# MAC Address Lookup

Identify the registered manufacturer of MAC addresses and OUIs from the IEEE Registration Authority lists (MA-L, MA-M, MA-S, IAB and CID; the longest matching prefix wins). Accepts any notation (colons, hyphens, dots, bare hex, EUI-64, an OUI alone), up to 500 per call, and finds the addresses in pasted ARP or DHCP table rows. For each address returns the vendor, registered address and country, the block type, the multicast and locally administered bits, whether it looks like a randomized (private Wi-Fi) address, well-known special addresses (broadcast, multicast, spanning tree, VRRP) and virtual machine prefixes (VMware, Hyper-V, QEMU/KVM, VirtualBox). A company name lists that company's blocks instead. A vendor is the registered maker of the network chip or card, not the device model or seller. Answers come from a bundled snapshot; nothing is sent to a third party.

**Not for:** Identifying a device model, its owner or its location, or looking up an IP address (use ip_whois).

- Tool id: `mac-lookup`
- Category: ip
- Execution: pure
- MCP tool `mac_lookup` at https://lookupowl.com/mcp
- REST `GET https://lookupowl.com/api/v1/tools/mac-lookup` (or POST a JSON body)
- OpenAPI: https://lookupowl.com/api/openapi.json

## Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `query` | string | yes |  | One or more MAC addresses, OUIs or block prefixes, one per line (commas and spaces also separate), up to 500. Any notation: aa:bb:cc:dd:ee:ff, aa-bb-cc-dd-ee-ff, aabb.ccdd.eeff, aabbccddeeff, or just the first 6 digits (the OUI). Pasted ARP or DHCP table rows are fine: the MAC addresses in each row are found. Or a company name such as "Raspberry Pi" to list that company's registered blocks. max length 65536 |
| `mode` | "auto" \| "mac" \| "vendor" | no | `"auto"` | auto: a single line that is not a MAC address but looks like a company name is searched as a name. mac: always read the input as addresses. vendor: always search registered company names. |

## Output

Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields:

| Field | Type | Description |
|---|---|---|
| `mode` | "mac" \| "vendor" |  |
| `items` | object[] |  |
| `totals` | object |  |
| `truncated` | boolean |  |
| `vendorSearch` | object |  |
| `dataset` | object |  |

## Examples

### A VMware virtual machine

```json
{"query":"00:50:56:C0:00:08","mode":"auto"}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/mac-lookup?mode=auto&query=00%3A50%3A56%3AC0%3A00%3A08'
```

Web page: https://lookupowl.com/mac-address-lookup?q=00%3A50%3A56%3AC0%3A00%3A08

### A phone using a private Wi-Fi address

```json
{"query":"3E:5B:7C:12:34:56","mode":"auto"}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/mac-lookup?mode=auto&query=3E%3A5B%3A7C%3A12%3A34%3A56'
```

Web page: https://lookupowl.com/mac-address-lookup?q=3E%3A5B%3A7C%3A12%3A34%3A56

### Just the OUI, in Cisco dotted style

```json
{"query":"0000.0c07.ac01","mode":"auto"}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/mac-lookup?mode=auto&query=0000.0c07.ac01'
```

Web page: https://lookupowl.com/mac-address-lookup?q=0000.0c07.ac01

### Rows pasted from an ARP table

```json
{"query":"? (192.168.1.1) at 00:00:0c:07:ac:01 on en0\n? (192.168.1.20) at 08:00:27:12:34:56 on en0\n? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0\n? (224.0.0.251) at 1:0:5e:0:0:fb on en0","mode":"auto"}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/mac-lookup?mode=auto&query=%3F+%28192.168.1.1%29+at+00%3A00%3A0c%3A07%3Aac%3A01+on+en0%0A%3F+%28192.168.1.20%29+at+08%3A00%3A27%3A12%3A34%3A56+on+en0%0A%3F+%28192.168.1.255%29+at+ff%3Aff%3Aff%3Aff%3Aff%3Aff+on+en0%0A%3F+%28224.0.0.251%29+at+1%3A0%3A5e%3A0%3A0%3Afb+on+en0'
```

