MAC Address Lookup

MAC Address Lookup: Identify Any Device Vendor from Its Hardware Address

This MAC address lookup tool takes any MAC address — or just the first three octets of one — and tells you which manufacturer registered that block with the IEEE. It is the fastest way to answer the question every network administrator eventually asks: what is this unknown device on my network? Paste an address such as 3C:22:FB:00:11:22 and the tool returns the registered vendor (Apple, Inc.), the registration address on file with the IEEE, and a full structural breakdown of the address itself.

The lookup runs against a copy of the IEEE MA-L (MAC Address Block Large) registry containing 38,298 assignments, sourced from standards-oui.ieee.org. Queries are served from an edge database, so results come back in milliseconds with no rate limits, no account, and no captcha. You can look up one address, paste a list of hundreds for batch processing, dump raw ipconfig/arp/ip link output and let the tool extract every MAC it finds, or search the registry by vendor name to see every OUI a company owns.

Behind the tool sits one of networking’s quietest successes: a global registry, maintained by the IEEE Registration Authority for decades, that lets anyone identify the maker of a network interface from the first half of its address. Across its full history the registry holds more than 55,000 unique OUI assignments — and hundreds of thousands of entries once historical and deprecated records are counted — with the oldest dating to the 1980s. That registry is what prevents addressing conflicts among billions of shipped devices, and what makes network inventory, security monitoring, and troubleshooting possible without touching the device itself.

How a MAC Address Is Structured

A MAC-48 address is 48 bits — six octets, usually written as twelve hexadecimal digits. Those 48 bits split cleanly in half:

• The first 24 bits are the OUI (Organizationally Unique Identifier). This is the part the IEEE Registration Authority sells to hardware manufacturers, and it is the only part a MAC vendor lookup can resolve. In 3C:22:FB:A1:B2:C3, the OUI is 3C:22:FB. It stays the same across every device that manufacturer ships from that block.
• The last 24 bits are the NIC-specific portion, assigned by the manufacturer to keep each interface it builds unique. One OUI therefore covers 16,777,216 (2²⁴) possible addresses, which is why large vendors register dozens or hundreds of separate blocks.

A worked split of 00:1A:2B:3C:4D:5E: the OUI is 00:1A:2B (say, Cisco Systems) and the device identifier is 3C:4D:5E. The structure is hierarchical in the same way a phone number is — the area code identifies a region the way an OUI identifies a manufacturer, and the remaining digits identify a specific subscriber the way the device bytes identify a specific interface.

Two bits inside the very first octet carry meaning of their own, and the tool decodes both:

Bit	Name	Value 0	Value 1
Least significant bit of octet 1	I/G (Individual/Group)	Unicast — one interface	Multicast — a group of interfaces
Second-least significant bit of octet 1	U/L (Universal/Local)	Universally administered — IEEE-assigned, resolvable	Locally administered — software-set, not in any registry

Practically, this means an address whose first octet has the value 2 in its second-lowest bit — addresses starting with 02, 06, 0A, 0E, x2, x6, xA or xE — was set locally and will never match a vendor. That is not a broken lookup; it is the correct answer.

How to Use the MAC Address Lookup Tool

1. Single lookup: paste a full MAC address or just the six-hex-digit OUI into the input box and run the lookup. Any common separator works — the tool normalises input before querying.
2. Batch lookup: switch to batch mode and paste addresses one per line or comma-separated. Every unique OUI is resolved in a single round trip, and the results table can be exported to CSV or JSON.
3. Extract from device output: switch to network mode and paste raw command output — ipconfig /all, ip link show, ifconfig, arp -a, a DHCP lease file, a switch MAC-address table. The tool finds every MAC address in the text and looks them all up at once.
4. Search by vendor: type a manufacturer name (for example “Raspberry Pi” or “VMware”) to list the OUI blocks registered to that company — useful when you want to write a firewall or NAC rule that matches a whole vendor.
5. Reformat and copy: results are shown in all four common notations, each with a one-click copy button.

