MAC Address Lookup, Explained
After reading this you can name the vendor behind any MAC address, read the two bits that decide whether an address is local or global, and tell a real burned-in hardware address from a randomized Wi-Fi privacy address.
What a MAC address is
A MAC address is a 48-bit number assigned to a network interface. You usually see it written as six hexadecimal bytes, like 3C:5A:B4:0F:12:9E. Each byte is two hex digits, so the whole address is 12 hex digits and covers 2^{48} possible values, roughly 281 trillion.
The IEEE splits those 48 bits into two halves with different owners. The first 24 bits are the Organizationally Unique Identifier (OUI). The IEEE sells that prefix to a manufacturer. The last 24 bits are assigned by that manufacturer to individual devices, giving each vendor 2^{24} addresses, about 16.7 million, per OUI block.
So a lookup is a table join. Take the first three bytes, find the company that registered them, and you know who built the network chip. 3C:5A:B4 resolves to Google. 00:1A:11 also resolves to Google. F0:9F:C2 resolves to Ubiquiti. The public registry is what makes this possible: every assignment is on file with the IEEE.
When to use it, and when it tells you nothing
Reach for a MAC lookup when you have a device on your network and want to know what it is. A DHCP lease table full of MAC addresses becomes readable once you resolve the OUIs: you can spot the printer, the phones, the smart plugs. It also helps when you are reverse-engineering captured traffic and want to attribute frames to a hardware maker.
It tells you nothing useful in three cases. First, MAC addresses do not cross routers, so you only ever see the MAC of the last hop on your own link, never the MAC of a remote server. Second, software can override the burned-in address, so a resolved vendor is a hint, not proof. Third, modern phones deliberately randomize their MAC on Wi-Fi, and those addresses do not resolve to any vendor at all. The next sections explain exactly why.
The vendor half of this tool queries the public maclookup.app registry from your browser. The bit analysis runs entirely on your device, so decoding an address never sends it anywhere.
The two bits inside the first byte
The interesting structure lives in the very first byte, the most significant byte of the OUI. Two of its bits are flags defined by the IEEE, and they change how you read the whole address.
Here the bits are numbered from most significant (b_7) to least significant. The two lowest bits carry meaning. I/G is the second-least-significant bit (value 2): the Individual/Group bit. U/L is the least-significant bit (value 1): the Universal/Local bit.
- I/G bit (value 2)
- 0 means unicast, a single interface. 1 means multicast or group, delivered to many. Broadcast
FF:FF:FF:FF:FF:FFis the all-ones case. - U/L bit (value 1)
- 0 means the address is globally unique and assigned through an IEEE OUI. 1 means it is locally administered: chosen by software, with no registry meaning.
To test them, take the first byte, convert to a number, and look at the last two bits. For 3C that is 3\text{C}_{16} = 60 = 00111100_2. The last two bits are 00: unicast, globally unique. That is why 3C:5A:B4 resolves cleanly to a vendor.
Why randomized addresses never resolve
When a phone sets the U/L bit to 1, it is telling the network the address is made up. The IEEE guarantees it never assigns an OUI with that bit set, so a locally-administered address can never match a registry entry. The lookup returns nothing, and that empty result is itself the answer: this is a private or randomized address.
You can spot a randomized address by eye. Look at the second hex digit of the first byte. If it is 2, 6, A, or E, the U/L bit is set. Those are the four hex digits whose binary form ends in 10, meaning unicast plus locally administered. An address like 7A:1B:9C:44:55:66 starts with 7A, and A ends in 10, so it is a privacy address.
Do not treat a resolved vendor as identity. The address can be spoofed in one command on most operating systems, and randomization means the same phone shows a different MAC to every network it joins. A MAC is a hardware hint, never an authentication token.
Worked example: decoding the demo address
Reading 3C:5A:B4:0F:12:9E
- Split off the OUI: the first three bytes are
3C:5A:B4. The registry maps this to Google. - Convert the first byte:
3Cin hex is 3 \times 16 + 12 = 60, which is00111100in binary. - Read the I/G bit (value 2): the second-lowest bit is
0. This is a unicast address. - Read the U/L bit (value 1): the lowest bit is
0. This is globally unique, so a vendor lookup is meaningful. - Note the notation variants: colon form
3C:5A:B4:0F:12:9E, dash form3C-5A-B4-0F-12-9E, and Cisco dotted form3c5a.b40f.129e. All three name the same 48 bits.
