MAC Address Lookup
Enter a MAC address to identify its manufacturer via the IEEE OUI database.
Formats accepted: AA:BB:CC:DD:EE:FF · AA-BB-CC-DD-EE-FF · AABBCCDDEEFF
Advertisement · Anuncio
A MAC (Media Access Control) address is a 48-bit hardware identifier permanently assigned to a network interface card during manufacturing. Written as six pairs of hex digits (AA:BB:CC:DD:EE:FF), it operates at Layer 2 (Data Link) of the OSI model. Your router uses ARP to map IP addresses to MAC addresses within the LAN.
The first three octets (24 bits) of a MAC address form the OUI, assigned by the IEEE to manufacturers. This is why looking up "00:1A:2B" reveals the manufacturer — Apple, Cisco, Intel, etc. The remaining three octets are assigned by the manufacturer, making each MAC globally unique in theory.
IP addresses are logical, network-assigned identifiers that change as you move between networks. MAC addresses are hardware-assigned identifiers that by default remain constant. When you connect to WiFi, your MAC is visible to the access point but not to the wider internet — your router substitutes its own MAC when forwarding packets.
MAC spoofing is changing a device's MAC address in software. All major operating systems support it. Modern iOS and Android randomize MAC addresses per WiFi network for privacy. The locally administered bit (second-least-significant bit of the first octet) distinguishes randomly generated MACs from manufacturer-assigned ones.
Network admins use MAC addresses for port security, NAC (Network Access Control), and DHCP reservations. However, MAC-based security is weak alone — spoofing is trivial. It works best as one layer alongside 802.1X authentication and network segmentation.
Can I find a device's location from its MAC address?
No. MAC addresses are only visible on the local network and cannot be traced over the internet.
Why does my phone show a random MAC?
Modern iOS and Android use randomized MACs per network as a privacy feature to prevent tracking.
Are MAC addresses truly unique?
Theoretically yes, but duplicates exist. Uniqueness is only required within a local network segment.
Expert guide · MAC Address Lookup
What it does
MAC Lookup normalizes whatever MAC notation you paste (colons, dashes, Cisco dotted or bare hex), keeps the first 24 bits, the Organizationally Unique Identifier, and resolves it against a vendor database built from the IEEE Registration Authority's public listings. It returns the OUI prefix, the registered manufacturer name and the address you entered, or 'Unknown (OUI not found)' when the prefix has no public registration.
Why it matters
- Rogue device hunting: An unknown entry in the switch CAM table whose OUI resolves to a consumer router brand on a corporate VLAN points to an unauthorized access point
- DHCP lease review: Identifying vendors in the lease table separates printers, IP phones and IoT cameras from laptops before writing NAC or VLAN policies
- Wireless troubleshooting: Knowing that a misbehaving client uses a specific chipset vendor speeds up driver and firmware investigations
- Forensics and asset tracking: Vendor names in ARP caches and firewall logs help map which hardware was present during an incident
- Spotting randomization: A result of 'not found' for a phone is usually a privacy-randomized address, which changes how you build MAC-based allow-lists
How to read the results
- OUI Prefix: The first three octets in XX:XX:XX form, the only part of the address used for the lookup
- Vendor / Manufacturer: The organization that registered the prefix with the IEEE; it may be the chipset or NIC maker rather than the brand on the device
- Vendor 'IEEE Registration Authority': The prefix is shared by many small MA-M or MA-S assignees; the remaining bits identify the real company
- Unknown (OUI not found): Usually a locally administered or randomized address, or an unregistered prefix used in a lab or virtual environment
- Full MAC Address: Echo of your input for reference; the device-specific lower 24 bits are not looked up
Technical background
A MAC address, formally an EUI-48, is a 48-bit identifier defined by IEEE 802 and written as six octets, for example 3C:22:FB:9A:41:07. The IEEE Registration Authority sells blocks of these addresses. The classic assignment, now called MA-L (MAC Address Block Large), gives an organization a 24-bit OUI and the 16.7 million addresses beneath it. Smaller organizations can buy MA-M (28-bit prefix, about one million addresses) or MA-S (36-bit prefix, 4,096 addresses). Those smaller blocks are carved out of OUIs held by the IEEE itself, which is why a 24-bit lookup sometimes returns 'IEEE Registration Authority' and you need the longer prefix to find the actual company. The public registries are downloadable as oui.csv, mam.csv and oui36.csv from the IEEE.
Two bits in the first octet change the meaning of the whole address. The least significant bit (I/G) marks a group address: 01:00:5E:xx:xx:xx is IPv4 multicast and FF:FF:FF:FF:FF:FF is broadcast. The second least significant bit (U/L) marks a locally administered address that was not assigned by the IEEE. You can spot it in the second hex digit: if it is 2, 6, A or E (for example x2:, xA:), the address is local. IEEE 802c-2017 further divides the local space into quadrants, and the block registered for organizations that want local addresses is called a CID (Company ID).