Internally the lookup is four steps, and it is worth knowing them because each one has a failure mode. Step 1 — extract the OUI: separators are stripped and the first six hexadecimal characters (24 bits) are taken, so 00:1A:2B:3C:4D:5E becomes the prefix 001A2B. Step 2 — query the registry: that prefix is matched against the indexed IEEE assignment list. Step 3 — return the result: the assigned organisation name, plus the registration address and country held on file. Step 4 — handle the special cases: locally administered addresses (which are in no registry by design), broadcast and multicast group addresses, and malformed input are each flagged as such rather than reported as “vendor not found”.

MAC Address Formats the Tool Accepts

Different vendors and operating systems print the same address differently. All of these are the same interface, and the tool reads and emits every one of them:

Notation	Example	Where you see it
Colon-separated	3C:22:FB:A1:B2:C3	Linux, macOS, most RFCs
Hyphen-separated	3C-22-FB-A1-B2-C3	Windows ipconfig, IEEE documents
Dot-separated (triplets)	3c22.fba1.b2c3	Cisco IOS, NX-OS
No separator	3C22FBA1B2C3	Log files, RADIUS, config exports

Worked Example: Reading an Unknown Address

Suppose an ARP table shows an unexpected client at B8:27:EB:9F:2C:41.

• First octet B8 is 10111000 in binary. The lowest bit is 0, so this is a unicast address. The second-lowest bit is also 0, so it is universally administered — an IEEE assignment, which means it is resolvable.
• The OUI is B8:27:EB, which the registry attributes to the Raspberry Pi Foundation.
• The NIC portion 9F:2C:41 is the board’s serial-derived identifier — unique per device, but meaningless outside the vendor.

In thirty seconds you have gone from “unknown host” to “someone plugged a Raspberry Pi into the network,” which is a very different investigation from “an enterprise switch is misbehaving.” Newer Pi hardware ships under DC:A6:32 (Raspberry Pi Trading Ltd), and virtual machines commonly appear under VMware’s 00:0C:29 and 00:50:56 blocks — a fast way to spot a hypervisor guest in a list of physical hosts.

Can This MAC Be Traced to a Vendor? Universal vs. Locally Administered

Whether a lookup can succeed at all is decided by two bits, not by the quality of the database. The distinction is worth internalising:

• Universally administered addresses (UAA). The second-least-significant bit of the first byte is 0. The address was assigned by the manufacturer from an IEEE block, is intended to be globally unique, and does appear in the OUI registry. Example: 00:1A:2B:3C:4D:5E — the second-lowest bit of 00 is 0.
• Locally administered addresses (LAA). That bit is 1. The address was set by software — an administrator, a hypervisor, a container runtime, or a phone’s Wi-Fi privacy feature — and will never appear in the IEEE database. Example: 02:1A:2B:3C:4D:5E — the second-lowest bit of 02 is 1.

The fastest field shortcut: read the second hex digit of the address. If it is 2, 6, A, or E, the U/L bit is set and the address is locally administered — no vendor lookup will work. Every other value means it’s universally administered and should resolve to a registered manufacturer. A good lookup tool says so explicitly instead of returning a bare “not found,” because the two outcomes mean completely different things operationally.

What an OUI Is and How a Manufacturer Gets One

An OUI (Organizationally Unique Identifier) is a 24-bit identifier forming the first half of a MAC address, and the IEEE Registration Authority assigns each one to exactly one organisation. That exclusivity is the whole foundation of globally unique MAC addressing: because no two manufacturers hold the same block, no two manufacturers can mint the same address.

Getting one is a formal, three-step process:

1. Purchase a block. The company applies to the IEEE Registration Authority. A standard 24-bit OUI (an MA-L) runs roughly $3,000 and yields 16,777,216 addresses. It is a one-time fee with no recurring cost.
2. IEEE assignment. The IEEE issues an available identifier from its registry, guaranteeing no conflict with any prior assignment, and publishes it in the public OUI database. Assignment typically completes within days.
3. Manufacturing integration. The company programs addresses from its block into device firmware during production. Each interface gets a unique address within the block, burned into the network interface card’s ROM, and carries it for the hardware’s lifetime.

MA-L vs. MA-M vs. MA-S: Choosing a Block Size

The IEEE offers several assignment sizes so a hobbyist maker isn’t forced to buy the same block as Apple. The trade-off is simple: a shorter reserved prefix means more addresses for you but a higher price.

