What is an OUI and How Does MAC Address Lookup Identify Vendors?

The System Behind Global Device Identification

When you perform a MAC address lookup and instantly discover that a mysterious device on your network is an Apple iPhone or a Cisco router, you're witnessing the IEEE's Organizationally Unique Identifier (OUI) system in action. This elegant registry, maintained for decades, enables anyone to identify network device manufacturers using just the first half of a MAC address—a capability essential for network management, security monitoring, and troubleshooting.

Understanding OUIs reveals how the networking industry maintains order among billions of devices, prevents addressing conflicts, and creates transparency that benefits administrators and security professionals worldwide.

What Is an OUI (Organizationally Unique Identifier)?

An OUI (Organizationally Unique Identifier) is a 24-bit identifier that forms the first half of a MAC address, uniquely identifying the organization that manufactured the network interface. The IEEE Registration Authority assigns these OUIs to companies, ensuring no two manufacturers receive the same identifier.

The Structure of an OUI

MAC addresses are 48 bits long, divided into two equal parts:

First 24 bits: OUI (Organizationally Unique Identifier)

• Assigned by IEEE to hardware manufacturers
• Uniquely identifies the vendor or organization
• Example: 00:1A:2B might belong to Cisco Systems
• Remains consistent across all devices from that manufacturer

Last 24 bits: Device-Specific Identifier

• Assigned by the manufacturer to individual devices
• Uniquely identifies each specific network interface
• Example: 3C:4D:5E distinguishes this device from others
• Under manufacturer's control to allocate as they choose

Complete MAC Address Example: 00:1A:2B:3C:4D:5E

• OUI: 00:1A:2B (Manufacturer: Cisco Systems)
• Device ID: 3C:4D:5E (Specific device)

This hierarchical structure is similar to phone numbers, where area codes identify geographic regions (like OUIs identify manufacturers) and the remaining digits identify specific subscribers (like device IDs identify specific interfaces).

How Organizations Obtain OUIs

The process for obtaining an OUI involves formal registration with the IEEE:

Step 1: Purchase OUI Block

• Companies apply to the IEEE Registration Authority
• Standard 24-bit OUI costs approximately $3,000 (pricing varies)
• Provides 16,777,216 (2^24) unique MAC addresses
• One-time fee with no recurring costs

Step 2: IEEE Assignment

• IEEE assigns an available OUI from their registry
• Ensures no conflicts with previously assigned OUIs
• Registration becomes part of the public OUI database
• Assignment typically completes within days

Step 3: Manufacturing Integration

• Company programs MAC addresses into device firmware during production
• Each device receives unique address within their OUI block
• Addresses are burned into network interface card (NIC) ROM
• Devices carry these addresses throughout their lifetime

Alternative OUI Options

IEEE offers several OUI variants for different needs:

MA-L (MAC Address Block Large) - Standard OUI

• 24-bit prefix providing 16,777,216 addresses
• Cost: ~$3,000
• Best for large manufacturers with high production volumes

MA-M (MAC Address Block Medium)

• 28-bit prefix providing 1,048,576 addresses
• Cost: ~$2,000
• Suitable for medium-volume manufacturers

MA-S (MAC Address Block Small)

• 36-bit prefix providing 4,096 addresses
• Cost: ~$700
• Designed for small manufacturers or specialized applications

IAB (Individual Address Block) - Deprecated but still in use

• 36-bit prefix providing 4,096 addresses
• Previously offered, now replaced by MA-S
• Existing IAB assignments remain valid

Large companies like Apple, Cisco, Dell, and HP own multiple OUIs to accommodate their massive production volumes spanning decades. For example, Apple has dozens of registered OUIs covering different product lines and manufacturing facilities.

The IEEE OUI Database: Public Registry of Manufacturers

Database Structure and Contents

The IEEE maintains a comprehensive public database of all assigned OUIs, accessible to anyone. This database contains:

Primary Information:

• OUI prefix: The 24-bit identifier (e.g., 00:1A:2B)
• Organization name: Company or entity the OUI was assigned to
• Organization address: Registered business address
• Assignment date: When IEEE issued the OUI

Database Scale:

• Over 55,000 unique OUI assignments as of 2025
• Hundreds of thousands total entries (including historical and deprecated)
• Constantly growing as new companies enter the market
• Includes entries dating back to the 1980s

Accessing the OUI Database

Several methods exist for querying the OUI database:

Official IEEE Database:

• Available at standards-ieee.org
• Free public access
• Most authoritative source
• Updated as new OUIs are assigned

Third-Party Lookup Tools:

• Numerous websites offer user-friendly OUI lookups
• Often provide enhanced features like bulk lookup, API access
• May include additional context about manufacturers
• Our MAC Address Lookup provides instant vendor identification

Local Database Files:

• IEEE publishes downloadable text files of the entire database
• Network monitoring tools often include local copies
• Enables offline lookups for air-gapped networks
• Requires periodic updates to remain current

Command-Line Tools:

• Wireshark includes OUI database functionality
• Many networking tools integrate OUI lookups
• Useful for automated network inventory scripts

Database Accuracy and Limitations

While generally reliable, the OUI database has some limitations:

Acquisition and Mergers: Companies that acquire others may inherit OUIs but continue using the original registration. A device might show "Company X" that was acquired by "Company Y" years ago.