Locally administered addresses are now everywhere because of privacy randomization. iOS 14 and later use a Private Wi-Fi Address per network, Android 10 and later randomize per SSID by default, and Windows 10 and 11 offer Random hardware addresses per network. These addresses set the U/L bit, so they never match an IEEE OUI and a vendor lookup correctly returns nothing. Hypervisors and containers also use well-known prefixes; VMware, Hyper-V, VirtualBox and KVM/QEMU each have their own (52:54:00 for QEMU is itself locally administered), so a lookup is a quick way to tell a VM from bare metal on a flat network.
Keep the limits in mind. A MAC address is only visible inside its own layer-2 broadcast domain; routers rewrite it at every hop, so a website or remote server never sees your device's MAC. Addresses are trivially changed in software (ip link set dev eth0 address, or the adapter's Network Address property in Windows), so MAC-based access control is an inventory aid rather than a security boundary. For real admission control, pair it with 802.1X authentication. IPv6 used to embed MACs in modified EUI-64 interface IDs (RFC 4291), exposing hardware identity across networks; modern systems use stable private (RFC 7217) or temporary (RFC 8981) identifiers instead.
Common errors and how to fix them
- Problem An iPhone or Android phone returns 'Unknown (OUI not found)'.
- Fix The device is using a randomized, locally administered address (second hex digit 2, 6, A or E). This is expected. To see the real address for inventory, disable Private Wi-Fi Address or MAC randomization for that SSID, or identify the device through 802.1X or MDM instead.
- Problem The vendor shown is a chipset maker, not the laptop or camera brand.
- Fix Many products ship with network modules from Intel, Realtek, Espressif, Murata and similar suppliers, and the OUI belongs to the module maker. Combine the vendor with DHCP hostname, option 55 fingerprints or LLDP data to identify the end product.
- Problem The result says 'IEEE Registration Authority'.
- Fix The prefix is subdivided into MA-M or MA-S blocks. Look up the first 28 or 36 bits in the IEEE mam.csv or oui36.csv listings to find the actual assignee.
- Problem A MAC-based allow-list keeps breaking after phone or laptop updates.
- Fix Operating systems now rotate addresses per network and sometimes periodically. Replace MAC allow-lists with 802.1X (WPA2/WPA3-Enterprise) or certificate-based onboarding, or require users to disable randomization only for that trusted SSID.
- Problem Lookup of a MAC seen in a remote server or website log fails or looks wrong.
- Fix MAC addresses do not cross routers; a remote log only contains the MAC of the last-hop router or gateway. Search for MACs in your own switch, DHCP or wireless controller logs within the same layer-2 segment.
Do it from the command line
macOS
# MAC addresses of neighbours on the local network
arp -a
# Hardware address of each interface
networksetup -listallhardwareports
# Address currently in use on Wi-Fi (may be private/randomized)
ifconfig en0 | grep etherWindows
# Adapters and their physical addresses
getmac /v /fo list
# Neighbour (ARP) table
arp -a
# PowerShell view
Get-NetAdapter | Select-Object Name, MacAddress, StatusLinux
# Interface MAC addresses
ip -br link
# Neighbour table with MACs
ip neigh show
# Offline OUI lookup (ieee-data package on Debian/Ubuntu)
grep -i '^3C-22-FB' /usr/share/ieee-data/oui.txtMore questions about MAC Address Lookup
What is an OUI in a MAC address?
The Organizationally Unique Identifier is the first 24 bits, or first three octets, of a MAC address, assigned by the IEEE Registration Authority to a manufacturer. In 00:1A:11:3F:22:9C the OUI is 00:1A:11. The remaining 24 bits are assigned by the manufacturer to individual network interfaces, which is why only the OUI identifies the vendor.
Why does my phone show a different MAC address on each Wi-Fi network?
iOS, Android and Windows randomize the MAC per network to stop Wi-Fi hotspots and retailers from tracking devices across locations. The random address sets the locally administered bit, so it never matches a manufacturer. You can turn it off per network in Wi-Fi settings if a captive portal or router reservation needs a stable address.
Can a website see my MAC address?
No. MAC addresses are only used within the local layer-2 network, and every router replaces them with its own when forwarding packets. Websites see your public IP address, browser headers and other fingerprints, but never your device's hardware address. Only devices on the same Wi-Fi or switch segment, such as your router, can observe it.
How can I tell if a MAC address is randomized or locally administered?
Look at the second hexadecimal character of the first octet. If it is 2, 6, A or E, the locally administered bit is set and the address was not assigned by a manufacturer, for example DA:A1:19:xx:xx:xx. Randomized phone and laptop addresses always fall in this group.
Can MAC addresses be spoofed?
Yes, easily. Linux uses ip link set dev eth0 address, macOS uses ifconfig ether, and Windows exposes a Network Address setting in the adapter's advanced properties. Because of this, MAC filtering should never be the only access control on a network; use 802.1X authentication for real enforcement.