MAC Address / OUI Lookup

Identify the hardware vendor of a network device by looking up the Organizationally Unique Identifier (OUI) in the IEEE registry.

TL;DR

The first three bytes of a MAC address are the OUI (Organizationally Unique Identifier), which the IEEE assigns to hardware manufacturers. A MAC lookup queries the IEEE public registry to identify the vendor that manufactured a network interface. It is a local-network-only technique — MAC addresses do not traverse router hops.

What it is

Every network interface — Ethernet port, Wi-Fi card, Bluetooth adapter — is supposed to have a unique 48-bit hardware address called a MAC address (Media Access Control address). This address is used at Layer 2 (data link layer) to identify devices on the same local network segment.

The IEEE Registration Authority allocates blocks of OUIs to manufacturers. When Apple, Cisco, Intel, or any other vendor wants to produce network hardware, they purchase an OUI assignment. They are then responsible for uniquely assigning the remaining 24 bits (the NIC-specific part) to each device.

How it works

A MAC address is 48 bits, written as six colon-separated hex octets:

  00:1A:2B:3C:4D:5E
  ├──────┤ └──────┤
  OUI     NIC-specific
  (manufacturer)  (device ID)

The OUI is the first three octets (00:1A:2B in this example). Bit flags within the first octet also carry meaning:

• Bit 0 (least significant): Unicast (0) or Multicast (1)
• Bit 1: Globally administered (0) or Locally administered (1)

A locally administered bit means the OUI was not assigned by the IEEE — the address was set by software (including MAC randomization). An OUI lookup on a locally-administered MAC will return "locally administered" or no match rather than a manufacturer name.

The lookup queries the IEEE public OUI database (updated regularly), matching the first three bytes to the registered company name and address.

When to use it

• Identify unknown devices on a local network from DHCP leases, ARP tables, or Wi-Fi association lists
• Audit what hardware manufacturers are present on a corporate network
• Investigate a suspicious device seen in network logs
• Verify whether a MAC is globally registered or locally administered (randomized)
• Identify the vendor of a Wi-Fi access point from its BSSID
• Cross-check DHCP hostname with the manufacturer implied by the OUI

Running it on networktoolkit.io

Select mac_lookup, enter a full MAC address or just the first three octets (OUI), and the lookup queries the IEEE registry. Accepted formats: 00:1a:2b:3c:4d:5e, 00-1a-2b-3c-4d-5e, 001a2b3c4d5e, or just 00:1a:2b. Sample output:

Input:    00:1A:2B:3C:4D:5E
OUI:      00:1A:2B
Vendor:   Cisco Systems, Inc.
Address:  170 West Tasman Dr.
          San Jose, CA 95134
          US
Type:     globally administered, unicast

Full address:
  00:1A:2B = Cisco (OUI)
  3C:4D:5E = NIC-specific (Cisco assigns this block)

For a randomized or locally administered MAC:

Input:    72:4F:B1:8A:3D:21
OUI:      72:4F:B1
Flags:    locally administered, unicast
Vendor:   (no match — locally administered OUI)
Note:     This MAC was likely assigned by the OS (MAC randomization)
          rather than burned into hardware at manufacturing time.

Reading the results

OUI registration types

The IEEE offers several OUI block sizes:

Limitations & gotchas

• MAC addresses are local-segment only. They are stripped and replaced at every router hop. You cannot query someone's MAC address from the internet — only from the same Layer 2 network.
• MAC randomization is now default on iOS (14+), Android (10+), and Windows (11). A "locally administered" flag or a failed OUI lookup is normal for modern mobile devices connecting to Wi-Fi.
• VM and container interfaces often have locally administered MACs generated by the hypervisor or container runtime.
• OUI spoofing is trivial. A MAC that looks like Apple or Cisco could be any device that set that prefix in software.
• The IEEE database has coverage gaps. Some legitimate OUIs were registered under corporate names that were later acquired, renamed, or dissolved. A failed lookup does not always mean a suspicious device.
• Multicast MACs (first octet low bit set) identify multicast groups, not physical devices. Common examples: 01:00:5E:xx:xx:xx (IPv4 multicast), 33:33:xx:xx:xx:xx (IPv6 multicast).

Security & privacy notes

Within a local network, MAC addresses are visible to any device on the same broadcast domain. Historically this enabled tracking: a device's globally unique MAC allowed correlation across different Wi-Fi networks. MAC randomization directly addresses this — the device presents a different locally-administered MAC per network, breaking cross-network tracking.

For network operators, MAC-based access control (Wi-Fi MAC filtering) is a weak security control precisely because MACs are trivially spoofed. It is no substitute for 802.1X port-based authentication or WPA3-Enterprise.

Standards & references

• IEEE Registration Authority
• IEEE OUI Public Registry
• RFC 7042 — IANA Considerations and IETF Protocol and Documentation Usage for IEEE 802 Parameters
• IEEE 802.3 — Ethernet standard (defines MAC address usage)
• IEEE 802.11 — Wi-Fi standard (BSSID follows same OUI structure)

FAQ

Can MAC addresses be faked or spoofed?

Yes. MAC spoofing is straightforward on all major operating systems and is used legitimately for privacy (MAC randomization) and network testing. A lookup tells you what the OUI represents, not whether that address is authentic.

My phone shows a random MAC — is something wrong?

No. iOS (from version 14), Android (from version 10), and Windows 11 randomize MAC addresses when connecting to Wi-Fi networks as a privacy feature. The random MAC may return no OUI match or an unexpected vendor (the "locally administered" flag will be set).

Why can't I look up someone's MAC address over the internet?

MAC addresses are Layer 2 identifiers. They are stripped and replaced at every router hop. An internet packet carries only the Layer 3 IP address; the MAC is only visible within a local Ethernet or Wi-Fi segment.

Can two devices have the same MAC address?

Theoretically no — the space is 2⁴⁸ addresses. In practice, MAC conflicts occur on local networks due to spoofing, cloning, or (rarely) manufacturing defects. Within a single broadcast domain, a conflict causes network disruption.

What is the difference between a MAC address and a BSSID?

A BSSID (Basic Service Set Identifier) is the MAC address of a Wi-Fi access point's radio interface. It follows the same OUI structure, so an OUI lookup on a BSSID will tell you the manufacturer of the access point.