Block type	Reserved prefix	Addresses you get	One-time IEEE fee (2026)	Who it’s for
MA-L (Large)	24 bits (full OUI)	16,777,216 (224)	~$3,140	High-volume manufacturers shipping millions of NICs — Apple, Cisco, Dell
MA-M (Medium)	28 bits (shared OUI)	1,048,576 (220)	~$2,065	Mid-volume makers who won’t exhaust a million addresses
MA-S (Small)	36 bits (shared OUI)	4,096 (212)	~$755	Startups, IoT specialists, prototype and low-run hardware
IAB (deprecated)	36 bits	4,096	no longer sold	Legacy — replaced by MA-S; existing assignments stay valid
Which should I use?	—	—	—	Pick the smallest block whose address count covers your lifetime unit volume; MA-S for under a few thousand devices, MA-L only if you’ll ship millions

Note that with MA-M and MA-S the buyer does not own a full unique 24-bit OUI — several organisations share the same first three octets, and the IEEE registry distinguishes them by the extra prefix bits. A good lookup tool handles this variable prefix length automatically, which is why a naive “grab the first 6 hex digits” script sometimes returns the wrong vendor for an MA-S device.

Why One Manufacturer Owns Dozens of OUIs

Large manufacturers hold dozens or even hundreds of blocks. Apple alone owns more than 60 registered OUIs spanning iPhones, iPads, MacBooks, AirPods, HomePods, and Apple Watches; Cisco, Dell, and HP are comparable. There are five ordinary reasons a vendor accumulates blocks:

• Production volume — earlier blocks simply ran out of addresses.
• Product lines — separate blocks for separate product families.
• Geographic separation — different manufacturing facilities draw from different blocks.
• Acquisitions — blocks inherited from companies that were bought.
• History — decades of production accumulate assignments.

This is why searching the registry by vendor name is often more useful than looking up one address: to write a NAC or firewall rule that matches “all Apple hardware,” you need every block, not the one you happened to see.

Inside the IEEE OUI Registry

The IEEE maintains a comprehensive public database of every assigned OUI. Each record carries four things:

• OUI prefix — the 24-bit identifier, for example 00:1A:2B.
• Organisation name — the company or entity the block was assigned to.
• Organisation address — the registered business address on file.
• Assignment date — when the IEEE issued it.

The registry holds over 55,000 unique OUI assignments, hundreds of thousands of total entries once historical and deprecated records are included, entries reaching back to the 1980s, and it grows continuously as new companies enter the market.

Ways to Query the Registry

• The official IEEE database at standards-ieee.org — free, public, and the most authoritative source, updated as new blocks are assigned.
• Third-party lookup tools like this one — friendlier interfaces, plus features the IEEE site lacks: batch and bulk lookup, extraction from raw command output, format conversion, API access.
• Local database files — the IEEE publishes the whole registry as downloadable text. Network monitoring tools ship local copies, which is how lookups work on air-gapped networks. They need periodic refreshing to stay current.
• Command-line and packet tools — Wireshark carries an OUI database and resolves vendors inline; many inventory scripts embed the same data.

Where the Registry Is Less Than Authoritative

The database is reliable about who was assigned a block and much weaker about what that means today:

• Acquisitions and mergers. An acquiring company usually inherits blocks but leaves the original registration in place, so a device happily reports a brand that was bought years ago. The hardware prefix does not change when the brand does.
• Sales and transfers. Blocks can be sold or transferred between organisations. It is uncommon, but it means the record may not reflect current ownership.
• Generic registrations. Some blocks are registered to entities like “Engineering Department” or “Technology Group” rather than a recognisable brand, which makes the result technically correct and practically useless.
• Virtualisation ambiguity. VMware, VirtualBox, Xen, and KVM use their own blocks. A hit tells you the virtualisation platform, not what the guest actually is or what hardware it runs on.
• Defunct assignees. The IEEE does not normally reuse a block when a company goes out of business — reassignment would create exactly the ambiguity the registry exists to prevent — so very old blocks from dead companies stay in the database as historical records.

