What an OUI is
A MAC address is 48 bits, usually written as six bytes: 3C:22:FB:12:34:56. The first part is a block the manufacturer bought from the IEEE Registration Authority. The classic block is the OUI (Organizationally Unique Identifier): the first 3 bytes, here 3C:22:FB, which belongs to Apple. The manufacturer then numbers its interfaces with the remaining 3 bytes.
| Block | Fixed bits | Addresses | Example prefix | In this data |
|---|---|---|---|---|
| MA-L (OUI) | 24 | 16,777,216 | 3C:22:FB | 40,423 |
| MA-M | 28 | 1,048,576 | 70:B3:D5:A | 6,664 |
| MA-S | 36 | 4,096 | 70:B3:D5:AB:C | 7,253 |
The lookup always uses the most specific match, so a small company with an MA-S block inside an IEEE-owned OUI is shown correctly.
Reading the first byte: multicast and local bits
Two bits in the first byte change what a MAC means. Take DA:A1:19:…:
- First byte DA = 1101 1010 in binary.
- The last bit (bit 0) is the I/G bit: 0 here, so it is a normal unicast address. A 1 would mean multicast — like 01:00:5E:… for IPv4 multicast.
- The next bit (bit 1) is the U/L bit: 1 here, so the address is locally administered — set by software, not burned in by a manufacturer.
Shortcut: if the second hex digit is 2, 6, A or E, the address is locally administered. Phones' random MACs, Docker containers (02:42:…) and KVM virtual machines (52:54:00:…) all fall into this group.
Why phones show random MACs now
A fixed MAC lets shops, airports and other Wi-Fi networks recognise the same phone every time it passes by. To stop that, phones now invent a random MAC per network: iOS and iPadOS since version 14 (Private Wi-Fi Address), Android since version 10 (Use randomised MAC), and Windows with Random hardware addresses. Some versions also rotate the random address over time.
For network admins this breaks DHCP reservations and MAC-based allow lists on Wi-Fi. The fix is to turn off the private address for that one network on the device, or to identify users with 802.1X instead of MACs.
How to find a MAC address
Windows
- getmac /v
- ipconfig /all (look for 'Physical Address')
macOS
- ifconfig en0 | grep ether
- networksetup -getmacaddress en0
Linux
- ip link show
- cat /sys/class/net/eth0/address
Cisco IOS / IOS-XE
- show interfaces | include address
- show mac address-table address 3c22.fb12.3456
- show ip arp 192.168.1.50
Other devices on your network
- arp -a (Windows, macOS, Linux)
- ip neigh (Linux)
- Router admin page → DHCP clients / attached devices
Phones
- iPhone: Settings → Wi-Fi → (i) next to the network
- Android: Settings → Network → Wi-Fi → network → Privacy / Advanced
On phones, the address shown for a network is the private one in use there; the hardware address is listed separately under About.
Common mistakes
- Trusting the vendor name as the device brand. An unknown "Espressif" or "Intel" device is a smart plug or a laptop of any brand. Check the DHCP hostname too.
- Building MAC allow lists for phones. Random MACs change per network (and sometimes daily). Use 802.1X or a captive portal instead.
- Mixing up MAC formats in search. Cisco's show mac address-table address wants dotted format (3c22.fb12.3456); copy the right format above.
- Hunting for a VRRP or HSRP MAC's "vendor". Gateway MACs like 00:00:5E:00:01:0A are virtual and move between routers on failover.
FAQ
Why does my phone show a different MAC address on every Wi-Fi network?
Modern phones use a random 'private' MAC for each Wi-Fi network to stop tracking across networks. iOS calls it Private Wi-Fi Address and Android calls it a randomised MAC. These addresses have the locally administered bit set, so they never match a vendor in the registry.
Can a MAC address tell me the exact device model?
No. The first three bytes (the OUI) identify the company that registered the block, which is often the maker of the network chip rather than the device brand. A laptop with an Intel Wi-Fi card shows Intel, and many smart plugs show Espressif.
What is the difference between MA-L, MA-M and MA-S?
They are the three sizes of block the IEEE sells. MA-L (the classic OUI) fixes 24 bits and leaves about 16.7 million addresses. MA-M fixes 28 bits (about 1 million addresses) and MA-S fixes 36 bits (4,096 addresses), for smaller manufacturers.
Is my MAC address sent to a server?
No. The registry is split into small static files that your browser downloads, and the lookup runs locally. The MAC you type is never sent anywhere.
Why does a MAC show 'Not found'?
Either the block was assigned after this copy of the registry was built, the address is mistyped, or it is a made-up or spoofed address. Locally administered and multicast addresses are never in the registry by design.
How do I change or spoof a MAC address?
Most operating systems let you set a custom MAC on an interface (for example 'ip link set dev eth0 address 02:00:00:aa:bb:cc' on Linux). Use an address with the locally administered bit set (second hex digit 2, 6, A or E) so it can't clash with real hardware.
Vendors network engineers see most
- Amazon 209 blocks
- Apple 1,593 blocks
- Arista Networks 59 blocks
- Cisco Meraki 59 blocks
- Cisco Systems 1,258 blocks
- D-Link 89 blocks
- Dell 194 blocks
- Espressif 374 blocks
- Extreme Networks 100 blocks
- Fortinet 28 blocks
- Google 114 blocks
- Hewlett Packard Enterprise (HPE, Aruba) 180 blocks
- HP (Hewlett Packard, HP Inc.) 195 blocks
- Huawei Technologies 1,417 blocks
- Intel 685 blocks
- Juniper Networks 220 blocks
- Microsoft 118 blocks
- MikroTik (Routerboard.com) 22 blocks
- NETGEAR 77 blocks
- NVIDIA (Mellanox) 93 blocks
- Palo Alto Networks 40 blocks
- Raspberry Pi 10 blocks
- Ruckus Wireless 100 blocks
- Samsung Electronics 906 blocks
- Supermicro 8 blocks
- TP-Link 269 blocks
- Ubiquiti 48 blocks
- VMware 4 blocks
- Xiaomi 337 blocks
- Zyxel 72 blocks