MAC Address Lookup

Understanding MAC Addresses

A MAC (Media Access Control) address is a hardware identifier assigned to every network interface controller (NIC) -- the component that connects a device to a network. Operating at Layer 2 (the Data Link layer) of the OSI networking model, MAC addresses are fundamental to how devices communicate on local network segments. Every Ethernet port, Wi-Fi adapter, and Bluetooth radio has its own unique MAC address, which is typically programmed into the hardware by the manufacturer during production. The MAC address is a 48-bit value, conventionally written as six pairs of hexadecimal digits separated by colons (AA:BB:CC:DD:EE:FF) or hyphens (AA-BB-CC-DD-EE-FF).

Unlike IP addresses, which operate at Layer 3 and can change when a device moves between networks, MAC addresses are designed to be permanent, hardware-level identifiers. When a device sends data on a local network, the Ethernet frame includes both the source and destination MAC addresses. Switches use MAC address tables to forward frames only to the port where the destination device is connected, rather than flooding every port. This is the basis of efficient Layer 2 switching and is why MAC addresses are essential to modern networking.

OUI: Identifying the Manufacturer

The first three bytes (24 bits) of a MAC address form the Organizationally Unique Identifier (OUI), which is assigned and managed by the IEEE (Institute of Electrical and Electronics Engineers). Any organization that manufactures network hardware must purchase an OUI block from the IEEE, which then gives them exclusive use of that prefix. This means you can identify the manufacturer of a network adapter simply by looking up its OUI prefix. For example, 00:50:56 identifies VMware virtual network adapters, DC:A6:32 identifies Raspberry Pi devices, and AC:DE:48 identifies Apple products. The remaining three bytes (the NIC-specific portion) are assigned by the manufacturer, ensuring that every device receives a globally unique address within their OUI block.

Unicast, Multicast, and the Special Bits

Two specific bits in the first byte of a MAC address carry important meaning. Bit 0 (the least significant bit) determines whether the address is unicast (bit = 0, targeting a single interface) or multicast (bit = 1, targeting a group of interfaces). The broadcast address FF:FF:FF:FF:FF:FF is a special multicast address that reaches every device on the local network. Bit 1 determines whether the address is globally unique (bit = 0, a Universally Administered Address assigned by the manufacturer) or locally administered (bit = 1, set by software or an administrator). Virtual machines, Docker containers, and Xen hypervisors typically use locally administered addresses since they generate MAC addresses programmatically rather than relying on physical hardware assignments.

MAC Address Randomization and Privacy

Because MAC addresses are unique and persistent, they can be used to track devices across locations. Retailers, airports, and advertisers have used MAC address tracking to monitor foot traffic and identify returning visitors. In response, major operating systems introduced MAC address randomization. Apple's iOS began randomizing MAC addresses during Wi-Fi scans in iOS 8 (2014) and expanded this to per-network randomization in iOS 14. Android 10 and Windows 10 followed with similar features. When randomization is active, the device generates a locally administered MAC address (with bit 1 set to 1) instead of revealing its true hardware address. This is why locally administered addresses have become increasingly common in real-world network traffic, and why you may see "Unknown" manufacturers for randomized addresses in this tool.

Where MAC Addresses Appear

Network administrators encounter MAC addresses in several contexts. ARP (Address Resolution Protocol) tables map IP addresses to MAC addresses on local networks. DHCP servers log the MAC addresses of devices that request IP leases. Wireless access points maintain association tables of connected client MAC addresses. Network switches build CAM (Content Addressable Memory) tables that associate MAC addresses with physical ports. Firewalls and access control lists can filter traffic based on MAC addresses, although this is easily bypassed by changing a device's MAC address in software, a process known as MAC spoofing.

Frequently Asked Questions

What is a MAC address?

A 48-bit hardware identifier assigned to every network interface controller. Written as six hex pairs (e.g., AA:BB:CC:DD:EE:FF), it operates at Layer 2 for local network communication.

What is an OUI prefix?

The first 3 bytes of a MAC address, assigned by the IEEE to manufacturers. Looking up the OUI tells you which company made the network adapter.

What is unicast vs multicast?

Bit 0 of the first byte: 0 = unicast (single device), 1 = multicast (group of devices). The broadcast address FF:FF:FF:FF:FF:FF is a special multicast.

What is globally unique vs locally administered?

Bit 1 of the first byte: 0 = assigned by manufacturer (globally unique), 1 = set by software (locally administered). VMs and randomized addresses use locally administered.

What is MAC address randomization?

A privacy feature in iOS, Android, and Windows that generates random locally administered MACs during Wi-Fi scans, preventing device tracking.