The practical consequence: an OUI identifies a manufacturer, never a product. “Apple, Inc.” could be an iPhone, an iPad, a MacBook, AirPods, or a HomePod. Narrowing to a model means combining the OUI with other signals — DHCP hostname, open ports, HTTP user agent, or an active scan.

EUI-64 and IPv6 Link-Local Derivation

The tool also converts a 48-bit MAC into its 64-bit EUI-64 form and the IPv6 link-local address that stateless address autoconfiguration (SLAAC) derives from it. The transformation is mechanical:

1. Split the MAC into its two 24-bit halves.
2. Insert the two bytes FF:FE between them.
3. Flip the U/L bit (bit 1 of the first octet) — so a universally administered MAC becomes a locally flagged EUI-64.
4. Prefix fe80:: to get the link-local address.

Because step 3 flips a bit, an IPv6 address seen in a packet capture will not textually contain the MAC that generated it, which trips people up constantly. Feeding the MAC through this converter shows exactly which fe80:: address to expect. If you also need to move between address families, the IPv4 to IPv6 converter handles the numeric side.

Randomized MAC Addresses and Privacy

The single biggest change to MAC lookup in the last decade is that phones stopped telling the truth about their hardware address — deliberately, and for good reason.

Why it happened. A stable MAC address is a persistent identifier that any Wi-Fi receiver can log without the device ever joining the network. Retailers used it for footfall analytics, public networks correlated it with behaviour, and the Snowden disclosures showed intelligence services tracking mobile devices the same way. Privacy regulators and vendors alike came to treat a MAC address as identifying information.

How it works. Since roughly 2014, iOS, Android, Windows 10 and later, and mainstream Linux distributions randomise the MAC a device advertises while probing for networks, and increasingly use a different random address per network once connected. Some rotate it periodically as well. Every randomised address is generated in the locally administered format — the U/L bit set — so it is structurally guaranteed not to collide with any real assignment.

What it does to a lookup. A randomised MAC will never match the IEEE database. Vendor identification is impossible by design, network administrators lose device-type visibility on guest and public Wi-Fi, and passive location tracking by static MAC is effectively dead. Most operating systems let a user disable randomisation for a trusted network (on iOS, turning off “Private Wi-Fi Address”) while keeping it on public ones, which is why a device can resolve cleanly on the corporate SSID and resolve to nothing on the guest SSID.

What randomisation does not break is inventory of your own managed fleet: devices enrolled on a corporate SSID with 802.1X typically present their real burned-in address. The right response to randomisation is to shift from identity-by-MAC to behavioural fingerprinting plus certificate-based identity — a more sophisticated approach that happens to be a better one.

Why Network Teams Run MAC Lookups

• Asset discovery: resolve every MAC in a switch table or DHCP lease list into vendor names to build a device inventory without touching an agent.
• Rogue device detection: an unexpected vendor on a segment — a consumer access point, a single-board computer, an unmanaged switch — is a strong early signal.
• Troubleshooting: duplicate or flapping MACs in a spanning-tree log become far easier to reason about once you know whose hardware they belong to.
• Forensics and incident response: DHCP and ARP logs preserve MAC addresses long after an IP lease has been recycled, and the OUI narrows down what kind of device was present.
• Procurement and warranty checks: confirming the manufacturer of a device you inherited without documentation.

Vendor identity is also a fast proxy for device category, which is what makes automated discovery useful: “Apple, Inc.” on a user VLAN is almost certainly a phone or a laptop, “Cisco Systems” is infrastructure, “HP Inc.” is usually a printer or a desktop, and “Amazon Technologies” is an Echo or a Fire tablet that has no business on a production segment. Scan the network, resolve each address, group by vendor, and you have an inventory — useful for capacity planning, for spotting hardware that is too old to be supported, and for reconciling what is connected against what you actually bought.

MAC Address Lookup as a Security Control

MAC address lookup matters for security because the first three bytes of any MAC address are assigned by the IEEE to a specific hardware manufacturer, so resolving them reveals who made every device on your network without ever touching the device itself. Security teams use that vendor insight to build asset inventories, detect rogue or unauthorised hardware, enforce network access control, and speed up incident response — an unexpected vendor on a segment is often the first sign of a rogue access point or a shadow-IT device. The important caveat: because MAC addresses can be spoofed and modern devices randomise them, a lookup is a lightweight enrichment and detection layer, not a real authentication control.

