MAC Addresses: OUI Lookup & Vendor Guide

Every device that connects to a network — laptop, phone, server, smart thermostat, printer — has a MAC (Media Access Control) address. This 48-bit hardware identifier is assigned at the factory and burned into the network interface. While IP addresses can change depending on which network you join, the MAC address is tied to the physical hardware itself.

Knowing how to read and look up MAC addresses is a practical skill for anyone who manages a network, troubleshoots connectivity issues, or investigates unknown devices. The MAC Address Lookup Tool identifies the manufacturer behind any MAC address by checking the OUI (Organizationally Unique Identifier) assigned by the IEEE.

This guide covers the anatomy of a MAC address, how vendor identification works, the difference between MAC and IP addresses, and real scenarios where MAC lookups solve problems.

Anatomy of a MAC Address

A MAC address is 48 bits long, typically written as six pairs of hexadecimal digits separated by colons or dashes:

00:1A:2B:3C:4D:5E

The address is split into two halves:

First 3 octets (00:1A:2B): The OUI, assigned by the IEEE to a specific manufacturer. This is the part that identifies who made the network interface.
Last 3 octets (3C:4D:5E): The NIC-specific portion, assigned by the manufacturer to individual devices. This ensures that no two devices from the same manufacturer share a MAC address.

Together, the 48-bit address is meant to be globally unique. With 2^48 possible combinations (over 281 trillion), collisions are statistically improbable when addresses are assigned properly.

Notation Formats

You will encounter MAC addresses written in several styles depending on the operating system or device:

Format	Example	Common On
Colon-separated	00:1A:2B:3C:4D:5E	Linux, macOS
Dash-separated	00-1A-2B-3C-4D-5E	Windows
Dot-separated	001A.2B3C.4D5E	Cisco IOS
Raw hex	001A2B3C4D5E	Log files, databases

All four formats represent the same address. The MAC Address Lookup Tool accepts any of these formats and normalizes them before performing the lookup.

How OUI Vendor Lookup Works

The IEEE (Institute of Electrical and Electronics Engineers) maintains a public registry of OUI assignments. When a company like Apple, Intel, or Cisco wants to manufacture network hardware, it purchases one or more OUI blocks from the IEEE. Each block is a unique 24-bit prefix.

For example, the OUI 00:1B:63 belongs to Apple. Every device Apple manufactures with this prefix will have a MAC address starting with 00:1B:63. Large manufacturers own dozens of OUI blocks because they produce millions of devices per year, and each block only covers about 16.7 million unique addresses (2^24).

When you enter a MAC address into the MAC Address Lookup Tool, it extracts the first three octets, looks them up against a database of known OUI assignments, and returns the registered manufacturer name. If the OUI is not in the database, it reports “Unknown Manufacturer” — which can happen with smaller vendors, recently registered OUIs, or locally administered addresses.

Unicast vs. Multicast

The least significant bit of the first octet carries specific meaning:

Bit 0 = 0: The address is unicast, targeting a single network interface. This is the normal case for all standard device MAC addresses.
Bit 0 = 1: The address is multicast, targeting a group of interfaces. Broadcast frames use the special address FF:FF:FF:FF:FF:FF, which is a specific form of multicast that reaches every device on the local network segment.

In practice, every MAC address assigned by a manufacturer is unicast. If a lookup tool reports a multicast MAC address for what should be a regular device, something unusual is happening — possibly a misconfiguration, a software-defined interface, or a spoofed address.

How to Check the Bit

Take the first octet as a hex number and convert it to decimal. If the decimal value is odd, bit 0 is set, and the address is multicast. If even, it’s unicast.

For 00:1A:2B:3C:4D:5E, the first octet is 00 (decimal 0), which is even. This is a unicast address.

For 01:00:5E:00:00:01, the first octet is 01 (decimal 1), which is odd. This is a multicast address (specifically, an IPv4 multicast MAC used by protocols like IGMP).

UAA vs. LAA (Who Assigned the Address?)

The second least significant bit of the first octet tells you whether the address was assigned by the manufacturer or by software:

Bit 1 = 0: UAA (Universally Administered Address). The manufacturer assigned this address using their IEEE-registered OUI. The OUI lookup result is meaningful.
Bit 1 = 1: LAA (Locally Administered Address). Software or an administrator assigned this address, overriding the burned-in hardware address. The OUI lookup may not be meaningful because the first three octets were chosen arbitrarily.

LAA addresses are everywhere in modern networking:

Virtual machines (VMware, VirtualBox, Hyper-V) generate LAA addresses for virtual NICs. VMware uses the OUI 00:50:56 and 00:0C:29 by convention, but the addresses are still technically locally administered.
Docker containers receive LAA addresses from the Docker bridge network.
MAC randomization on smartphones generates LAA addresses when scanning for Wi-Fi networks, preventing retailers and trackers from identifying devices by their real hardware address.
Manual overrides by administrators or security tools that spoof a different MAC address for access control purposes.

