MAC Address Lookup

The complete IEEE registry, not a sample

This looks up all 35,084 registered OUI assignments from the IEEE registration authority — the same data behind Wireshark's vendor column. The dataset is fetched once from our own server (about 330 KB compressed) and cached by your browser; the lookup itself happens locally. We never see what you searched for.

Many free MAC lookups only cover a few hundred well-known vendors and quietly report "unknown" for everything else. If a lookup here says not found, the OUI genuinely is not in the public registry.

How a MAC address is put together

Six octets. The first three are the OUI — Organisationally Unique Identifier — bought from the IEEE by the manufacturer. The last three are assigned by that manufacturer to individual interfaces. A large vendor like Cisco holds hundreds of OUIs, which is why two Cisco devices can have completely different-looking addresses.

Two bits in the very first octet carry meaning of their own:

• Least significant bit — unicast (0) or multicast (1). ff:ff:ff:ff:ff:ff is broadcast, 01:00:5e:… carries IPv4 multicast, 33:33:… carries IPv6 multicast.
• Second-least significant bit — universally administered (0, burned in by the vendor) or locally administered (1, randomised or set by hand). A locally administered address has no vendor to look up, by definition.

MAC randomisation broke a lot of assumptions

iOS, Android, Windows and macOS now randomise the MAC address per network by default. That is good for privacy and genuinely disruptive to a lot of established practice:

• MAC-based device inventories no longer work. The same laptop presents a different address on each SSID, and may rotate it.
• MAC filtering as access control was never security — addresses are trivially spoofable — and now it is not even reliable as a convenience.
• DHCP reservations by MAC break for client devices. Reserve for infrastructure; use 802.1X or a captive portal for users.
• Guest-wifi session tracking over-counts devices, sometimes badly.

If your network still depends on a stable client MAC for anything load-bearing, that is worth revisiting. It is a common finding when we look at an existing network design.

The IPv6 link-local address

We also derive the modified EUI-64 link-local address, which is how a device self-assigns an IPv6 address from its MAC: flip the universal/local bit, insert ff:fe in the middle, prefix with fe80::. Useful when you have a MAC from a switch table and need to reach the device over IPv6, and useful to recognise — an IPv6 address containing ff:fe in the middle is very likely EUI-64 derived, which means it leaks the hardware address. Privacy extensions (RFC 4941) exist precisely to avoid that.

Where a MAC actually helps

Tracing a rogue device through switch CAM tables. Identifying what a mystery IP on a camera VLAN actually is before you unplug it. Confirming a replacement access point is the model you ordered. Spotting a consumer switch someone added under a desk. All of it easier when you can name the vendor from the address.