Unlike an IP address, which changes as DHCP leases turn over, a genuine burned-in MAC stays with the hardware. That stability is exactly what makes it useful for inventory and for correlating one device across switch tables, wireless controllers, and DHCP logs over time.

Where MAC and OUI Lookup Actually Earns Its Keep

The table below maps the core security use cases to how an OUI/MAC lookup helps — and, just as importantly, the limitation you have to design around. Read the limitations column as the reason MAC data supports decisions rather than making them.

Security use case	How OUI / MAC lookup helps	Key limitation to design around
Asset inventory	Resolves every connected MAC to a vendor, so you can enumerate what hardware is on each segment and reconcile it against your approved-device list.	Randomised MACs from phones and laptops show as “unknown/private”; inventory managed devices via their real address on the corporate SSID or 802.1X, not guest Wi-Fi.
Rogue device detection	Flags any OUI that doesn’t match expected hardware — a consumer Wi-Fi vendor on a switch-only segment is a classic rogue-AP signature.	An attacker can clone an approved vendor’s OUI to blend in; pair lookup with port and behaviour anomalies, not vendor alone.
Network access control (NAC)	MAC allow-lists gate casual and accidental connections and seed dynamic VLAN assignment based on device type or OUI.	MAC filtering is trivially bypassed by spoofing; use it as one layer under 802.1X and certificates, never as the sole gate.
Incident response & forensics	Turns a bare MAC from a switch table or DHCP log into a device identity, and anchors correlation across port, wireless controller, and DHCP to locate the physical device.	The same MAC appearing in two places, or a spoofed one, can mislead — treat it as an investigative lead and corroborate with other evidence.
IoT / OT visibility	OUI reveals which IoT and OT vendors (cameras, PLCs, sensors) are present so you can segment and baseline them despite weak on-device security.	IoT devices rarely randomise, but they also can’t authenticate — segmentation, not MAC trust, is the real control.

Network Access Control and Device Authentication

Many organisations run MAC address filtering as one layer of a defence-in-depth strategy: maintain an allow-list of approved addresses, and flag any unknown device the moment it attempts to connect. This is genuinely useful in environments with strict compliance obligations — healthcare under HIPAA, payment environments under PCI-DSS — where being able to enumerate and justify every connected device is itself a control.

It is not, however, a gate. A determined attacker can sniff a permitted MAC off the air and clone it in seconds, because the field is unencrypted and software-changeable. MAC filtering stops the accidental and the casual; it complements 802.1X certificate authentication, VPN enforcement, and a full NAC platform that combines MAC data with posture checks and identity. Treated as a thin layer, it earns its place. Treated as the gate, it is a false sense of security.

The same data drives automated segmentation: MAC-address-based VLANs can place a device on the right segment from its OUI alone, separating guest hardware from corporate, and isolating IoT devices onto a dedicated network without any manual step.

Threat Detection and Incident Response

Network monitoring systems track MAC addresses and their activity continuously, and those logs are what forensic investigations actually run on. When an alert fires, a responder often starts with nothing but an IP or a bare MAC from a switch table or DHCP log. Resolving the OUI turns it into a device identity — an Axis camera, a Cisco phone, an Apple laptop — which answers the first question worth asking: does this belong on this segment? Correlating the same MAC across switch port, wireless controller, and DHCP records then pinpoints the physical port or access point so the device can be isolated.

The speed matters. Many sophisticated intrusions begin with physical access and an unauthorised device plugged into a live port. MAC monitoring can surface that within minutes and trigger an automated response — port isolation, a quarantine VLAN, an alert — and the gap between a contained incident and a full breach is frequently exactly that window.

MAC data also catches the subtler case of spoofing, where an attacker clones a legitimate device’s address to impersonate it. Correlation over time is what exposes it: a vendor that changes without a physical device swap, or the same address appearing in two physical locations simultaneously, is not ambiguous — it is malicious. See the explainer on MAC address spoofing for the mechanics, and whether two devices can share a MAC address for the innocent explanations you should rule out first.