The Cisco form groups the 12 hex digits into three sets of four rather than six sets of two. It carries no extra information; it is only a different way to punctuate the same number.
The four combinations of the two flag bits
Because the two flags are independent, the first byte falls into one of four categories. The table below shows how the last two bits map to meaning, with an example first byte for each.
| U/L bit | I/G bit | Last 2 bits | Meaning | Example first byte | Resolves? |
|---|---|---|---|---|---|
| 0 | 0 | 00 | Global unicast | 3C | Yes |
| 0 | 1 | 01 | Global multicast | 01 | Sometimes |
| 1 | 0 | 10 | Local unicast | 7A | No |
| 1 | 1 | 11 | Local multicast | 33 | No |
The second hex digit of the first byte tells you the row directly. Digits ending in binary 00 (0,4,8,C) are global unicast. Ending in 01 (1,5,9,D) is global multicast. Ending in 10 (2,6,A,E) is local unicast. Ending in 11 (3,7,B,F) is local multicast.
Common mistakes
The first mistake is reading the wrong bit. The flags are the two lowest bits of the first byte, not the first bits you write. In 3C the printed digits are 3 then C, but the U/L bit lives inside the C, the second digit. Always convert the full byte to binary before judging.
The second mistake is expecting every address to have a vendor. Roughly three of the four first-byte categories cannot resolve, and phones on Wi-Fi actively pick local addresses. An empty vendor field is not a lookup failure.
The third mistake is confusing notation with content. 3C:5A:B4:0F:12:9E, 3C-5A-B4-0F-12-9E, and 3c5a.b40f.129e are identical. Do not assume the dotted form is a different address family; Cisco simply prints four digits per group.
The fourth mistake is trusting a MAC as identity. Because software can set any address, a spoofed MAC can borrow a real vendor's OUI. The lookup will happily report that vendor even though the hardware is something else.
Related tools
A MAC address names the hardware on your local link. To reason about the addresses that travel across networks, other tools fit alongside this one. Use the Subnet / CIDR Calculator to work out the IP range and broadcast address of the network those devices share. When you have a hostname instead of a device, the DNS Lookup resolves it to IP records, and the WHOIS Lookup tells you who registered the domain. For inspecting the certificate a server presents, the SSL Certificate Decoder shows subject and validity. If your investigation lands on file access rather than the network, the Chmod Calculator converts Unix permission bits.
Frequently asked questions
Why does my phone show a different MAC on every Wi-Fi network?
Since iOS 14 and Android 10, phones generate a random locally-administered MAC per network by default. The U/L bit is set to 1, so it never matches a real vendor. This blocks tracking across venues that once used a stable MAC to recognize you.
Can I find a device's location or owner from its MAC?
No. A MAC identifies the hardware maker at best, and only on your own local link. It carries no location, and it never leaves your network segment, so a remote server's MAC is invisible to you.
What does an empty vendor result mean?
Usually one of two things: the address is locally administered (U/L bit set, as with a privacy address), or the OUI is a valid registration the public database has not indexed. Check the first byte to tell them apart.
Is the first three bytes always the full vendor prefix?
Usually, but the IEEE also sells smaller blocks (MA-M and MA-S) that split the fourth or fifth digits between the vendor and the device serial. The 24-bit OUI still names the registrant for standard MA-L blocks, which cover most consumer hardware.
How is a broadcast address different from multicast?
Broadcast is the single address FF:FF:FF:FF:FF:FF, all 48 bits set, delivered to every interface on the link. Multicast is any address with the I/G bit set to 1 that targets a defined group. Broadcast is the extreme case of multicast.
Related tools
Subnet / CIDR Calculator
Network, broadcast, host range and mask from CIDR notation.
Chmod Calculator
Octal ↔ symbolic Unix permissions, with checkboxes.
DNS Lookup
A, AAAA, MX, TXT, NS, CNAME records via DNS-over-HTTPS.
SSL Certificate Decoder
Paste a PEM certificate, see subject, issuer, SANs, validity.
WHOIS Lookup
Registrar, dates and nameservers of any domain.
Base64 / URL / HTML Encoder-Decoder
Encode and decode Base64, hex, URL percent-encoding and HTML entities — with auto-detect, bulk lines and file drop.