MAC Address Lookup Explained: OUI, Vendors & Formats

What Is a MAC Address?

A MAC address (Media Access Control address) is a 48-bit hardware identifier assigned to a network interface at the time of manufacture. It operates at Layer 2 of the OSI model — the data link layer — and is used to deliver frames between devices on the same local network segment. Unlike an IP address, which is a logical address assigned by software and subject to change, a MAC address is burned into the hardware and remains constant unless the device supports address randomization or manual spoofing.

The formal term for a 48-bit MAC address is EUI-48 (Extended Unique Identifier, 48-bit), as defined by the IEEE Registration Authority and codified in RFC 9542. The IEEE manages the global assignment of address blocks to manufacturers through its Registration Authority program. As of mid-2026, the IEEE OUI database contains more than 58,000 registered vendor prefixes.

MAC addresses matter beyond local networking. They appear in Wi-Fi association logs, DHCP leases, ARP tables, RADIUS authentication records, and network access control (NAC) policies. When a network administrator audits connected devices — looking for rogue hardware, unmanaged endpoints, or unauthorized access points — the MAC address and its vendor identity are the first data points examined.

ℹ️ Note: MAC addresses are only visible within a single broadcast domain. A router strips the MAC header before forwarding a packet to another network, so you cannot look up the MAC address of a device on a remote network by examining internet traffic.

MAC Address Format: Anatomy of 6 Octets

A MAC address is 48 bits arranged as six octets. The canonical representation writes each octet in hexadecimal notation, typically separated by colons:

AA:BB:CC:DD:EE:FF
│──────────│──────────│
  OUI (24 bits)  NIC-specific (24 bits)

The first octet contains two special control bits defined by RFC 9542:

• Bit 0 (LSB) — multicast bit (M bit): 0 = unicast address (one device), 1 = multicast/group address.
• Bit 1 — universal/local bit (X bit): 0 = globally unique address assigned by the IEEE, 1 = locally administered address (manually configured or randomly generated).

These bits are embedded inside the OUI and affect how lookup tools interpret the address. A locally-administered address (X bit = 1) will not match any OUI in the IEEE database because it was never assigned by a manufacturer.

The three octets that follow the OUI are assigned by the manufacturer and must be unique within their own block — the IEEE does not prescribe how vendors number their devices in that space.

What Is an OUI and Who Assigns It?

An OUI (Organizationally Unique Identifier) is a 24-bit prefix purchased from the IEEE Registration Authority. Combined with a 24-bit manufacturer-assigned suffix, it forms a globally unique EUI-48 MAC address. Per RFC 9542 §2, the IEEE Registration Authority manages three assignment tiers:

Large hardware vendors — Cisco, Intel, Apple, Dell — typically hold multiple MA-L blocks. Smaller or newer companies may acquire only an MA-S block to cover a limited product line. IANA itself holds the OUI 00-00-5E, which it uses for addresses assigned to IETF protocol specifications (as noted in RFC 9542 §4.1).

The IEEE publishes the full OUI registry as a downloadable CSV at standards-oui.ieee.org. MAC address lookup tools — including DNSnexus — pull from this registry and augment it with the Wireshark vendor database, which covers additional virtual machine vendors and private-range assignments not in the IEEE list.

💡 Tip: You can look up any MAC address vendor using the MAC Address Lookup tool — paste the full MAC or just the first 6 hex digits (OUI prefix) to identify the manufacturer.

How Does a MAC Address Lookup Work?

When you submit a MAC address to a lookup tool, the process is straightforward:

1. Normalize the input. The tool strips separators (:, -, .) and converts to uppercase hex. a4:c3:f0:12:34:56 becomes A4C3F0123456.

2. Extract the OUI prefix. The first six hex characters — A4C3F0 — represent the 24-bit OUI. This is the lookup key.

3. Match against the IEEE registry. The tool queries its local copy of the IEEE OUI CSV (updated regularly). A4:C3:F0 maps to Apple, Inc.

4. Return vendor details. Results include company name, address, and assignment type (MA-L, MA-M, or MA-S). Some tools also flag whether the prefix belongs to a virtual machine platform (VMware, VirtualBox, Parallels) or a known device category (access point, printer, IoT device).

The device-specific bits (octets 4–6) are not part of the lookup — they are assigned privately by the vendor and are not in any public database. A lookup tells you who made the hardware; it does not tell you the specific device model or serial number.

⚠️ Warning: If a lookup returns "locally administered" or "unknown," the device may be using a randomized MAC address. Modern iOS (14+), Android (10+), and Windows 11 devices use per-network random MACs by default. Randomized addresses have the X bit set to 1 and will never match a real OUI.

How Do You Find Your MAC Address?

