MAC address lookup
Find the registered manufacturer of a MAC address or OUI, and see at a glance whether it is a phone's private address, a multicast group or a virtual machine.
Results for 3E:5B:7C:12:34:56
Private address
Likely a private (random) address
Phones and laptops make these up on purpose, so no manufacturer is registered. A missing vendor is expected here.
- Local bit
- Set by software
- Group bit
- One device
3E is 00111110 in binary. The local bit is set and the group bit is clear.
One device, address set by software
Nothing registered for this prefix
Nothing registered
- The second digit of the first byte is E, which sets the "locally administered" bit. Phones and laptops set it on purpose when they use a private or random Wi-Fi address (iOS and iPadOS "Private Wi-Fi Address", Android "Randomized MAC", Windows "Random hardware addresses"). No manufacturer is expected, so a missing vendor is normal.
Ways to write it
- Colons
3E:5B:7C:12:34:56- Hyphens
3E-5B-7C-12-34-56- Cisco dots
3e5b.7c12.3456- No separators
3E5B7C123456- Lower case
3e:5b:7c:12:34:56
Registration
- Registered to
- –
- IEEE lists as of
- 2026-11-14
Structured result (JSON) · 1.3 KB
{
"mode": "mac",
"items": [
{
"input": "3E:5B:7C:12:34:56",
"ok": true,
"kind": "mac",
"normalized": "3E:5B:7C:12:34:56",
"formats": {
"colon": "3E:5B:7C:12:34:56",
"hyphen": "3E-5B-7C-12-34-56",
"cisco": "3e5b.7c12.3456",
"bare": "3E5B7C123456"
},
"found": false,
"addressType": "local-unicast",
"firstByte": {
"hex": "3E",
"binary": "00111110"
},
"multicast": false,
"locallyAdministered": true,
"randomizedLikely": true,
"notes": [
"The second digit of the first byte is E, which sets the \"locally administered\" bit. Phones and laptops set it on purpose when they use a private or random Wi-Fi address (iOS and iPadOS \"Private Wi-Fi Address\", Android \"Randomized MAC\", Windows \"Random hardware addresses\"). No manufacturer is expected, so a missing vendor is normal."
]
}
],
"totals": {
"items": 1,
"ok": 1,
"failed": 0,
"found": 0,
"randomized": 1,
"multicast": 0,
"virtual": 0
},
"truncated": false,
"dataset": {
"snapshot": "2026-11-14",
"source": "IEEE Registration Authority (standards-oui.ieee.org): oui.csv, mam.csv, oui36.csv, iab.csv, cid.csv",
"blocks": 59265
}
}What a MAC lookup tells you
A MAC address is the 48-bit hardware address of a network interface, written as six bytes such as 00:50:56:C0:00:08. The first three bytes are the OUI (organizationally unique identifier). The IEEE Registration Authority sells these prefixes to manufacturers, so the OUI names the company that registered the block. A lookup matches the start of your address against the IEEE lists and tells you who that company is.
It names the maker of the network chip or card, and nothing more. It does not tell you the device model, who sold it, who owns it or where it is. A laptop with an Intel Wi-Fi card shows Intel, and a router built around a Realtek chip may show Realtek. The result is a strong clue when you are tracing an unknown device on your network, and a weak one when you want to know exactly what it is.
How to use it
- Paste an addressUse any notation: colons, hyphens, Cisco dots (
0050.56c0.0008), bare hex or an OUI on its own (00:50:56). Upper or lower case, it does not matter. - Or paste a whole tableDrop in the output of
arp -a,ip neighor a DHCP lease list, up to 500 addresses. We pick the MAC addresses out of each row and skip the IP addresses, interface names and timestamps around them. - Read the answerYou get the vendor, its registered address and country, the registry block that matched and a plain-English note about the address itself. A single address shows its bits and every common way of writing it, ready to copy. A list shows a table you can copy as tab-separated text.
- Or search by companyType a company name such as
Raspberry Piand we list the blocks registered under that name, so you can build a filter for a switch or a firewall.
Why a phone shows no manufacturer
Two bits in the first byte describe the address itself. The lowest bit says whether the address is for one device (0) or a group (1). The next bit says whether the manufacturer assigned it (0) or software or an administrator chose it (1), which is called locally administered. In hex, look at the second digit of the address.
| Second digit | Meaning | Typical example |
|---|---|---|
0, 4, 8, C | One device, assigned by the manufacturer | A network card straight from the factory |
2, 6, A, E | One device, chosen by software | A phone using a private or random Wi-Fi address |
1, 5, 9, D | A group, assigned by the manufacturer | IPv4 multicast, which starts 01:00:5E |
3, 7, B, F | A group, chosen by software | IPv6 multicast, which starts 33:33 |
iOS and iPadOS call their feature Private Wi-Fi Address, Android calls it Randomized MAC, and Windows has Random hardware addresses. Each network sees a different made-up address, so a phone cannot be followed from café to café by its hardware address. Such an address has no registered owner, so "no vendor" is what you should expect. Some companies, including Google, hold a company ID (CID) for exactly this use, and we name them when the prefix matches.