Web page: https://lookupowl.com/mac-address-lookup?q=%3F+%28192.168.1.1%29+at+00%3A00%3A0c%3A07%3Aac%3A01+on+en0%0A%3F+%28192.168.1.20%29+at+08%3A00%3A27%3A12%3A34%3A56+on+en0%0A%3F+%28192.168.1.255%29+at+ff%3Aff%3Aff%3Aff%3Aff%3Aff+on+en0%0A%3F+%28224.0.0.251%29+at+1%3A0%3A5e%3A0%3A0%3Afb+on+en0

### All the blocks registered to a company

```json
{"query":"Raspberry Pi","mode":"auto"}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/mac-lookup?mode=auto&query=Raspberry+Pi'
```

Web page: https://lookupowl.com/mac-address-lookup?q=Raspberry+Pi

## Web pages

- https://lookupowl.com/mac-address-lookup

## Limits and caching

- Cost: from 1 unit up, depending on the input (a registry lookup counts every upstream request); 1 unit for a cached result. Budgets are per network and published in the `RateLimit` response headers.
- Cache: results are kept for 86400 s.
- Timeout: 2 s.

## Related tools

- [IP WHOIS Lookup](https://lookupowl.com/tools/ip-whois.md): Who owns an IPv4 or IPv6 address: network range, name, country, registry, abuse contact and origin AS, from RDAP.
- [IP Address Converter](https://lookupowl.com/tools/ip-convert.md): Convert IP addresses to decimal, hex and binary, IPv4 to IPv6 forms, and pull the IPv4 out of an IPv6 address.
- [IP Subnet Calculator](https://lookupowl.com/tools/subnet-calculator.md): Network, broadcast, usable range, masks and exact host counts for any IPv4 or IPv6 subnet.
- [What Is My IP Address](https://lookupowl.com/tools/what-is-my-ip.md): Show your public IP address, whether it is IPv4 or IPv6, its reverse DNS name and the network it belongs to.

## Guide: MAC address lookup

Find the registered manufacturer of a MAC address or OUI, and see at a glance whether it is a phone's private address, a multicast group or a virtual machine.

### What a MAC lookup tells you

A MAC address is the 48-bit hardware address of a network interface, written as six bytes such as `00:50:56:C0:00:08`. The first three bytes are the **OUI** (organizationally unique identifier). The IEEE Registration Authority sells these prefixes to manufacturers, so the OUI names the company that registered the block. A lookup matches the start of your address against the IEEE lists and tells you who that company is.

It names the maker of the network chip or card, and nothing more. It does not tell you the device model, who sold it, who owns it or where it is. A laptop with an Intel Wi-Fi card shows Intel, and a router built around a Realtek chip may show Realtek. The result is a strong clue when you are tracing an unknown device on your network, and a weak one when you want to know exactly what it is.

> **No vendor is often the right answer** Modern phones and laptops hide behind random addresses on purpose. If the lookup shows no manufacturer, read the notes under the result before you assume something is wrong.

### How to use it

1. **Paste an address**: Use any notation: colons, hyphens, Cisco dots (`0050.56c0.0008`), bare hex or an OUI on its own (`00:50:56`). Upper or lower case, it does not matter.
2. **Or paste a whole table**: Drop in the output of `arp -a`, `ip neigh` or a DHCP lease list, up to 500 addresses. We pick the MAC addresses out of each row and skip the IP addresses, interface names and timestamps around them.
3. **Read the answer**: You get the vendor, its registered address and country, the registry block that matched and a plain-English note about the address itself. A single address shows its bits and every common way of writing it, ready to copy. A list shows a table you can copy as tab-separated text.
4. **Or search by company**: Type a company name such as `Raspberry Pi` and we list the blocks registered under that name, so you can build a filter for a switch or a firewall.

> **From Claude, ChatGPT or Cursor** Connect the LookupOwl MCP server and ask: “Who made the device with MAC address 3C:22:FB:12:34:56?” The assistant calls `mac_lookup` and gets the vendor, the registry block and a note on whether the address looks randomized, multicast or virtual. It takes up to 500 addresses in one call, or a company name to list its blocks.