OUI Sales and Transfers: OUIs can be sold or transferred between organizations, though this is uncommon. The database may not always reflect current ownership.

Generic Registrations: Some OUIs register to generic entities ("Engineering Department," "Technology Group") rather than recognizable brand names, making identification less useful.

Virtualization Ambiguity: Virtual machine manufacturers often use their own OUIs (VMware, VirtualBox), but this identifies the virtualization platform, not the actual device running the VM.

How MAC Address Lookup Works

The Lookup Process

When you enter a MAC address into a lookup tool, here's what happens:

Step 1: Extract OUI

• Tool extracts the first 24 bits (6 hexadecimal characters) from the MAC address
• Example: From 00:1A:2B:3C:4D:5E, extract 00:1A:2B
• Standardizes format (removes separators like colons or hyphens)

Step 2: Query OUI Database

• Searches IEEE OUI database for matching prefix
• Uses efficient indexing for fast lookups
• Returns manufacturer information if found

Step 3: Return Results

• Displays manufacturer name and other available information
• May include company address, country, and assignment date
• Some tools provide additional context about the vendor

Step 4: Handle Special Cases

• Identifies locally administered addresses (not in database)
• Recognizes broadcast and multicast addresses
• Flags unusual or invalid MAC address formats

Local vs. Universal Addresses

The OUI lookup process depends on the MAC address type:

Universally Administered Addresses (UAA):

• Second least significant bit of first byte is 0
• Assigned by manufacturer, guaranteed globally unique
• Appear in IEEE OUI database
• Example: 00:1A:2B:3C:4D:5E (second bit of 00 is 0)

Locally Administered Addresses (LAA):

• Second least significant bit of first byte is 1
• Manually configured by administrator or software
• Will NOT appear in IEEE OUI database
• Example: 02:1A:2B:3C:4D:5E (second bit of 02 is 1)

Lookup tools typically identify locally administered addresses and notify users that vendor identification isn't possible for these manually configured addresses.

Practical Applications of OUI Lookups

Network Device Inventory and Management

MAC address vendor identification streamlines network administration:

Automated Network Discovery:

• Scan network for active MAC addresses
• Look up OUI for each address
• Automatically categorize devices by manufacturer
• Generate comprehensive network inventory

Device Type Inference:

• Manufacturer often indicates device category
  • "Apple, Inc." → Likely iPhones, iPads, or MacBooks
  • "Cisco Systems" → Network infrastructure (routers, switches)
  • "HP Inc." → Printers or desktop computers
  • "Amazon Technologies" → Echo devices, Fire tablets
• Helps identify purpose of unknown devices
• Assists in capacity planning and lifecycle management

Asset Tracking:

• Monitor specific manufacturer devices across campus networks
• Track warranty status by correlating MAC addresses with purchase dates
• Identify old or unsupported hardware needing replacement
• Maintain compliance with vendor licensing agreements

Security Monitoring and Threat Detection

OUI information enhances security postures:

Rogue Device Detection:

• Identify unauthorized devices on corporate networks
• Flag personal devices violating BYOD policies
• Detect unauthorized access points or routers
• Alert on suspicious device types in secure areas

Anomaly Detection:

• Baseline expected manufacturers for different network segments
• Alert when unexpected manufacturer appears
• Detect MAC address spoofing attempts (vendor changes without physical device swap)
• Identify counterfeit or cloned devices

Penetration Testing:

• Identify security infrastructure (firewalls, IDS/IPS) by manufacturer
• Recognize wireless access points for targeted attacks
• Map network topology using device vendors
• Plan attack strategies based on known vendor vulnerabilities

Incident Response:

• Quickly identify compromised device manufacturers during breaches
• Correlate MAC addresses with asset management systems
• Determine scope of compromise across device types
• Prioritize remediation based on critical infrastructure vendors

Network Troubleshooting

Vendor identification accelerates problem resolution:

Narrowing Problem Scope:

• Unknown MAC causing network issues? Vendor lookup reveals device type
• Multiple devices from one manufacturer failing? Possible vendor-specific problem
• Identify which team should handle issues (printer team, network team, endpoint team)

Finding Documentation:

