An unknown device shows up in the DHCP lease table, the switch MAC table or a Wi-Fi controller, and all you have is a hardware address like 00:1A:2B:3C:4D:5E. Before walking the office with a cable tester, the first clue is the vendor: a printer manufacturer, a VoIP phone maker, a virtualization platform, or nothing at all because the address is randomized.
MAC Lookup identifies the manufacturer registered for a MAC address prefix in the IEEE registry and tells you when the address is locally administered (typically randomized) or multicast.
What is a MAC address lookup?
In simple terms
A MAC address is the hardware address of a network interface, used to deliver frames on a local network. The first half of a factory-assigned MAC address identifies the manufacturer. A lookup matches that prefix against the public list of prefixes the IEEE has handed out and returns the company name.
Technical background
An EUI-48 MAC address is 48 bits, usually written as six hex bytes. Its structure is defined by IEEE 802:
- OUI (first 24 bits). Assigned by the IEEE Registration Authority. The large assignment block is called MA-L (MAC Address Block Large); smaller MA-M (28-bit) and MA-S (36-bit) blocks also exist for organizations needing fewer addresses.
- Interface identifier (last 24 bits). Assigned by the manufacturer.
- I/G bit (least significant bit of the first byte). 0 = individual (unicast), 1 = group (multicast or broadcast, such as
FF:FF:FF:FF:FF:FF). - U/L bit (second least significant bit of the first byte). 0 = universally administered (factory address with an OUI), 1 = locally administered (set by software).
Locally administered addresses are used by operating systems for MAC randomization on Wi-Fi, by virtual machines and containers, and by some VPN and bonding drivers. They carry no vendor information. You can spot them by the second hex digit: 2, 6, A or E (for example DA:… or x2:…).
MAC addresses are only meaningful on a single layer-2 segment. Routers replace the source MAC at each hop, which is why a remote server cannot learn a client's MAC address. On a local network, ARP (IPv4) and Neighbor Discovery (IPv6) map IP addresses to MAC addresses.
Why use MAC Lookup?
- Identify unknown devices in DHCP leases, ARP tables, switch port tables or wireless client lists.
- Spot randomized clients so you do not waste time searching for a vendor that does not exist.
- Recognize virtual interfaces from hypervisor OUIs when tracing traffic in a data center.
- Check asset inventories for mislabeled or unexpected hardware.
- Understand captures, distinguishing multicast group addresses from real interfaces.
Who should use it?
- Network and system administrators managing switches, DHCP and Wi-Fi.
- Help desk and on-site technicians identifying devices on a port.
- Security analysts reviewing unknown devices on internal networks.
- Home users trying to work out what is connected to their router.
How MAC Lookup works
You enter a MAC address or just its OUI. The NetTools.tech server normalizes the input by stripping colons, hyphens, dots and spaces and converting it to upper case; it accepts exactly 12 hex digits (a full address) or 6 (an OUI) and rejects anything else. It then:
- Takes the first six hex digits as the OUI and looks them up in a local copy of the IEEE MA-L registry (
oui.csv), which the server downloads from the IEEE monthly. If the download fails, the previous copy is kept. - Returns the organization name and, if the registry lists one, its registered address.
- Reads the I/G and U/L bits from the first byte and flags multicast and locally administered addresses.
- Returns the date of the registry copy used.
No request is sent to a third party when you run a lookup; the registry is stored on the server. MA-M and MA-S sub-assignments are not included yet, so addresses from those smaller blocks show the MA-L holder of the parent prefix (often the IEEE itself) or no vendor.
The lookup is also available as /mac (aliases /oui, /macvendor) in the NetTools terminal.
On your own machine, these commands list MAC addresses to look up:
ip neigh show
arp -aHow to use the NetTools.tech MAC Lookup
- Open MAC Lookup.
- Enter the address in the MAC field, for example
00:1A:2B:3C:4D:5E,00-1a-2b-3c-4d-5e,001a.2b3c.4d5e, or just the OUI00:1A:2B. You can also click the example chip. - Press Run MAC Lookup.
- Read the vendor, OUI and registry date, and any notes about locally administered or multicast addresses.
- To run the same lookup in the terminal, use Open in terminal.
Understanding the results
| Result | Meaning | What to look for |
|---|---|---|
| MAC | Normalized address in colon notation | For an OUI-only input, only three bytes are shown |
| OUI | The 24-bit prefix used for the lookup | Compare with neighbors in the same switch table |
| Vendor | Organization registered for the OUI, or "Not in the IEEE registry" | May be a chip or module supplier rather than the device brand |
| Address | Registered postal address of the organization, when listed | Helps tell apart companies with similar names |
| Registry date | Date of the IEEE registry copy on the server | Very new assignments may be missing until the next import |
| Locally administered note | U/L bit set: usually randomized by the device for privacy | No vendor exists for such addresses |
| Multicast note | I/G bit set: group address, not a single device | Common in captures and switch tables |
Example: sorting out a DHCP lease table
Three unknown leases appear on a guest VLAN:
00:1A:2B:3C:4D:5E– the lookup returns the vendor registered for OUI00:1A:2B, with the registry date. This is a factory address; the vendor name tells you what kind of hardware to look for.DA:A1:19:5C:0E:31– the result shows Vendor: Not in the IEEE registry and the note Locally administered address: usually randomized by the device for privacy, so it has no registered vendor. This is almost certainly a phone or laptop with Wi-Fi privacy addressing; identify it by hostname or the user who logged in.01:00:5E:00:00:FB– flagged as a Multicast address (group address), not a single device. It is the IPv4 multicast MAC used for mDNS and should not be in a lease table at all; it comes from a capture or a switch's multicast entries.
