MAC Address Lookup

What a MAC address tells you

A MAC address is a 48-bit hardware address written as six pairs of hex digits, such as 00:50:56:AB:CD:EF. Switches use it to deliver frames on a local network, so every network interface has one. The same address appears with different punctuation depending on the system: colons on Linux and macOS, hyphens on Windows, and dotted groups of four digits (0050.56ab.cdef) on Cisco devices. This tool accepts all of them, and also plain digits with no separators.

The first 24 bits are the Organizationally Unique Identifier (OUI), assigned by the IEEE to the company that registered it. The remaining bits are chosen by that company to give each device a different address. Looking up the OUI therefore tells you who registered the block.

MA-L, MA-M, and MA-S blocks

The IEEE Registration Authority hands out three sizes of block. A large block (MA-L) is a 24-bit prefix with about 16.7 million addresses. A medium block (MA-M) is a 28-bit prefix with 1,048,576 addresses, and a small block (MA-S) is a 36-bit prefix with 4,096 addresses. The medium and small blocks are carved out of MA-L prefixes that the IEEE keeps for itself, which is why you sometimes see "IEEE Registration Authority" for the first six digits. To find the real owner the lookup needs more digits, so this tool checks the longest match first and asks for the full address when it needs it.

Randomized and locally administered addresses

Two bits in the first octet carry meaning. The lowest bit says whether the address is individual (0) or a group/multicast address (1). The next bit says whether the address is universally administered, meaning assigned from an IEEE block (0), or locally administered, meaning set by software (1). In hex, a first octet whose second digit is 2, 6, A, or E is locally administered and unicast.

This matters more than it used to. Modern phones and laptops can use a random, per-network Wi-Fi address instead of the real hardware address to make tracking harder. These addresses are locally administered, so no vendor lookup will succeed, and that is the correct result rather than a failure of the tool. Virtual machines behave similarly: the common KVM and QEMU prefix 52:54:00 is locally administered and not in the registry. By contrast, VMware (00:50:56), VirtualBox (08:00:27, registered to PCS Systemtechnik), and Microsoft Hyper-V (00:15:5D) use registered prefixes, so they do show a vendor.

When to use a MAC lookup

• Identifying an unknown device. Take an address from a DHCP lease table, an ARP table, or a switch's MAC address table and see whether it belongs to a printer, a phone, or something that should not be there.
• Spotting rogue equipment. An unexpected vendor on a restricted VLAN is a quick lead when you audit a network.
• Troubleshooting. Matching an address to a vendor can tell you whether a flapping entry comes from a switch, a hypervisor, or a client.
• Inventory work. Batch lookups label a spreadsheet of addresses without checking each one by hand.

To find your own address, run ipconfig /all on Windows (look for "Physical Address") or ip link on Linux. On macOS, ifconfig shows it as "ether".

Limits to keep in mind

• The vendor is who registered the block. A laptop with an Intel Wi-Fi card will show Intel, not the laptop's brand, because the network chip carries the address.
• Addresses can be changed. Anyone can set a MAC address in software, so it is a clue and not proof of identity.
• Registry data ages. New assignments appear constantly. This tool uses a snapshot of the public IEEE registries from October 2026, so a very recent assignment may be missing.

The registry is stored as a single file of about 1.6 MB (roughly 550 KB compressed) that your browser downloads from this site the first time you run a lookup and then searches locally. The data comes from the public IEEE OUI registries.

Related tools and guides

Frequently asked questions