Want to learn more?
Learn about MAC addresses, OUI vendor lookup, and how hardware identifiers work in networking.
Read the guideUnknown Devices on Your Network?
Our team implements network access control, device monitoring, and rogue device detection.
What Is MAC Address Lookup
A MAC (Media Access Control) address lookup identifies the manufacturer of a network device by examining the first three octets (24 bits) of its 48-bit hardware address. Every network interface card (NIC)—whether in a laptop, smartphone, router, IoT device, or server—is assigned a globally unique MAC address at manufacture. The first half of this address is the Organizationally Unique Identifier (OUI), which maps to the device manufacturer.
MAC address lookup is a fundamental tool for network administration, security operations, and device inventory management. When you see an unknown device on your network, the OUI lookup tells you whether it is an Apple iPhone, a Dell server, a Raspberry Pi, or a Hikvision camera—providing immediate context for security decisions and troubleshooting.
How MAC Addresses Work
A MAC address is a 48-bit identifier written as six pairs of hexadecimal digits: AA:BB:CC:DD:EE:FF. The IEEE (Institute of Electrical and Electronics Engineers) manages MAC address allocation:
| Portion | Bits | Name | Purpose |
|---|---|---|---|
| First 3 octets | 24 | OUI (Organizationally Unique Identifier) | Identifies the manufacturer |
| Last 3 octets | 24 | NIC-specific | Unique within the manufacturer |
Special MAC address types:
- Unicast: Identifies a single device (least significant bit of first octet is 0)
- Multicast: Addresses a group of devices (LSB of first octet is 1)
- Broadcast: FF:FF:FF:FF:FF:FF — reaches all devices on the local network
- Locally administered: Second least significant bit of first octet is 1; assigned by software, not by IEEE
MAC randomization: Modern operating systems (iOS 14+, Android 10+, Windows 10/11) randomize MAC addresses when scanning for Wi-Fi networks and may use random addresses per network. This privacy feature means OUI lookups may return "Private" or "Locally Administered" for mobile devices.
Common Use Cases
- Network inventory: Identify the manufacturer of every device connected to your network
- Security monitoring: Detect unauthorized or unexpected device types (e.g., a Raspberry Pi on a corporate network)
- Troubleshooting: Determine device type when DHCP hostnames are missing or unhelpful
- IoT security: Identify IoT device manufacturers to assess firmware update status and known vulnerabilities
- Forensic investigation: Trace network activity to specific hardware manufacturers as part of incident response
Best Practices
- Cross-reference OUI with DHCP and DNS data — MAC address alone identifies the manufacturer; combine with hostname and IP for full device identification
- Account for MAC randomization — Mobile devices increasingly use random MACs; check the locally administered bit before trusting OUI results
- Maintain an internal MAC inventory — Track known device MACs alongside asset tags for rapid identification during security incidents
- Update OUI databases regularly — The IEEE assigns new OUIs weekly; use current databases for accurate lookups
- Use MAC filtering cautiously — MAC addresses can be spoofed; MAC filtering is a minor deterrent, not a security control
References & Citations
- IEEE Registration Authority. (2024). IEEE OUI Public Listing. Retrieved from https://standards.ieee.org/products-programs/regauth/ (accessed January 2025)
- IEEE Computer Society. (2016). IEEE 802 LAN/MAN Standards. Retrieved from https://ieeexplore.ieee.org/document/7428776 (accessed January 2025)
Note: These citations are provided for informational and educational purposes. Always verify information with the original sources and consult with qualified professionals for specific advice related to your situation.
Key Security Terms
Understand the essential concepts behind this tool
Frequently Asked Questions
Common questions about the MAC Address Lookup
A MAC (Media Access Control) address is a unique 48-bit identifier assigned to network interfaces by manufacturers. Written as six pairs of hexadecimal digits (e.g., 00:1A:2B:3C:4D:5E), the first three octets identify the manufacturer (OUI), while the last three are device-specific. MAC addresses operate at Layer 2 of the OSI model for local network communication.
OUI (Organizationally Unique Identifier) comprises the first 24 bits of a MAC address, identifying the manufacturer. IEEE assigns OUIs to hardware vendors who then assign unique device IDs. Companies like Apple (3C:06:30), Cisco (00:1E:14), and Intel (00:50:56) have multiple registered OUIs. Lookup tools use IEEE's public OUI database for identification.