Advanced Applications

• Behavioural baselining. MAC addresses serve as anchor points for normal-activity baselines. When the device behind a known address starts consuming unusual bandwidth, connecting to suspicious external IPs, or probing restricted resources, that deviation is what triggers the investigation — the MAC is the identity the baseline is attached to.
• Physical security correlation. Cross-referencing MAC sightings with badge and door-access systems catches devices that appear where they shouldn’t, or move between locations in ways no legitimate workflow explains. In large facilities this covers ground that visual monitoring cannot.
• IoT compromise detection. IoT devices often ship with weak security and are attractive footholds. A maintained MAC inventory of every IoT device, monitored for behavioural change, is how a compromised camera or sensor is caught before it becomes a pivot point into the rest of the network.
• Penetration testing and red-team reconnaissance. The same signal works offensively: OUIs in a captured ARP table identify firewalls, IDS/IPS appliances, and wireless access points by vendor, sketching the topology and pointing at known vendor-specific weaknesses. Worth knowing, because it is what an attacker sees when they look at your network.

Looking forward, MAC intelligence is being folded into larger frameworks rather than replaced. Software-defined networking and zero-trust architectures treat the MAC as one factor in device authentication alongside certificates, behavioural analysis, and continuous verification. 5G and edge deployments, where devices join and leave constantly, need exactly the kind of fast automated identity signal a MAC lookup provides. And machine-learning monitoring increasingly learns which vendors are normal for which segment and flags the anomalies a human would miss.

Building a MAC-Based Security Programme

1. Maintain a real inventory. Record every authorised MAC with its device type, owner, and purpose. Everything else — access control policy, anomaly detection, rogue-device alerting — is built on this list, and without it the rest is guesswork.
2. Automate the lookups. Deploy monitoring that resolves vendors continuously and alerts on unexpected devices. Modern SIEM platforms ingest MAC intelligence alongside other telemetry, query OUI data automatically, and score risk against policy.
3. Segment the network. Assume a rogue device will eventually connect. Proper segmentation means that when it does, it cannot reach critical systems or sensitive data. OUI-driven dynamic VLAN assignment makes this automatic rather than manual.
4. Audit the allow-list. Review it as devices are added, retired, and replaced. A stale MAC list creates security gaps and operational tickets in equal measure; integrating asset management with network infrastructure keeps it current without manual upkeep.

For the security side of an investigation, pair this tool with the IP reputation checker for the addresses those devices talked to.

Network Troubleshooting with Vendor Identity

Outside security, vendor identification mostly saves time by narrowing scope before anyone opens a packet capture:

• Narrowing the problem. An unknown MAC flooding a segment becomes actionable the moment you know what kind of device it is. Several failing devices from a single manufacturer point at a vendor-specific fault rather than a network one — and vendor identity also tells you which team owns the ticket: printers, network, or endpoint.
• Finding documentation. Knowing the manufacturer leads straight to firmware updates, security advisories, vendor troubleshooting guides, and the right support queue.
• Configuration management. Different manufacturers want different handling — SNMP community strings, web interfaces, and CLI syntax all vary. Identifying the vendor first means reaching for the right tool, which matters most when pushing bulk configuration across many similar devices.
• VLAN and policy assignment. OUI-driven rules place devices on the correct segment automatically, separating guest from corporate and isolating IoT.

Best Practices for Vendor Identification

• Verify the format first. A valid MAC is twelve hexadecimal characters — six pairs — with any common separator (colon, hyphen, period) or none at all. This tool normalises all of them, but a homegrown script usually won’t.
• Know what the lookup cannot do. It identifies a manufacturer, not a model. It may report a company name that an acquisition made obsolete. It cannot resolve locally administered or randomised addresses. And it reveals nothing about location, ownership, or network configuration.
• Cross-reference when precision matters. Check more than one OUI source for consistency, consult manufacturer documentation for known block ranges, gather extra device detail with an active scan, and correlate against DHCP logs showing hostnames and leased IPs.
• Respect privacy. MAC addresses are identifying information under several privacy regimes. Don’t publish individual addresses, redact or anonymise them in documentation and tickets, use lookups for legitimate network management only, and keep monitoring practice inside whatever regulations apply to you.