MA-L, MA-M, MA-S and CID blocks
The IEEE sells prefixes in three sizes, and a longer prefix leaves less room for the company that owns it. We check the longest one first, so a small company that rents a slice of a bigger block is named instead of the block's holder.
| Block | Prefix length | Addresses in the block | Used for |
|---|---|---|---|
| MA-L | 24 bits (6 hex digits) | About 16.8 million | The classic OUI: most manufacturers |
| MA-M | 28 bits (7 hex digits) | About 1 million | Mid-sized runs of products |
| MA-S | 36 bits (9 hex digits) | About 4,000 | Small makers and single product lines |
| IAB | 36 bits (9 hex digits) | About 4,000 | The older name for small blocks, no longer sold |
| CID | 24 bits (6 hex digits) | Not for factory use | Company IDs for locally administered addresses |
When a 24-bit block is split between many small companies, the entry for the whole block reads IEEE Registration Authority. Give at least 9 hex digits and we find the company that owns your slice. Some owners ask the IEEE to keep the name out of the public list, and the registry then shows the owner as Private.
Multicast, broadcast and virtual machines
Not every address on a network belongs to a device. FF:FF:FF:FF:FF:FF is the broadcast address, which every device on the segment receives. IPv4 multicast frames go to 01:00:5E and IPv6 multicast frames to 33:33. Spanning tree, LLDP, Cisco Discovery Protocol and the shared gateway addresses of VRRP and HSRP all have well-known values too. We name them, so an entry in a packet capture or a switch table stops being a mystery.
Hypervisors also pick recognisable prefixes. VMware uses 00:50:56 and 00:0C:29, Microsoft Hyper-V uses 00:15:5D, VirtualBox uses 08:00:27, QEMU and KVM use 52:54:00, Xen uses 00:16:3E, and Docker starts container addresses with 02:42. If you see one of these, the address belongs to a virtual network card, and the vendor in the result is the maker of the virtualisation software, not of the server underneath.
Where the data comes from
The vendor names, addresses and countries come from the public lists of the IEEE Registration Authority: MA-L, MA-M, MA-S, IAB and CID. We keep a snapshot on our own server and show its date under every answer, so a lookup never waits on anyone else and no address is sent to a third party to answer it. A prefix assigned after the snapshot will show as not found until the next refresh.
The lists carry no assignment dates, so we cannot tell you when a block was registered. The country is read from the registered address, and it is left out when the address does not say. The same lookup is available as a REST endpoint and as an MCP tool, so a script or an AI assistant can use it too.
Related tools: IP WHOIS tells you who owns an IP address, what is my IP shows the address the internet sees for you, and IPv6 expand spells out the link-local IPv6 address a device builds from its MAC.
Questions people ask
What is an OUI?
An OUI is the organizationally unique identifier: the first three bytes (six hex digits) of a MAC address. The IEEE assigns it to a company, which then numbers its own devices after it. Entering only the OUI, such as 00:50:56, is the quickest way to ask who a block belongs to.
Can a MAC address tell me the device model or its owner?
No. It names the company that registered the prefix, which is usually the maker of the network chip or card. The model, the seller, the owner and the location are not in it. Treat the vendor as a clue, then check the device itself or your router's device list.
Why does my phone show no vendor, or the wrong one?
Phones and laptops use private or random Wi-Fi addresses by default, and these are locally administered, so no manufacturer is registered for them. An address that does name a brand may come from a different chip supplier than the brand you expect, because many devices use a module made by someone else.
How do I tell a randomized MAC address from a real one?
Look at the second hex digit. If it is 2, 6, A or E, the locally administered bit is set and the address was probably made up by software. We label these as likely randomized, unless the prefix is a known virtual machine or company ID. It is a strong hint rather than proof, because a person can also set an address by hand.
Is there a list I can download?
We do not offer a bulk download of the list. The IEEE publishes it on its own site, and our lookup, REST endpoint and MCP tool answer one question at a time or up to 500 addresses at once.
How up to date is the data?
Every answer shows the date of the IEEE snapshot it came from. A company that registered a prefix after that date will not appear until the next refresh. If a brand-new device shows no vendor and its address does not look randomized, that is the most likely reason.
Does it work for IPv6 addresses built from a MAC?
Yes, when you give us the MAC. A device can build the last 64 bits of an IPv6 address from its MAC address by inserting ff:fe in the middle and flipping the locally administered bit of the first byte. If you only have the IPv6 address, take its last 64 bits, flip that bit back (a first byte of 02 becomes 00) and remove the ff:fe.
Use it from AI, the API or the command line
Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is mac_lookup. Please be kind to the rate limits.
curl "https://lookupowl.com/api/v1/tools/mac-lookup?q=00%3A50%3A56%3AC0%3A00%3A08"claude mcp add --transport http lookupowl https://lookupowl.com/mcp