MAC Address Lookup
Identify the manufacturer (OUI) of any MAC address from the IEEE registry.
The Unknown Device on Your Network — Starting the Investigation
You pull up your router's connected devices list and see a device with an unfamiliar hostname — or worse, no hostname at all. It has an IP in your DHCP range and a MAC address. That MAC address is the starting point for identification. The first three bytes (the Organizationally Unique Identifier, or OUI) are assigned by IEEE to the hardware manufacturer and reveal which company made the network interface in the device. E4:5F:01:xx:xx:xx is Raspberry Pi Trading Ltd. A8:96:75:xx:xx:xx is Apple. 00:50:56:xx:xx:xx is VMware (a virtual machine). The manufacturer identification alone often narrows down whether the mystery device is a smart home gadget, a phone, a laptop, or a network device that should not be there.
The Anatomy of a MAC Address
A MAC (Media Access Control) address is a 48-bit hardware identifier assigned to a network interface. It is written as six colon-separated or hyphen-separated byte pairs: AA:BB:CC:DD:EE:FF.
- Bytes 1–3 (OUI): assigned by IEEE to the manufacturer. Over 36,000 OUIs are registered as of 2024.
- Bytes 4–6 (NIC-specific): assigned by the manufacturer. These can be sequential (making MAC addresses somewhat predictable for hardware enumeration) or randomized.
- Bit 1 of byte 1 (LSB, the "multicast" bit): if 1, the address is a multicast or broadcast address. Normal unicast device addresses have this bit set to 0.
- Bit 2 of byte 1 (the "local" bit): if 1, the address is locally administered — either manually configured or randomly generated. Manufacturer-assigned (burned-in) addresses have this bit set to 0.
Randomized MAC Addresses — Why Your Lookup Returns Nothing
Since iOS 14 (2020), Android 10 (2019), and Windows 10 20H2 (2020), mobile devices and laptops use randomized MAC addresses by default for privacy. The randomization goal is to prevent tracking across networks — a consistent MAC allows building a location history as the device connects to different networks or is observed by passive scanners.
Randomized MACs set the locally administered bit (bit 2 of byte 1), which makes them identifiable as random. The OUI for a randomized MAC is not registered with IEEE and a lookup returns "unknown" or "locally administered." If you see this result, the device is almost certainly a modern smartphone, laptop, or tablet using the privacy feature — not necessarily a rogue device.
To see the real (burned-in) MAC of a device: on iPhone, go to Settings → Wi-Fi → tap the network → toggle off "Private Wi-Fi Address." On Android, similar settings in Wi-Fi → network details. Once connected with the real MAC, the OUI lookup will return the manufacturer.
MAC Addresses in Network Security
MAC filtering (allow/deny by MAC address) is a widely deployed but weak security control. Because MACs are transmitted in plaintext in every Ethernet frame and 802.11 WiFi packet, an attacker with a passive wireless adapter can observe the MACs of legitimate devices on the network and clone one — MAC spoofing takes about 10 seconds. MAC filtering stops untargeted casual intrusions, not anyone who has observed your network traffic. It remains useful for authorized device inventories and network documentation, but should not be relied on as a primary access control.
How to Use This Tool
- Paste a MAC address in any standard format:
AA:BB:CC:DD:EE:FF,AA-BB-CC-DD-EE-FF, orAABBCCDDEEFF. - The tool extracts the OUI, looks it up against the IEEE registry, and displays the vendor name and address.
- The locally-administered bit is flagged if detected, indicating a randomized or manually configured MAC.
◇ FAQ
01 Why does my device return "locally administered" instead of a vendor name? +
Modern iOS, Android, Windows, and macOS devices randomize their MAC addresses by default for privacy. The randomized MAC has the locally administered bit set, which makes it identifiable as non-manufacturer-assigned. There is no OUI registration for random addresses. Disable "private WiFi address" in your device's network settings to restore the burned-in MAC.
02 Can MAC addresses be spoofed? +
Yes — trivially, in about 10 seconds, on any operating system. On Linux: ip link set dev eth0 address AA:BB:CC:DD:EE:FF. On macOS: ifconfig en0 ether AA:BB:CC:DD:EE:FF. On Windows: through Device Manager or registry. This is why MAC filtering is not a strong security control — it stops untargeted intrusions but not anyone who has passively observed your network.
03 How often is the IEEE OUI database updated? +
IEEE updates the OUI registry several times per week as new assignments are made. The bundled snapshot used by this tool is periodically refreshed. Very new vendor assignments (registered in the past few months) may not appear in the bundled data.
04 What is the difference between an OUI-24 and an OUI-28/OUI-36? +
The standard OUI is 24 bits (3 bytes), supporting 16 million unique device addresses per assignment. IEEE also issues MA-M (Medium) assignments using 28 bits and MA-S (Small) using 36 bits for manufacturers that need fewer unique addresses. Small assignments cover 4,096 devices rather than 16 million. OUI-28 and OUI-36 assignments appear in the same lookup table and are resolved correctly.
