MAC Vendor Lookup

Overview

Looks up a MAC address's hardware vendor from a small offline OUI registry, and classifies the address as unicast or multicast and universally or locally administered from the first octet's flag bits. The lookup needs no network, so the address you are investigating stays entirely on your machine.

How It Works

Type or paste a MAC address with colons, hyphens, Cisco-style dots or no separators at all. Results appear once the box holds a complete 48-bit address (12 hex digits in one consistent layout); anything shorter or irregular shows a format error instead. A Vendor card gives the hardware vendor from the registry, followed by cards for the OUI prefix, unicast or multicast, and locally or universally administered, and four copyable cells show the same address in colon, hyphen (Windows), Cisco dotted and bare hex form. Unknown prefixes are labeled Not in the offline sample, with a link to the IEEE registry, rather than guessed at. A locally administered address shows Randomised / locally administered instead of a vendor, and FF:FF:FF:FF:FF:FF is recognised as the broadcast address.

Step-by-Step Usage Guide

1. Paste the full MAC address in colon, hyphen, Cisco dotted or bare hex form; a partial address shows a format error.
2. Read the vendor card if the prefix is in the offline registry; otherwise the tool says Not in the offline sample rather than guessing.
3. Check the Transmission card: multicast (odd first byte) addresses are not source addresses on a wire.
4. Check the Assignment card: Locally Administered usually means a virtual machine, container or randomized privacy address.

Technical Specifications & Standards

Two mechanisms are at work. The vendor lookup takes the first three octets - the Organizationally Unique Identifier - and checks a curated offline table of 25 well-known prefixes covering VMware (00:50:56, 00:0C:29), Oracle VirtualBox (08:00:27), Raspberry Pi (B8:27:EB, DC:A6:32, E4:5F:01), Apple, Google, TP-Link, Espressif, Intel, Dell, HP, Microsoft Hyper-V, QEMU/KVM, Xen and Docker's default bridge, among others. The IEEE registry lists tens of thousands of OUIs, so most prefixes will return unknown - that is honest output, not a bug, and the trade is a zero-network lookup with no query to any vendor-database API. The classification is pure bit logic on the first octet: the least significant bit distinguishes unicast (0) from multicast (1), and the second-least-significant bit distinguishes universally administered (0, a real IEEE-assigned OUI) from locally administered (1, set by software - the mark of a virtualized or privacy-randomized address). Separators do not affect the result: 00-1A-2B-3C-4D-5E, the colon form, the dotted Cisco form and bare hex all normalize to the same prefix, although mixed or irregular separators are rejected as a format error.

Targeted Use Cases

• Identifying the maker of a device whose MAC you can see in a DHCP lease table or Wi-Fi scan.
• Spotting virtualization: VMware, VirtualBox and Microsoft OUIs in a network inventory reveal which machines are VMs.
• Classifying an address from a packet capture as unicast versus multicast and real versus locally administered.
• Investigating a suspicious device offline, without sending the address to a third-party lookup service.

Notes & Gotchas

• Expect unknown for most prefixes - the offline registry covers well-known vendors only, which keeps the lookup private and instant.
• A locally administered address almost always means software assigned it: VM, container, or MAC randomization. Factor that into attribution.
• For exhaustive vendor identification, consult the official IEEE OUI registry; use this tool for quick triage and privacy-sensitive checks.
• Remember MAC addresses are only meaningful on the local link - the same MAC can appear on different devices on different networks.

Frequently Asked Questions