MAC Address Vendor Lookup

About MAC Address Lookup

A MAC address is the hardware address a network card puts on every frame it sends. Its first half is not random: a manufacturer buys a block of addresses from IEEE, and the block's prefix is written into every card it makes. This reads that prefix and names the company it was registered to, from IEEE's MA-L, MA-M and MA-S registries — checking the smaller 28-bit and 36-bit blocks first, because a vendor that bought one of those shares its 24-bit prefix with others.

It also reads the two bits that change what the rest means. The group bit makes it a multicast address — one that a set of devices listen on, not one device's. The local bit means nobody registered it at all: today that is most often a phone or laptop using a randomised private address on Wi-Fi, and otherwise a virtual machine, a container, a bond or a VPN interface that made its own. For those it says so rather than naming a vendor that does not exist.

Well-known addresses are named for what they are: broadcast, the IPv4 and IPv6 multicast ranges, Spanning Tree, LLDP, LACP, Cisco CDP, and the virtual router addresses VRRP and HSRP use for a gateway that moves between devices.

Paste one address to see every notation it is written in — colon, hyphen, Cisco's dotted form, the integer, and the IPv6 link-local address the interface would take with SLAAC. Paste many, or a whole arp -a or switch address table, and every address in it is listed with its vendor.

The lookup runs in this browser against a copy of the registry served by this site. The addresses you paste are never sent anywhere.

Where it helps

• Reads colon, hyphen, Cisco dotted, bare and unpadded notations, EUI-64, and bare 6-, 7- and 9-digit prefixes without being told which.
• Checks the 36-bit and 28-bit blocks before the 24-bit OUI, so vendors sharing a prefix are told apart.
• Recognises randomised and locally administered addresses instead of guessing a vendor for them.
• Names broadcast, multicast, STP, LLDP, LACP, CDP, VRRP and HSRP addresses for what they are.
• Takes a whole ARP table or switch address table and lists every address in it.
• Runs in the browser: internal addresses are never sent anywhere.

Limits

• The vendor is whoever registered the prefix, which is often the maker of the network chip rather than the brand on the device.
• A MAC address can be changed in software, so the vendor is what the address claims, not proof of the hardware.
• A randomised address cannot be traced to a manufacturer: that is what randomising it is for.
• The registry is the copy this site was built with; a block assigned since then shows as not registered until the next update.
• The registry file is downloaded the first time the tool runs, which takes a moment on a slow connection.

Frequently asked questions

Why does my phone show a different MAC address on every network?

Because it randomises it. iOS, Android, Windows and macOS give each Wi-Fi network its own made-up address so the networks you join cannot be used to track the device between them. Those addresses set the local bit, which is why no vendor is found for them.

How can I tell if a MAC address is randomised?

Look at the second hex digit. If it is 2, 6, A or E, the locally administered bit is set and the address was not assigned by a manufacturer. That covers randomised private addresses, and also those set by virtual machines and containers.

What is an OUI?

An Organizationally Unique Identifier: the 24-bit prefix IEEE sells to a company, which then numbers its devices under it. Companies that need fewer addresses can buy smaller blocks — MA-M (28-bit) or MA-S (36-bit) — which is why a lookup has to check those first.

Why does it say Private instead of a company name?

Because the company paid IEEE to keep its name out of the public listing. The block is registered; only the owner's name is withheld.

Can a MAC address tell me where a device is?

No. It identifies a network interface on the local segment and never leaves it — routers replace it at every hop. It says who made the hardware, not where it is or who owns it.

Related tools

• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• What Is My IP — Your public address, and what a browser reveals about you
• Subnet Calculator — IPv4 and IPv6 networks, masks, splits, VLSM plans and summarisation
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• Port Checker — Test whether TCP ports accept connections

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Blacklist Checker — Whether an address is on the blocklists that actually stop mail
• Reverse IP Lookup — What an address says about itself: its name, its certificate, its network
• Traceroute — Every hop between this server and a host, with the time each one took
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• IP to MAC Lookup — Find the MAC address behind an IP: computed for multicast and EUI-64 addresses, or read from an ARP table
• DNSSEC Checker — Whether a domain's DNSSEC validates, and if not, whether it is the DS, a key, an algorithm or an expired signature