Guide
Looking up the vendor of a MAC address
A MAC address is the hardware identifier a network card uses on its local link. The first half of a globally unique address names the organisation that bought the block from the IEEE, so a list of addresses from a switch or scan can be turned into a list of manufacturers. The page does this lookup for as many addresses as you paste, without sending them anywhere.
How the lookup works
A 48-bit address is six bytes. The IEEE registry assigns prefixes of three sizes: 24 bits (MA-L, the classic OUI), 28 bits (MA-M) and 36 bits (MA-S). The page tries the longest match first, so a small registrant who bought a 36-bit block is not confused with the larger company that owns the surrounding 24-bit one. The data is a compact snapshot of the public IEEE lists, more than 54,000 entries, loaded once from this site and cached by your browser. The addresses you type are never sent; only the data file travels to you.
Reading the flags
The two lowest bits of the first byte carry meaning that is independent of any vendor. Bit 0 says unicast (0) or group (1); multicast and broadcast addresses are group addresses. Bit 1 says universal (0, assigned by the IEEE) or locally administered (1, set by software or an administrator). Random Wi-Fi addresses and the addresses Docker and virtual machines generate have the local bit set, so their second hex digit is 2, 6, A or E. The table states these facts for every row, which saves guessing why a lookup returned nothing.
Input and output
Paste addresses in any notation: colons, hyphens, Cisco dots, bare hex or a three-byte OUI such as 00:00:5E. One per line is simplest. The results table has columns for the address, the vendor with the matched block size, and the type. The sample includes real prefixes and one address of each special kind so every kind of answer is visible on first use.
A worked example
Load the sample. 00:00:5E:00:53:01 returns ICANN, IANA Department, matched on the 24-bit block 00005E; this is the block used for documentation addresses and for VRRP virtual routers. 3C:52:82:12:34:56 is listed to Hewlett Packard (block 3C5282) and 28:6F:B9:00:00:01 to Nokia Shanghai Bell Co., Ltd. (block 286FB9). 02:42:AC:11:00:02, the style Docker assigns, is reported as locally administered with no vendor. FF:FF:FF:FF:FF:FF is the broadcast address and 01:00:5E:00:00:FB is an IPv4 multicast address; neither has a vendor.
Limits
The vendor is the registered owner of the block, not necessarily the brand on the box. The data is a snapshot, so a very recent registration may be missing. Randomised addresses cannot be traced to a maker, and a device can change its address, so a MAC address should not be treated as proof of identity. The lookup works offline once the data file has loaded.
Related tools
- MAC Address Formatter converts addresses between colon, hyphen and Cisco styles.
- MAC Address Generator creates random or vendor-prefixed addresses for testing.
- EUI-64 Calculator derives the IPv6 interface identifier from a MAC address.
- Wake-on-LAN Generator builds the magic packet for a MAC address.
Checked against the current version of the MAC Address Lookup on .