MAC Address vs. IP Address

These two identifiers operate at different layers of the network stack and serve different purposes:

Property	MAC Address	IP Address
OSI Layer	Layer 2 (Data Link)	Layer 3 (Network)
Length	48 bits (6 octets)	32 bits (IPv4) or 128 bits (IPv6)
Assigned by	Manufacturer (burned-in)	Network (DHCP or static config)
Scope	Local network segment only	Global (routable across the internet)
Changes?	Fixed (unless spoofed)	Changes when you join a different network
Used for	Frame delivery on the local LAN	Packet routing across networks

When your laptop sends a packet to a server on the internet, the packet’s IP header contains the destination IP address, which remains constant across all hops. But the Ethernet frame wrapping that packet has a MAC destination that changes at every router hop — it always reflects the next physical device the frame needs to reach. Your laptop’s frame goes to the router’s MAC address. The router strips the frame, creates a new one with the next hop’s MAC, and forwards it.

This is why MAC addresses only matter on the local network segment. Once a packet passes through a router, the original MAC addresses are gone.

When MAC Address Lookups Are Useful

Identifying Unknown Devices on Your Network

You check your router’s DHCP lease table and see a device you don’t recognize. The hostname is generic (like “android-abc123” or just an IP address). Plugging the MAC address into the MAC Address Lookup Tool reveals that the manufacturer is “Espressif (ESP32),” which tells you it’s probably a smart home device with an ESP32 microcontroller. Without the OUI lookup, you would have no quick way to identify it.

Network Security Auditing

Security teams use MAC lookups during network assessments to build an inventory of device manufacturers on a network. Finding unexpected vendors — like a Raspberry Pi Foundation OUI on a corporate network that doesn’t use Raspberry Pi devices — can flag unauthorized hardware.

Troubleshooting Duplicate IP Addresses

If two devices have the same IP address (a common misconfiguration), ARP tables will show conflicting MAC addresses for that IP. Looking up both MAC addresses identifies which devices are fighting over the address, making it easier to fix the conflict.

Verifying Hardware Authenticity

Counterfeit network equipment sometimes uses OUIs that don’t match the claimed manufacturer. If a switch claims to be a Cisco device but its MAC address resolves to an unknown or different vendor, further investigation is warranted.

Wi-Fi Access Control

Some networks use MAC-based access lists (MAC filtering) as a basic security layer. While this isn’t strong security (MAC addresses can be spoofed), knowing which OUI ranges belong to authorized device types helps administrators build and audit these lists.

MAC Address Randomization and Privacy

Starting around 2014, mobile operating systems began randomizing the MAC address used during Wi-Fi probe requests — the frames your phone broadcasts when looking for known networks. Previously, retailers and analytics companies could track foot traffic by logging the static MAC addresses of phones passing by their Wi-Fi access points.

Today, iOS, Android, and Windows all randomize probe request MAC addresses by default. Some implementations go further:

iOS 14+ uses a unique random MAC address per SSID. Your phone presents a different MAC to your home network than to the coffee shop network.
Android 10+ enables per-network randomization by default.
Windows 10/11 offers optional random hardware addresses per Wi-Fi network.

These randomized addresses are always LAA (locally administered), which means the OUI doesn’t correspond to a real manufacturer. If you see an LAA address in your router’s connected device list, it may be a privacy-randomized address rather than the device’s actual hardware MAC.

How to Find Your Own MAC Address

Each operating system exposes the MAC address differently:

Windows: Open Command Prompt and run ipconfig /all. Look for “Physical Address” under your network adapter.
macOS: Open System Settings, click Network, select your connection, and find “MAC Address” in the hardware details.
Linux: Run ip link show in the terminal. The MAC appears after the word “ether.”
iPhone: Go to Settings > General > About and look for “Wi-Fi Address.”
Android: Go to Settings > About Phone > Status and look for “Wi-Fi MAC address.”

Note that on phones, the displayed address may be the randomized per-network address rather than the true hardware address.

Frequently Asked Questions

Can two devices have the same MAC address?

In theory, no. The OUI + NIC-specific structure ensures global uniqueness. In practice, collisions can occur with cheap hardware that doesn’t follow IEEE standards, locally administered addresses assigned without coordination, or intentional spoofing. Two devices with the same MAC on the same network segment will cause connectivity problems.

Is MAC address filtering good security?

It is a weak layer of defense. MAC addresses can be spoofed in seconds on any operating system. A determined attacker observes allowed MAC addresses from network traffic and clones one. MAC filtering should never be the only security measure, but it can complement stronger controls like WPA3 authentication and 802.1X.

Why does my phone show a different MAC address on different Wi-Fi networks?

Modern phones use per-network MAC randomization for privacy. Each saved network gets a persistent but random MAC address. This prevents cross-network tracking while still allowing the network to recognize your device on subsequent connections.

What is the broadcast MAC address?

The broadcast address is FF:FF:FF:FF:FF:FF. Frames sent to this address are delivered to every device on the local network segment. Protocols like ARP (Address Resolution Protocol) and DHCP use broadcast frames to discover other devices and request network configuration.

How many OUI prefixes does a large manufacturer own?

Companies like Apple, Samsung, and Intel own dozens to hundreds of OUI blocks. Each block covers about 16.7 million unique addresses (2^24 NIC-specific combinations). When a manufacturer exhausts one block, it registers another with the IEEE. The IEEE also offers smaller assignment blocks (MA-M and MA-S) for companies with lower volume needs.