Before running a lookup, you need to read the MAC address from the device. The commands differ by operating system:

# Linux — show all interfaces and their MAC addresses
ip link show
# or
cat /sys/class/net/eth0/address

# macOS
ifconfig en0 | grep ether
# Output example:
# ether a4:c3:f0:1a:2b:3c

# Windows (PowerShell)
Get-NetAdapter | Select-Object Name, MacAddress

# Windows (Command Prompt)
ipconfig /all
# Look for "Physical Address" under each adapter

On a router admin page, connected device MAC addresses appear in the DHCP client table — usually under Status → DHCP or Network Map → Connected Devices. On a managed switch, use show mac address-table on Cisco IOS (or the equivalent for your vendor) to see MAC-to-port mappings.

# Cisco IOS — display MAC address table for all VLANs
show mac address-table

# Linux — ARP table (shows MAC for devices that recently communicated)
arp -n
# or
ip neigh show

Once you have the address, paste it into the MAC Address Lookup tool to identify the vendor.

MAC Format Variants: Colons, Dashes, and Dots

The same MAC address can appear in several notation styles depending on the operating system, tool, or vendor. All are valid representations of the same 48-bit value:

Most lookup tools accept all four formats and normalize them automatically. If a tool returns an error, try removing separators and submitting the bare 12-character hex string.

💡 Tip: When copying MAC addresses from Windows ipconfig /all output, the format uses dashes (A4-C3-F0-1A-2B-3C). Paste it directly — the MAC Address Lookup tool handles this format without any conversion needed.

MAC Address Randomization and Its Impact on Lookups

Starting with iOS 14 (2020), Android 10 (2019), and Windows 11 (2021), major operating systems enable per-network MAC randomization by default. When a device connects to a Wi-Fi network, it uses a randomly generated MAC address rather than the hardware-burned OUI. The X bit (bit 1 of the first octet) is set to 1, making the address locally administered and outside the IEEE OUI registry entirely.

The practical effect: a MAC address lookup on a randomized address will return "locally administered" with no vendor — which is the correct and expected result. It does not indicate a problem with the lookup tool.

Key facts about randomization for network administrators:

• Randomization is per-SSID. The random MAC is consistent for a given network but changes if the device forgets and reconnects to a new profile.
• Enterprise Wi-Fi (802.1X) often disables randomization. MDM policies for managed devices (Jamf, Intune, Addigy) can enforce use of the real hardware MAC on corporate SSIDs.
• Wired Ethernet (802.3) does not randomize. Plugged-in devices still use their burned-in hardware MAC.
• You cannot recover the real hardware MAC from a randomized one — the randomization is intentional and provides no cryptographic link back to the original address.

If you are managing a network and need to correlate randomized MACs to actual devices, options include requiring 802.1X certificate authentication (which ties identity to a device cert rather than a MAC), using network access control platforms, or enforcing MDM profiles that disable randomization on managed endpoints.

For IP-level device tracking beyond MAC addresses, see our IP Geolocation guide and the IP Lookup tool for understanding what network-layer information is available from an IP address.

Why Does My MAC Lookup Return No Vendor?

Submitting an IP address instead of a MAC. 192.168.1.1 is an IP address — it has no OUI and will not return a vendor. Use arp -n on Linux/macOS or check your router's ARP table to find the MAC address associated with an IP on your local network.

Confusing locally administered with "unknown vendor." If a lookup returns "locally administered," the device is using a random or manually configured MAC. This is not a database gap — the X bit explicitly marks the address as outside IEEE assignment.

Expecting model-level detail. An OUI lookup returns the manufacturer, not the device model or serial number. Apple, Inc. tells you the device is made by Apple — it could be an iPhone, MacBook, AirPods, or Apple TV. Cross-reference with DHCP hostname, mDNS name, or DNS Lookup for the device's hostname if further identification is needed.

Using the wrong octets. The OUI is always the first three octets. Submitting the last three octets of a MAC (1a:2b:3c from a4:c3:f0:1a:2b:3c) will return no results or an incorrect vendor.

Multi-vendor OUI blocks. Some very large manufacturers — particularly chip makers like Qualcomm and Broadcom — supply OEM components that ship under the finished product vendor's OUI. A device labeled as one brand may have a NIC chip from another vendor, and the OUI reflects the chip manufacturer, not the device assembler.

For a deeper look at how network-level addressing relates to IP geolocation and ASN routing, see our guides on ASN Lookup Explained and IP Geolocation Explained.

Frequently Asked Questions

Next Steps

Now that you understand how MAC address lookup and OUI identification work, the next step is running a lookup against a device on your network.

Use the MAC Address Lookup tool to identify any device by its 12-character hardware address — paste the full MAC or just the first 6 hex digits to get the vendor name immediately.

For network-layer context alongside the MAC, the IP Lookup tool shows geolocation, ASN, and provider data for any IP address on your network. To understand how ASN routing fits into the bigger picture, see our ASN Lookup Explained guide.

Browse all IP and network guides on DNSnexus.

Related Guides

• ASN Lookup Explained
• IP Geolocation Explained
• What Is My IP Address — Explained
• CIDR Subnetting Guide