Frequently Asked Questions

What is an OUI in a MAC address?

The OUI is the first 24 bits (first three octets) of a MAC address, assigned by the IEEE Registration Authority to a specific organisation. It identifies who made the network interface. The remaining 24 bits are chosen by that manufacturer. In 00:1A:2B:3C:4D:5E the OUI is 00:1A:2B and 3C:4D:5E is the device-specific portion.

How does a MAC address lookup find the vendor?

The tool strips separators, takes the first six hex characters (24 bits), and matches that prefix against the IEEE OUI registry. If the prefix is a registered MA-L, MA-M, or MA-S block, it returns the assigned organisation name. If the U/L bit is set (locally administered) or the prefix isn’t registered, no vendor can be returned.

Why does my MAC address lookup return no vendor?

Three common reasons. First, the address is locally administered — randomised by a phone’s Wi-Fi privacy feature, set by a hypervisor, or configured by hand. These are not in any registry by design. Second, the OUI was assigned very recently and post-dates the registry snapshot. Third, the block is an MA-M or MA-S (medium and small) assignment, which subdivides a 28- or 36-bit prefix; this tool covers the 24-bit MA-L registry, which is the block type used by essentially all consumer and enterprise NICs.

How much does an IEEE OUI cost?

As of 2026 the IEEE Registration Authority charges roughly $3,140 for an MA-L (24-bit prefix, ~16.7 million addresses), about $2,065 for an MA-M (28-bit prefix, ~1 million addresses), and around $755 for an MA-S (36-bit prefix, 4,096 addresses). All are one-time fees with no recurring cost. Large vendors such as Apple and Cisco own dozens of MA-L blocks.

What is the difference between MA-L, MA-M, and MA-S blocks?

They are IEEE assignment sizes. MA-L reserves a full 24-bit OUI and gives the buyer ~16.7 million addresses. MA-M reserves 28 bits, so the vendor shares the OUI prefix with others and gets ~1 million addresses. MA-S reserves 36 bits, giving 4,096 addresses — ideal for small or specialised makers. All three are searchable in the IEEE registry, and lookup tools handle the variable prefix length automatically. The older IAB assignment was equivalent to MA-S and is no longer sold, though existing IAB assignments remain valid.

Can two manufacturers share the same OUI?

No. The IEEE guarantees each MA-L, MA-M, or MA-S block is assigned to only one organisation, which is what makes globally unique MAC addresses possible. Ambiguity only comes from mergers and acquisitions, where a device still carries the OUI of a company that was later bought — the hardware prefix doesn’t change even when the brand does.

Does an OUI tell me the exact device model?

No. An OUI identifies the manufacturer, not the product. “Apple, Inc.” could be an iPhone, iPad, MacBook, AirPods, or HomePod. To narrow the model you have to combine the OUI with other signals — DHCP hostname, open ports, HTTP user agent, or an active scan.

Why is MAC address lookup important for security?

Because resolving the OUI tells you who made the network card connecting to your network without touching the device itself. Security teams use that to build asset inventories, spot rogue or unauthorised devices (an unexpected consumer-router or single-board-computer vendor on a corporate LAN is a red flag), enforce network access control, and give incident responders a fast way to identify which physical device was involved in an event. It is a lightweight enrichment layer, not an authentication mechanism, because MAC addresses can be spoofed and modern devices randomise them.

Can MAC address filtering actually stop an attacker?

No, not on its own. MAC filtering stops casual or accidental connections, but a determined attacker can sniff a permitted MAC off the air and clone it in seconds because the field is unencrypted and software-changeable. Treat it as one thin layer in a defence-in-depth stack, not as a real gatekeeper. For genuine device authentication, use 802.1X with certificates or a full NAC platform that combines MAC data with posture checks and identity.

What is a rogue device, and how does MAC lookup detect it?

