MAC Address Vendor Lookup

MAC Address Vendor Lookup

Enter a MAC address such as 28:8E:EC:12:34:56 or 28-8E-EC-12-34-56 and the tool returns the manufacturer that registered its prefix, with the company address from the IEEE registry. The lookup uses the IEEE MA-L (OUI) list, which holds about 35,000 prefixes.

How MAC addresses are built

A MAC address is a 48-bit identifier for a network interface, written as six hex bytes. The first three bytes are the Organizationally Unique Identifier (OUI) that the IEEE sells to a manufacturer. The last three bytes are the serial the manufacturer assigns to each interface. In 28:8E:EC:12:34:56, the OUI 28:8E:EC belongs to Apple.

Two bits in the first byte carry meaning:

• Bit 0 (I/G): set means a multicast or broadcast address, such as 01:00:5E:... for IPv4 multicast or FF:FF:FF:FF:FF:FF for broadcast.
• Bit 1 (U/L): set means a locally administered address. Software chose it, and no vendor registered it. If the second hex digit is 2, 6, A or E (for example DA:A1:19:...), the address is locally administered.

Why a lookup may come back empty

• Randomized addresses: iOS, Android, Windows and macOS use a random, locally administered MAC on Wi-Fi networks by default. Those addresses don't map to any vendor.
• Smaller blocks: the IEEE also sells MA-M (28-bit) and MA-S (36-bit) blocks to small manufacturers. This tool matches the 24-bit MA-L list only.
• Virtual interfaces: VMs and containers get prefixes owned by the hypervisor vendor, such as 00:50:56 for VMware or 52:54:00 for QEMU/KVM (a locally administered prefix with no registry entry).

Uses

• Identify an unknown device in your router's DHCP lease list or an arp -a output.
• Spot a printer, camera or IoT device on a network scan by its manufacturer.
• Check what kind of hardware sits behind a switch port during troubleshooting.

Limits of MAC addresses

Anyone can change a MAC address in software, so MAC filtering on Wi-Fi stops casual users but not an attacker who copies an allowed address. MAC addresses also stay inside the local network segment. Routers replace them at each hop, so a website can't see your MAC.