. Any tool that does MAC vendor lookup is ultimately querying (a copy of) this data.

OUIs are typically assigned in blocks of one 24-bit prefix per manufacturer, which gives each manufacturer 16.7 million unique MAC addresses. Large manufacturers hold many OUIs because they've long since exhausted individual blocks. Apple, for example, has dozens of OUIs. Cisco has hundreds. Small manufacturers might share an OUI through the IEEE's MA-M (Medium) or MA-S (Small) programs, which subdivide a single OUI among multiple companies.

Randomized and private MAC addresses

Modern operating systems increasingly use randomized MACs to prevent cross-network tracking. When your phone joins a WiFi network, iOS and Android often generate a fresh MAC just for that network rather than exposing the hardware address. The randomized MAC has a specific bit pattern that identifies it as locally-administered (the second-least-significant bit of the first byte is set to 1), which is how vendor lookup tools recognize it as randomized rather than trying to find a manufacturer.

Randomized MACs by design don't have vendor information. A MAC vendor lookup on a randomized address returns something like "Locally Administered" or "Private" rather than a manufacturer name. If you see a lot of these in your network logs, that's just modern phones and laptops being modern phones and laptops.

How to tell if a MAC is randomized

Look at the first byte. If the second-least-significant bit (the "locally administered" bit) is 1, the MAC is administratively assigned rather than manufacturer-assigned. Common patterns for randomized MACs start with 02:, 06:, 0A:, 0E:, and other values where the low nibble of the first byte has the LA bit set. Vendor lookup tools recognize this pattern and report it appropriately.

MAC address formats

MAC addresses appear in a few different formats depending on where you're looking:

• Colon-separated hex: aa:bb:cc:dd:ee:ff — the Linux and Unix convention.
• Hyphen-separated hex: aa-bb-cc-dd-ee-ff — the Windows convention.
• Dot-separated groups: aabb.ccdd.eeff — the Cisco convention.
• No separator: aabbccddeeff — common in raw packet captures and some APIs.

All represent the same 48-bit value. This tool accepts all these formats and normalizes on input.

Common questions

"Can I change my MAC address?"

Yes, and modern operating systems increasingly do it automatically per-network for privacy. On most systems you can also override the MAC manually if you need to. Some corporate networks tie access to specific MACs (MAC-based authentication), and changing your MAC there will break access. Some ISPs also tie DHCP leases to the modem's MAC — but usually you're not the one setting that.

"Is a MAC address globally unique?"

Manufacturer-assigned MACs are supposed to be. Each manufacturer's OUI block gives them 16.7 million addresses to assign, and they're expected to not repeat within their own manufacturing. In practice, there have been occasional cases of duplicate MACs shipped from a single manufacturer — usually recalled or fixed with firmware updates. Locally-administered MACs (randomized ones, or manually set ones) are not globally unique by design.

"Can I geolocate a MAC address?"

Only in a very limited sense. Some databases correlate MAC addresses observed by wardriving with geographic locations, and services like Google's Location Services use nearby WiFi access point MACs to determine your location. But you can't turn "I have this MAC" into "this device is at this address" through any public tool. The correlation requires being physically nearby to observe the AP's broadcasts.

"Why do WiFi networks show a different MAC than the physical hardware?"

Modern iOS and Android generate randomized MACs per-network for privacy. The MAC you see on the WiFi network is the randomized one; the hardware MAC is a separate value stored in the device firmware and never exposed on the network.

Related tools

If you're auditing a device you've identified via MAC lookup, the next step is usually a network-level look at what it's doing. The IP Lookup tool can identify the ISP and geolocation for any public IP the device connects to, which sometimes helps clarify what service it's talking to.

For understanding the addressing on your network more broadly, the Subnet Calculator and CIDR Range Tool help visualize which devices belong to which network segments.

Privacy of MAC lookups

MAC address lookups run entirely against a database that's cached in the browser. Nothing you paste is sent to a third party. Privately-administered (randomized) MACs don't produce a vendor result — they're not looked up externally, just identified locally as randomized. The tool works offline once the data is cached.