A rogue device is any hardware connected to your network without authorisation — a smuggled-in wireless access point, an attacker’s laptop, a personal switch, or an unmanaged IoT gadget. MAC lookup helps detect it by revealing the vendor of every connected address and flagging any OUI that doesn’t match your approved hardware list. A consumer-grade Wi-Fi vendor appearing on a segment that should only hold enterprise switches and servers is a classic rogue-access-point signature worth investigating immediately.

How does MAC address lookup help incident response?

Responders often start with only an IP or a MAC from a switch table or DHCP log. Resolving the OUI to a vendor narrows down what the device physically is — an Axis camera, a Cisco phone, an Apple laptop — which helps confirm whether it belongs on that segment and where to go looking for it. Correlating the MAC across switch port, wireless controller, and DHCP records then pinpoints the physical port or access point so the device can be isolated. The MAC is an anchor for correlation and attribution, not proof of identity by itself.

Does MAC address randomization break security monitoring?

Partly. Since roughly 2014, iOS, Android, Windows, and Linux randomise the MAC a phone or laptop advertises while probing for Wi-Fi networks, and increasingly per-network once connected. This defeats passive location tracking by static MAC and makes randomised addresses show up as “unknown” or “private” in a lookup. It does not break inventory of your own managed devices, which typically use their real burned-in address on the corporate SSID, and modern tooling shifts to behavioural fingerprinting plus 802.1X identity rather than relying on the MAC alone.

How do I tell a randomized MAC address from a real hardware MAC?

Look at the second-least-significant bit of the first byte — the locally administered (U/L) bit. If it is 1, the address was assigned by software rather than burned in by the manufacturer, which is the hallmark of a randomised or spoofed MAC. In practice the first byte of a randomised address ends in 2, 6, A, or E (for example DA:A1:19:...). A lookup on such an address returns no registered vendor because the prefix belongs to no IEEE assignee.

Why do modern phones show a different MAC on every network?

iOS and Android both default to per-network randomised (locally administered) MAC addresses to prevent cross-venue tracking. That is why a lookup on a phone’s Wi-Fi MAC often resolves to nothing. Disabling “Private Wi-Fi Address” on the device reveals the real, vendor-assigned address.

Is a MAC address unique to one device forever?

It is supposed to be globally unique, and for a genuine burned-in address it usually is. But MAC addresses can be changed in software, cloned, or duplicated by manufacturing errors, so two devices can end up sharing one address. That is exactly why MAC data supports security decisions rather than making them alone — uniqueness is an assumption you verify, not a guarantee you trust.

Can I find a device’s location or owner from its MAC address?

No. A MAC address identifies a network interface’s manufacturer, nothing more. It carries no geographic, ownership, or subscriber information, and it is only visible within a single Layer 2 broadcast domain — routers rewrite it at every hop, so it never travels across the internet.

How many MAC addresses can I look up at once?

Batch mode has no fixed limit — paste a full switch MAC-address table if you like. Duplicate OUIs are deduplicated before the query, so a thousand Apple devices cost one lookup, and results export to CSV or JSON.

How current is the OUI database?

The registry snapshot holds 38,298 MA-L assignments taken from the IEEE public listing. Blocks registered after the snapshot will not resolve; if a lookup fails for a brand-new device, that is usually why. The IEEE also publishes the full registry as a downloadable text file, which is how monitoring tools do offline lookups on air-gapped networks — those local copies need periodic refreshing for the same reason.

What is the difference between MAC-48 and EUI-64?

MAC-48 is the 48-bit address burned into an Ethernet or Wi-Fi interface. EUI-64 is the 64-bit form used by IPv6 SLAAC, derived from the MAC by inserting FF:FE in the middle and inverting the U/L bit. The tool shows the derivation step by step.

Is the tool free, and do the addresses I paste get stored?

The tool is free with no sign-up. Lookups query the OUI registry for the vendor name only; nothing you paste is retained or associated with you.

What does a multicast MAC address look like?

Its first octet is odd — the least significant bit is set. Familiar examples are 01:00:5E:xx:xx:xx (IPv4 multicast), 33:33:xx:xx:xx:xx (IPv6 multicast), and 01:80:C2:00:00:00 (spanning tree). The tool flags these so you do not chase a phantom device.