Article Summary: This article explains what a MAC address is, how the OUI system works, how MAC address vendor lookup is performed using the IEEE registration database, and what the tool's practical applications are in network management and security. It covers MAC address format, the multicast and locally-administered bits, address randomization, and answers common questions about device identification from MAC addresses.
What Is MAC Address Lookup?
A MAC address lookup — also called an OUI lookup or vendor lookup — identifies the manufacturer of a network device from the first three bytes of its MAC address. These three bytes form the OUI (Organizationally Unique Identifier), a code that is registered exclusively with the IEEE (Institute of Electrical and Electronics Engineers) by every company that manufactures network hardware.
Enter any MAC address in any common format — colon-separated (00:1A:2B:3C:4D:5E), dash-separated (00-1A-2B-3C-4D-5E), or as a plain hex string (001A2B3C4D5E) — and this tool extracts the OUI and matches it against the current IEEE registration database to return the manufacturer's name instantly.
This tool is used by network administrators, security professionals, and forensic analysts for hardware identification, network inventory management, rogue device detection, and Wi-Fi device classification.
How It Works
The MAC Address Structure
A MAC address (formally an EUI-48 address) is a 48-bit value typically written as six pairs of hexadecimal digits. It is permanently programmed into a device's network interface controller at the factory, though software can override it with a locally administered address. The 48 bits are divided into two logical halves: the OUI (first 24 bits, assigned by the IEEE to the manufacturer) and the NIC-specific portion (last 24 bits, assigned by the manufacturer to the individual device).
Two special bits within the OUI carry structural meaning. The multicast bit (bit 0 of the first byte) indicates whether the address is a unicast address (bit = 0, identifying a single device) or a multicast/broadcast address (bit = 1, identifying a group). The locally administered bit (bit 1 of the first byte) indicates whether the address was assigned by the manufacturer (bit = 0, globally unique) or set by software on the local device (bit = 1, locally administered).
The IEEE OUI Registration Database
The IEEE maintains the public OUI registry — a database of all registered OUI assignments, updated continuously as manufacturers register new prefixes. Any company that manufactures network hardware must purchase an OUI from the IEEE to guarantee globally unique MAC addresses for their devices. The IEEE publishes this database publicly, making it the definitive source for MAC address vendor lookup.
The IEEE also administers extended registries: the MA-M (MAC Address Block Medium) for companies needing a smaller allocation, and the MA-S (MAC Address Block Small) for very small batches. Both are included in the public OUI lookup database.
How the Lookup Executes
The tool normalizes the input MAC address, strips formatting characters, and extracts the first six hexadecimal characters (three bytes). It then queries the current IEEE OUI database for a matching registration. If a match is found, the manufacturer name is returned. If no match is found — which can occur for locally administered addresses, virtual machine MACs, or very new or obscure hardware — the result is reported as unknown.
Common Use Cases
Network Inventory and Device Classification
Network administrators use MAC address vendor lookup as part of network discovery and inventory. When scanning a network with tools like nmap or the ARP table, a list of MAC addresses reveals what types of devices are connected — identifying Apple iPhones, Cisco switches, Raspberry Pis, or IP cameras by their OUI without needing to query the devices themselves. This is invaluable in large enterprise networks where manually cataloguing device types is impractical.
Rogue Device Detection
Security teams use OUI lookups to identify unauthorized devices on a network. If an ARP table entry shows a MAC address with an OUI registered to a consumer electronics company on a corporate network segment that should only contain known enterprise hardware, that is a strong signal worth investigating. Similarly, a MAC with no registered OUI may indicate a spoofed or locally administered address — a common technique in network attacks.
Wi-Fi and Wireless Network Analysis
In Wi-Fi device identification, OUI lookup helps classify devices probing or connected to wireless networks. Wi-Fi access points broadcast the MAC addresses of connected clients; identifying the manufacturer from the OUI helps classify traffic by device type — separating smartphones from laptops from IoT devices — and can identify unauthorized access points (rogue APs) by their OUI.
Network Forensics
In network forensics, MAC addresses captured in packet captures or DHCP logs help reconstruct which physical devices were present on a network segment at a given time. OUI lookup translates raw MAC addresses into manufacturer context, making forensic reports more readable and actionable for non-technical stakeholders.
Technical Reference
| Component | Bits | Example | Purpose |
|---|---|---|---|
| OUI (first 3 bytes) | 24 bits | 00:1A:2B | Identifies the manufacturer; registered with IEEE |
| NIC-specific (last 3 bytes) | 24 bits | 3C:4D:5E | Unique device identifier assigned by the manufacturer |
| Multicast bit (bit 0 of byte 1) | 1 bit | 0 = unicast, 1 = multicast | Distinguishes unicast (single device) from multicast/broadcast addresses |
| Locally administered bit (bit 1 of byte 1) | 1 bit | 0 = global, 1 = local | Indicates whether the address is globally assigned (factory) or locally overridden by software |
Frequently Asked Questions
What is a MAC address?
A MAC address (Media Access Control address) is a 48-bit hardware identifier permanently assigned to a network interface controller. It operates at Layer 2 of the OSI model (the Data Link layer) and is used to identify devices within a local network segment. Unlike IP addresses, which can change and are assigned by network administrators, MAC addresses are globally unique and assigned by the device manufacturer — though modern operating systems can override them with randomized locally administered addresses.
What is an OUI?
An OUI (Organizationally Unique Identifier) is the first three bytes (24 bits) of a MAC address, registered exclusively with the IEEE by the hardware manufacturer. Every company that manufactures network hardware must obtain an OUI to ensure their devices have globally unique MAC addresses. The IEEE's public OUI database maps each registered prefix to its owning organization, enabling the vendor lookup this tool performs.
Can I find a device's exact model from its MAC address?
The OUI (first three bytes) identifies only the manufacturer — not the specific product, model, or generation. For example, an OUI registered to Apple Inc. could belong to any Apple device: an iPhone, MacBook, Apple Watch, or AirPods. The last three bytes (NIC-specific portion) are assigned by the manufacturer and typically do not encode model information in any standardized way. In some cases, firmware or DHCP option 12 (hostname) may provide additional context, but MAC address alone does not reveal the model.
Why does my device show a randomized MAC address?
Modern mobile operating systems — including iOS 14+ and Android 10+ — use MAC address randomization as a privacy feature. When scanning for Wi-Fi networks before connecting, the device uses a randomly generated locally administered MAC address rather than its true hardware MAC. This prevents tracking across locations by Wi-Fi access points that log probe requests. The randomized MAC has the locally administered bit set (bit 1 of byte 1 = 1), which is why OUI lookup returns "unknown" or shows no manufacturer — the first three bytes do not correspond to any registered OUI.
Is MAC address lookup legal?
Yes. MAC address lookup queries the IEEE's publicly available OUI registration database — data that is freely published by the IEEE itself. No private information, personal data, or access-controlled systems are involved. The OUI database contains only company names and their registered MAC prefixes. Using this information for network administration, security research, device inventory, or forensic analysis is entirely lawful in all jurisdictions.
Conclusion and Takeaways
MAC address lookup is a fast, reliable way to identify the manufacturer of any network device from its hardware address. By querying the IEEE OUI registration database, this tool resolves the first three bytes of any MAC address to its registered organization — giving network administrators, security professionals, and forensic analysts immediate manufacturer context without requiring physical access to the device. From rogue device detection to Wi-Fi client classification, OUI lookup is an essential capability in any network toolkit.
Ready to Check?
Use MAC Address Lookup above — no login required, instant results.