• Knowing manufacturer leads directly to support resources
• Locate firmware updates and security patches
• Access vendor-specific troubleshooting guides
• Contact appropriate technical support

Configuration Management:

• Different manufacturers require different management approaches
• SNMP community strings, web interfaces, and CLI commands vary
• Vendor identification helps administrators use correct tools
• Streamlines bulk configuration changes across similar devices

VLAN Assignment:

• Automatically assign devices to VLANs based on manufacturer
• Separate guest devices from corporate hardware
• Isolate IoT devices to dedicated network segments
• Implement network access control policies

Advanced OUI Concepts

Multiple OUIs Per Manufacturer

Large manufacturers own dozens or even hundreds of OUIs:

Why Multiple OUIs?:

• Production volume: Exhausted address space in earlier OUIs
• Product lines: Different OUIs for different product families
• Geographic separation: Different manufacturing facilities use different OUIs
• Acquisitions: Inherited OUIs from acquired companies
• Historical reasons: Decades of production accumulate multiple assignments

Example: Apple Inc. owns over 60 registered OUIs, used across iPhones, iPads, MacBooks, AirPods, HomePods, Apple Watches, and more. Each product generation may use different OUI blocks.

OUI Reuse and Recycling

IEEE doesn't typically reuse OUIs, but some scenarios create ambiguity:

Bankrupt Companies: When manufacturers go out of business, their OUIs theoretically become available, though IEEE rarely reassigns them to avoid confusion.

Transferred OUIs: Occasionally companies transfer OUI ownership during mergers or asset sales, causing database records to become outdated.

Historical Ambiguity: Very old OUIs from defunct companies appear in current database but no longer actively manufacture devices.

Randomized MAC Addresses and Privacy

Modern devices increasingly use randomized MAC addresses for privacy:

Privacy Concerns:

• MAC addresses enable device tracking across locations
• Retailers use Wi-Fi MAC tracking for customer analytics
• Public networks can correlate MAC addresses with behavior patterns
• Privacy advocates consider MAC addresses identifying information

Randomization Implementation:

• iOS, Android, and Windows 10+ support MAC randomization
• Different random MAC address used for each Wi-Fi network
• Changes periodically to prevent persistent tracking
• Randomized addresses use locally administered format

Impact on OUI Lookups:

• Randomized MACs won't match IEEE database
• Vendor identification becomes impossible
• Network administrators lose visibility into device types
• Security monitoring becomes more challenging

Some operating systems allow users to disable randomization for trusted networks while maintaining privacy on public networks.

Using MAC Address Lookup Tools

Best Practices for Vendor Identification

Verify Format: Ensure MAC address is properly formatted before lookup:

• Should be 6 pairs of hexadecimal digits
• Accept common separators (colons, hyphens, periods, none)
• Total of 12 hexadecimal characters

Understand Limitations: Recognize what OUI lookups can and cannot do:

• Identifies manufacturer, not specific device model
• May show outdated company names from acquisitions
• Cannot identify locally administered or randomized addresses
• Doesn't reveal device location or network configuration

Cross-Reference Results: When precision matters, verify OUI information:

• Check multiple OUI databases for consistency
• Consult manufacturer documentation for OUI ranges
• Use network scanning tools to gather additional device details
• Correlate with DHCP logs showing hostnames and IP addresses

Privacy Considerations: Respect privacy when using OUI information:

• Avoid publishing individual MAC addresses publicly
• Use MAC lookups for legitimate network management only
• Comply with privacy regulations regarding network monitoring
• Redact or anonymize MAC addresses in public documentation

Try MAC Address Lookup Now

Curious about the devices on your network? Our MAC Address Lookup tool provides instant vendor identification using the IEEE OUI database. Simply enter any MAC address to discover its manufacturer—perfect for network inventory, security monitoring, and troubleshooting.

The Elegant Registry Behind Networking

The OUI system represents one of networking's most successful standards—a global registry that's functioned reliably for decades, enabling interoperability across billions of devices from tens of thousands of manufacturers. The IEEE's public database democratizes this information, empowering network administrators, security professionals, and curious users to identify devices with simple lookups.

From troubleshooting mysterious devices on home networks to managing enterprise infrastructures with thousands of endpoints, OUI lookups provide invaluable context that streamlines workflows and enhances security. The ability to instantly identify "that unknown device" as an Apple iPhone or a Samsung smart TV can save hours of investigation and prevent security false alarms.

As networks grow more complex and IoT devices proliferate, the humble OUI becomes increasingly important. While users rarely think about these 24-bit prefixes, they work tirelessly behind the scenes, maintaining order in the chaotic world of network devices. The next time you wonder what that strange MAC address represents, remember that IEEE's OUI registry has the answer—a testament to thoughtful standardization that scales from home networks to the global internet.