Common use cases
- Mapping unknown switch ports to device types before an audit.
- Identifying IoT devices (cameras, printers, smart TVs) on a home or office network.
- Recognizing hypervisor-generated MACs when troubleshooting duplicate address issues.
- Checking whether a client in Wi-Fi logs uses a randomized address.
- Verifying that replacement hardware matches the expected vendor.
Troubleshooting
"A MAC address uses hexadecimal digits"
The input contains characters other than 0–9, A–F and separators. A common cause is the letter O instead of zero, or copying a label with extra text.
"Enter a full MAC address (12 hex digits) or its first 6 digits"
The address has a missing or extra digit, often from a truncated copy. EUI-64 identifiers (16 hex digits) are not accepted.
No vendor, but the address is not locally administered
The OUI may be from an MA-M or MA-S block, which are not imported yet, or a very recent assignment not yet in the server's copy. It may also be a private (unregistered) prefix some vendors use.
The vendor is a company I don't recognize
Network chips are often made by component suppliers or contract manufacturers. Search the vendor name together with the device type you suspect.
The tool says the registry has not been imported
The server has no copy of the IEEE registry yet. Try again later.
Common mistakes
- Expecting a vendor for a randomized Wi-Fi address.
- Treating the vendor as proof of what a device is; MAC addresses can be changed in software.
- Trying to find a remote visitor's MAC address from a website or IP address; it is never transmitted beyond the local segment.
- Using the MAC address of a router or firewall interface seen in captures as the address of the devices behind it.
- Confusing the multicast MAC of a protocol with a real device.
Limitations
- Only the IEEE MA-L registry is used; MA-M and MA-S assignments are not included yet.
- MAC addresses can be changed or spoofed in software; the vendor reflects only what the address claims.
- Randomized and other locally administered addresses carry no vendor information.
- The registry copy is refreshed monthly, so the newest assignments can be missing.
- The tool does not discover devices; you need the MAC address from your own switch, router, controller or capture.
Security & privacy
The MAC address you enter is sent to the NetTools server and matched against a local copy of the IEEE registry; no third party receives it. The server keeps the usual short tool log (tool, target, your shortened IP) for 30 days, as described in the privacy policy. MAC addresses are not secret, but lists of them reveal what is on your network; there is no need to paste whole inventories, and the tool takes one address at a time.
Related tools
- Subnet Calculator – work out the subnet the device's IP belongs to. Guide: Subnet Calculator guide.
- My IP – the public address your network uses. Guide: What is my IP.
- User Agent – identify browsers and devices from their user agent. Guide: User Agent guide.
- IP Lookup – owner and routing of public addresses. Guide: IP Lookup guide.
- Overview: IP & Network Utilities.
Summary
MAC Lookup matches the OUI of a MAC address against a server-side copy of the IEEE MA-L registry and returns the registered vendor, plus flags for locally administered and multicast addresses. It is a quick first step in identifying devices on a local network, but randomized addresses have no vendor and any MAC can be changed in software, so treat the result as a clue rather than proof.
Frequently asked questions
What is an OUI?
An Organizationally Unique Identifier is a 24-bit prefix that the IEEE Registration Authority assigns to a manufacturer. The first three bytes of a globally unique MAC address are the OUI, and the manufacturer numbers the remaining three bytes itself.
Why does the lookup find no vendor for my phone's MAC address?
Modern phones, tablets and laptops use randomized MAC addresses on Wi-Fi to prevent tracking. Those addresses have the locally administered bit set and do not belong to any manufacturer, so no registry entry exists.
Can a website see my MAC address?
No. MAC addresses are used only on the local network segment and are replaced at every router hop, so websites and remote servers never receive them.
Which MAC address formats are accepted?
Colon, hyphen, dot and space separators are all accepted, in upper or lower case, for example 00:1A:2B:3C:4D:5E, 00-1a-2b-3c-4d-5e or 001a.2b3c.4d5e. You can also enter only the first six hex digits, the OUI.
Is the vendor always the device manufacturer?
Not necessarily. The OUI belongs to whoever made the network chip or module, which may be a component supplier rather than the brand on the device, and virtualization platforms use their own OUIs for virtual NICs.
What does multicast address mean in the result?
If the least significant bit of the first byte is set, the address is a group address used for multicast or broadcast traffic rather than a single interface. Such addresses appear in switch tables and captures but never as a device's own address.