Yes. While manufacturers assign MAC addresses, operating systems allow modification (MAC spoofing). This is useful for privacy, bypassing network restrictions, or testing. However, spoofing may violate network policies or laws in some jurisdictions. Most devices support changing MAC addresses through network settings or command-line tools, though some hardware has limitations.
Windows: Run "ipconfig /all" in Command Prompt, look for "Physical Address". Mac: System Preferences > Network > Advanced > Hardware, or run "ifconfig en0". Linux: Run "ip link show" or "ifconfig". Mobile devices: iOS Settings > General > About > Wi-Fi Address; Android Settings > About > Status > Wi-Fi MAC address. Each network interface has its own MAC.
Locally administered MAC addresses have the second-least significant bit of the first octet set to 1 (e.g., x2, x6, xA, xE in first octet). These are not globally unique and can be assigned by network administrators. Since iOS 14 and Android 10, devices use randomized private MAC addresses for Wi-Fi networks to enhance privacy.
Security teams use MAC lookup for network inventory (identifying unauthorized devices), forensics (tracking device manufacturers), access control (MAC filtering), rogue device detection, and incident response. While MAC addresses can be spoofed, lookup helps establish baseline inventory and detect anomalies. Combine with other factors for robust security rather than relying solely on MAC filtering.
MAC addresses are hardware identifiers assigned by manufacturers, permanent (though changeable), and work at Layer 2 for local network communication. IP addresses are logical identifiers assigned by networks, temporary (DHCP) or static, and work at Layer 3 for routing across networks. Devices need both: MAC for local switching, IP for internet routing.
IEEE updates the OUI database daily as manufacturers register new addresses. Public lookup tools should refresh their databases monthly minimum for accuracy. New device types (IoT, wearables) constantly emerge, requiring fresh assignments. The MA-L (24-bit OUI), MA-M (28-bit), and MA-S (36-bit) registries all receive regular updates from IEEE registration authority.
Batch lookup allows you to analyze multiple MAC addresses at once by entering them one per line or separated by commas. The tool automatically detects duplicates, showing you how many times each MAC appears, and processes up to 100 addresses in a single request. This is especially useful for network administrators analyzing network scans or device inventories.
Yes! The tool has a "Paste Network Output" mode that automatically extracts MAC addresses from ipconfig (Windows) or ifconfig (macOS/Linux) output. Just paste the entire command output, and the tool will find all MAC addresses, perform lookups, and detect any duplicates - perfect for quick network diagnostics.
EUI-64 (Extended Unique Identifier) converts a 48-bit MAC address into a 64-bit identifier used in IPv6 link-local addresses. The tool automatically generates the IPv6 address by inserting FF:FE in the middle of the MAC and flipping the 7th bit (U/L bit). This is essential for IPv6 networking and autoconfiguration.
The binary breakdown feature displays your MAC address in binary format, highlighting special bits like the I/G bit (Individual/Group for multicast) and U/L bit (Universal/Local for administration). This educational view helps you understand MAC address structure at the bit level and identify why certain addresses behave differently on networks.
No, absolutely not! Your lookup history is stored only in your browser's localStorage and never leaves your device. This privacy-first approach means your network investigation data stays completely private. You can clear your history at any time, and it's automatically limited to your 10 most recent lookups.
Type any vendor name (like "Apple" or "Cisco") and the tool automatically searches after you stop typing (300ms debounce). It queries our database of 38,000+ OUI entries and shows matching vendors with their assigned OUI prefixes. Click any result to instantly lookup a MAC address from that vendor.
When analyzing multiple MAC addresses (batch or network mode), duplicate detection automatically identifies MAC addresses that appear more than once and shows you the count. This is invaluable for finding devices with multiple interfaces, detecting network configuration issues, or identifying duplicated MAC addresses on your network.
Yes! The tool includes a random MAC generator with vendor selection. You can generate completely random MAC addresses or choose from 10 popular vendors (Apple, Cisco, Intel, etc.) to generate realistic MAC addresses using their actual OUI prefixes - perfect for network testing, simulation, or development work.