MAC address and OUI lookup
Paste an address in any format and get the manufacturer from the IEEE registry, and, more usefully, what the address itself says. Two bits in the first octet decide whether there is a manufacturer to find at all, and increasingly there is not.
Why a MAC address lookup so often finds nothing
A MAC vendor lookup can only succeed if the address was assigned by the IEEE, and a large and growing share of the addresses you will meet on a network were not. Since iOS 14, Android 10, Windows 10 and recent macOS, every device generates a fresh random MAC address for each wireless network it joins, and keeps the real one to itself. That is the default, not an option somebody turned on.
A randomised address is a locally administered address: it belongs to nobody, appears in no registry, and never will. Most lookup sites answer "not found" and leave you wondering whether their data is stale. It is not: the address genuinely has no owner, and the address itself says so, in one bit.
The two bits nobody reads
Only the first octet matters here, and only its two least significant bits.
- Bit 0: unicast or multicast. Clear means the address identifies one interface. Set means it names a group of listeners, and it can then only ever be a destination: no frame is ever sent from a multicast address.
- Bit 1: globally unique or locally administered. Clear means the first three octets are an IEEE assignment and there is a manufacturer to look up. Set means the address was invented locally, and there is not.
The shortcut worth memorising: for a normal unicast address, if the
second character is 2, 6, A or E, it is locally
administered. 7a:9f:2c:… is a randomised phone.
52:54:00:… is a QEMU or KVM guest. 02:42:… is a
Docker container. None of them will ever appear in an OUI lookup, and
that is the correct result rather than a gap in the data.
MA-L, MA-M and MA-S: why prefix length matters
An OUI lookup is usually described as matching the first three octets, and for a large assignee that is right: an MA-L block is 24 bits of prefix and 16.7 million addresses. But the IEEE also sells smaller blocks. An MA-M is 28 bits and about a million addresses; an MA-S is 36 bits and 4,096 addresses, which is what a company shipping a few thousand units a year actually needs.
The /24s those smaller blocks are carved out of are registered to the
IEEE Registration Authority itself. So a tool that only ever matches 24
bits will confidently tell you that a device made by one of the seven
thousand companies sharing 70-B3-D5 was made by the IEEE.
This one matches the longest prefix first, names the registry it matched
in, and says plainly when an address falls inside a subdivided block that
has no assignee.
Addresses that are not devices
Some addresses you will find in a capture are not identifying hardware at all, and looking up their MAC address manufacturer is the wrong question:
ff:ff:ff:ff:ff:ff: broadcast. Every interface on the segment accepts it. ARP requests and DHCP discovers go here.01:00:5e:…: IPv4 multicast. The low 23 bits are copied from the group address, so 32 different IPv4 groups share one MAC and a host still has to filter in software.33:33:…: IPv6 multicast, carrying the low 32 bits of the group address.33:33:ff:…is a solicited-node address: neighbour discovery, IPv6's replacement for ARP.01:80:c2:00:00:00: spanning tree. Seeing BPDUs on an access port usually means something is bridging that should not be.00:00:5e:00:01:xxand00:00:0c:07:ac:xx: VRRP and HSRP virtual routers. The last octet is the group number, and the address moves between physical routers on failover.
For a globally unique unicast address the tool also shows the IPv6 link-local address the interface will configure for itself, which is derived from the MAC by modified EUI-64. If you are chasing an address that never got that far, 169.254 addresses and what they mean covers the IPv4 equivalent, and destination host unreachable is usually an ARP failure, which is to say, a MAC address that was never learned.
Nothing is sent to us
The IEEE registry ships with this page as static JSON, split by first octet so a lookup downloads only the slice it needs. The match happens in your browser. The address you type is never transmitted anywhere, because there is no server to transmit it to: the same as the subnet calculator, and unlike the DNS lookup, which has to ask a resolver.