MAC Address Lookup

Every network interface ships with a 48-bit hardware address, and the first half of it is a prefix its manufacturer bought from the IEEE. This tool looks that prefix up across all four IEEE registries (MA-L, MA-M, MA-S, and the legacy IAB list), so a full address like BC:24:11:7A:92:3D resolves to the organization that registered the block, its country, and the exact range the block covers.

It also decodes what the address itself says: whether it is unicast or multicast, vendor-assigned or locally administered (the tell-tale of randomized Wi-Fi MACs and virtual NICs), whether it is a reserved protocol address such as a VRRP virtual router MAC, and how it converts between colon, hyphen, Cisco dot, and bare-hex notation. Paste a list in bulk mode to identify up to 50 addresses at once.

What is a MAC address?

A MAC (Media Access Control) address is the layer-2 identifier a network interface uses on Ethernet and Wi-Fi. It is 48 bits long, written as twelve hexadecimal digits (BC:24:11:7A:92:3D), and it needs to be unique only within a broadcast domain, unlike an IP address, which identifies the host across networks.

The address splits into two halves. The first 24 bits are the OUI (Organizationally Unique Identifier), assigned by the IEEE Registration Authority to a specific manufacturer; the remaining 24 bits are chosen by that manufacturer per device. Two bits of the first octet carry special meaning:

• The I/G bit (least significant bit of the first octet): 0 means unicast, addressed to one interface; 1 means multicast, addressed to a group. FF:FF:FF:FF:FF:FF, the broadcast address, is the extreme case.
• The U/L bit (second least significant bit): 0 means universally administered, burned in under a vendor OUI; 1 means locally administered, assigned by software. If the second hex digit is 2, 6, A, or E, the address is local and no vendor lookup can succeed.

MA-L, MA-M, MA-S and the IEEE registries

The IEEE sells hardware address space in three block sizes. MA-L (the classic OUI) is a 24-bit prefix covering 16,777,216 addresses; MA-M is a 28-bit prefix covering 1,048,576; MA-S (formerly OUI-36) is a 36-bit prefix covering 4,096, aimed at small-volume manufacturers. A fourth list, the IAB registry, was closed when MA-S replaced it in 2014, but its assignments remain valid and still show up on real hardware, so this tool searches it too.

Smaller blocks nest inside OUIs held by the IEEE Registration Authority itself, which is why a correct lookup must match the longest prefix first: 70:B3:D5 belongs to the Registration Authority, but 70:B3:D5:A resolved nine digits deep can belong to a specific company. Registrants can also pay to keep their name and address confidential. Those blocks show up here as private registrations rather than as an unknown vendor.

Randomized MACs: why lookups come back empty

The most common reason a MAC lookup finds no vendor is that the address was never a vendor’s to begin with. iOS 14+, Android 10+, and Windows 10 1903+ all default to MAC randomization on Wi-Fi: the device generates a fresh locally-administered address per network (Apple calls it a "private Wi-Fi address") so that its real hardware address cannot be tracked across networks. Randomized addresses set the U/L bit, so their second hex digit is always 2, 6, A, or E.

Virtualization does the same thing for different reasons. Hypervisors and container runtimes mint MAC addresses for virtual NICs at creation time, some under real registered OUIs and some in locally-administered space. If you run guest networks, captive portals, or DHCP reservations keyed on MAC addresses, randomization is why the same phone keeps appearing as a new device. This tool flags such addresses explicitly instead of reporting a meaningless "not found".

Reading MAC addresses as a server administrator

On a hosting network, MAC prefixes are a quick fingerprinting tool. Proxmox VE 8.1+ gives VM NICs its registered BC:24:11 prefix, VMware uses 00:50:56 and 00:0C:29, Hyper-V uses 00:15:5D, VirtualBox 08:00:27, and Xen 00:16:3E. KVM/QEMU with libvirt conventionally uses 52:54:00 and Docker starts its bridge interfaces with 02:42. Both of those are locally administered, so they identify the platform by convention rather than by IEEE registration. Scanning an ARP table or DHCP lease file with these prefixes in mind tells you immediately which entries are virtual machines and whose.

Some addresses identify a protocol rather than a device. 00:00:5E:00:01:XX is a VRRP (or CARP) virtual router MAC where XX is the router ID; seeing it in a switch table means a failover pair lives there, not a physical NIC. Cisco’s HSRP equivalents sit under 00:00:0C, spanning tree and LLDP use the reserved 01:80:C2 range, and 01:00:5E maps IPv4 multicast groups per RFC 1112.

The tool also derives the Modified EUI-64 interface identifier and fe80:: link-local address a host would autoconfigure from a given MAC (RFC 4291), which is useful when you need to reach a server over IPv6 before any addressing is set up.