MAC Address Lookup

About the MAC Address Lookup

Paste a MAC address — or a whole arp -a listing, an ip neigh table, a DHCP lease file or a switch’s MAC address table — and see who registered each address block, from the IEEE Registration Authority’s public MA-L, MA-M and MA-S listings plus the older IAB and the CID listings: 58,907 assignments in all. Every address in the text is found, with the IP address from the same line next to it.

The tool also reads what the address itself says: unicast or multicast, and universally administered (set by the manufacturer) or locally administered — which is what the randomised “private” Wi-Fi addresses of phones and laptops, virtual machines and containers use. It names well-known addresses such as broadcast, IPv4 and IPv6 multicast, Spanning Tree, LLDP and VRRP, converts between colon, hyphen, Cisco dotted and bare notation in bulk, shows the IPv6 link-local address a MAC would produce, and makes random MAC addresses for testing. Everything runs in your browser.

Common uses

• Identifying unknown devices in your router’s client list or an arp -a listing — a TP-Link plug, an Espressif-based smart device, a Raspberry Pi.
• Telling a phone’s randomised private Wi-Fi address apart from its real one when MAC filtering or DHCP reservations stop working.
• Converting MAC addresses between Cisco, Linux, Windows and database formats for firewall rules, DHCP reservations, NAC lists and inventories.
• Decoding multicast and reserved destination addresses in Wireshark captures (STP, LLDP, LACP, VRRP, IPv6 Neighbor Discovery).
• Making unique locally administered MAC addresses for virtual machines, containers and lab networks.

What the first byte of a MAC address tells you

A MAC address is 48 bits, written as six bytes. The two lowest bits of the first byte have fixed meanings (IEEE RA guidelines for EUI, OUI and CID):

• I/G bit (bit 0): 0 = an individual (unicast) address, 1 = a group (multicast) address. FF-FF-FF-FF-FF-FF, all ones, is the broadcast address for every station.
• U/L bit (bit 1): 0 = universally administered, from a block the IEEE assigned to a manufacturer, meant to be globally unique; 1 = locally administered, set by software or an administrator.

So the second hex digit gives it away: 0, 4, 8 or C is a manufacturer-assigned unicast address; 2, 6, A or E is locally administered (random) unicast; an odd digit means multicast. IEEE 802c-2017 splits the local space into four quadrants, the Structured Local Address Plan: 2 = administratively assigned (AAI, for random or hand-picked addresses), A = extended local identifiers built from a company ID (ELI), E = addresses assigned by standard protocols (SAI) and 6 = reserved.

Random and private Wi-Fi addresses

Phones and laptops now hide their burned-in address on Wi-Fi to stop tracking:

• Android 10 and later uses a randomised address for each network by default, with the locally administered bit set and the other 46 bits random (Android Open Source Project).
• Apple devices (iOS 14, iPadOS 14, watchOS 7, macOS Sequoia 15 and later) use a different private address for each network; since iOS 18 and macOS Sequoia it can be Fixed, Rotating (a new address every two weeks) or Off (Apple).
• Windows 10 and 11 offer “Random hardware addresses” in the Wi-Fi settings, for all networks or one network (Microsoft).

A random address has no vendor to look up, and the same phone can appear with different addresses on different networks. If MAC filtering or a DHCP reservation stops working, set the network to use the fixed private address (or turn privacy off for that network only), or use WPA2/WPA3-Enterprise or device registration, which do not depend on the MAC address.

The IEEE registries in this tool

• MA-L (MAC Address Block Large): a 24-bit OUI and 2²⁴ = 16,777,216 addresses — 40,287 assignments. Every OUI assigned before 2014 is an MA-L.
• MA-M (Medium): a 28-bit prefix and 2²⁰ = 1,048,576 addresses — 6,614 assignments.
• MA-S (Small): a 36-bit OUI-36 and 2¹² = 4,096 addresses — 7,211 assignments. It replaced the IAB (Individual Address Block, also 4,096 addresses) on 1 January 2014; the 4,575 IABs are included.
• CID (Company ID): a 24-bit identifier with the local bit set that gives no addresses of its own; companies use it for local (ELI) addresses — 220 assignments.

MA-M, MA-S and IAB blocks are carved out of OUIs held by the IEEE Registration Authority, so the longest matching prefix wins. Some assignees pay to keep their name off the public listing; those blocks show as Private. The data is a snapshot: oui-data 2.1.34 (BSD-2-Clause), which packages the IEEE MA-L, MA-M and MA-S listings, plus the IAB and CID listings of the IEEE Registration Authority.

Well-known group and reserved addresses

• 01-00-5E-00-00-00 to 01-00-5E-7F-FF-FF: IPv4 multicast; the low 23 bits of the group address are copied in (RFC 1112, RFC 9542).
• 33-33-xx-xx-xx-xx: IPv6 multicast, carrying the last 32 bits of the group, such as 33-33-00-00-00-01 for ff02::1 (RFC 2464).
• 01-80-C2-00-00-00 to 01-80-C2-00-00-0F: IEEE 802.1 addresses that bridges never forward — Spanning Tree (…00), PAUSE frames (…01), LACP (…02), 802.1X (…03) and LLDP (…0E) (IEEE RA listing).
• 00-00-5E-00-01-xx and 00-00-5E-00-02-xx: VRRP virtual routers for IPv4 and IPv6; the last byte is the virtual router ID (RFC 5798).
• 00-00-5E-00-53-00 to 00-00-5E-00-53-FF (and 01-00-5E-90-10-xx for multicast): reserved for documentation, like 192.0.2.0/24 for IPv4 (RFC 9542).

Group addresses are also looked up with the group bit cleared, because a block’s owner may define multicast addresses in it: 01-00-0C-CC-CC-CC, for example, belongs to Cisco’s 00-00-0C block.

MAC addresses inside IPv6 addresses

Stateless address autoconfiguration can build the last 64 bits of an IPv6 address from the MAC address: insert FF-FE in the middle and invert the U/L bit, so 00:1A:2B:3C:4D:5E becomes the interface identifier 021a:2bff:fe3c:4d5e and the link-local address fe80::21a:2bff:fe3c:4d5e (RFC 4291, Appendix A). Paste such an IPv6 address and the tool gives you the MAC address back. Because this shows the hardware address to every server the device talks to, RFC 8064 recommends that devices stop embedding it in stable addresses and use RFC 7217 identifiers instead; addresses with ff:fe in the middle of the interface identifier still turn up, for example on older and embedded devices.

Limitations

• The registry names the organisation that registered the block. Many devices use a Wi-Fi or network module from another company, so a smart plug may show the module maker (Espressif, for example) rather than the brand on the box.
• Randomised and other locally administered addresses have no manufacturer to look up, and any MAC address can be changed in software — a vendor match is a strong hint, not proof.
• The data is a snapshot of the IEEE listings: blocks assigned after it was taken show as not registered.
• The country is the one in the registration as IEEE lists it — not where a device was made — and it is occasionally wrong in IEEE’s own listing.
• Up to 100,000 addresses per run; the table shows the first 1,000 rows, while the CSV and the converted list include them all. Looking up thousands of addresses downloads the whole registry once (under 1 MB compressed).

Privacy

Addresses are parsed and looked up in your browser; nothing you paste is uploaded or stored. The registry comes from MySmartCoPilot’s own site in 64 files, each holding about 900 prefixes from all over the address space, so the files your browser fetches do not show which vendor you looked up. The output notation you choose is remembered in this browser.