### Why a phone shows no manufacturer

Two bits in the first byte describe the address itself. The lowest bit says whether the address is for one device (0) or a group (1). The next bit says whether the manufacturer assigned it (0) or software or an administrator chose it (1), which is called **locally administered**. In hex, look at the second digit of the address.

| Second digit | Meaning | Typical example |
|---|---|---|
| `0`, `4`, `8`, `C` | One device, assigned by the manufacturer | A network card straight from the factory |
| `2`, `6`, `A`, `E` | One device, chosen by software | A phone using a private or random Wi-Fi address |
| `1`, `5`, `9`, `D` | A group, assigned by the manufacturer | IPv4 multicast, which starts `01:00:5E` |
| `3`, `7`, `B`, `F` | A group, chosen by software | IPv6 multicast, which starts `33:33` |

iOS and iPadOS call their feature Private Wi-Fi Address, Android calls it Randomized MAC, and Windows has Random hardware addresses. Each network sees a different made-up address, so a phone cannot be followed from café to café by its hardware address. Such an address has no registered owner, so "no vendor" is what you should expect. Some companies, including Google, hold a company ID (CID) for exactly this use, and we name them when the prefix matches.

### MA-L, MA-M, MA-S and CID blocks

The IEEE sells prefixes in three sizes, and a longer prefix leaves less room for the company that owns it. We check the longest one first, so a small company that rents a slice of a bigger block is named instead of the block's holder.

| Block | Prefix length | Addresses in the block | Used for |
|---|---|---|---|
| MA-L | 24 bits (6 hex digits) | About 16.8 million | The classic OUI: most manufacturers |
| MA-M | 28 bits (7 hex digits) | About 1 million | Mid-sized runs of products |
| MA-S | 36 bits (9 hex digits) | About 4,000 | Small makers and single product lines |
| IAB | 36 bits (9 hex digits) | About 4,000 | The older name for small blocks, no longer sold |
| CID | 24 bits (6 hex digits) | Not for factory use | Company IDs for locally administered addresses |

When a 24-bit block is split between many small companies, the entry for the whole block reads IEEE Registration Authority. Give at least 9 hex digits and we find the company that owns your slice. Some owners ask the IEEE to keep the name out of the public list, and the registry then shows the owner as Private.

### Multicast, broadcast and virtual machines

Not every address on a network belongs to a device. `FF:FF:FF:FF:FF:FF` is the broadcast address, which every device on the segment receives. IPv4 multicast frames go to `01:00:5E` and IPv6 multicast frames to `33:33`. Spanning tree, LLDP, Cisco Discovery Protocol and the shared gateway addresses of VRRP and HSRP all have well-known values too. We name them, so an entry in a packet capture or a switch table stops being a mystery.

Hypervisors also pick recognisable prefixes. VMware uses `00:50:56` and `00:0C:29`, Microsoft Hyper-V uses `00:15:5D`, VirtualBox uses `08:00:27`, QEMU and KVM use `52:54:00`, Xen uses `00:16:3E`, and Docker starts container addresses with `02:42`. If you see one of these, the address belongs to a virtual network card, and the vendor in the result is the maker of the virtualisation software, not of the server underneath.

### Where the data comes from

The vendor names, addresses and countries come from the public lists of the IEEE Registration Authority: MA-L, MA-M, MA-S, IAB and CID. We keep a snapshot on our own server and show its date under every answer, so a lookup never waits on anyone else and no address is sent to a third party to answer it. A prefix assigned after the snapshot will show as not found until the next refresh.

The lists carry no assignment dates, so we cannot tell you when a block was registered. The country is read from the registered address, and it is left out when the address does not say. The same lookup is available as a REST endpoint and as an MCP tool, so a script or an AI assistant can use it too.

Related tools: [IP WHOIS](https://lookupowl.com/ip-whois-lookup) tells you who owns an IP address, [what is my IP](https://lookupowl.com/what-is-my-ip) shows the address the internet sees for you, and [IPv6 expand](https://lookupowl.com/ipv6-expand) spells out the link-local IPv6 address a device builds from its MAC.

### Frequently asked questions

**What is an OUI?**

An OUI is the organizationally unique identifier: the first three bytes (six hex digits) of a MAC address. The IEEE assigns it to a company, which then numbers its own devices after it. Entering only the OUI, such as `00:50:56`, is the quickest way to ask who a block belongs to.

**Can a MAC address tell me the device model or its owner?**

No. It names the company that registered the prefix, which is usually the maker of the network chip or card. The model, the seller, the owner and the location are not in it. Treat the vendor as a clue, then check the device itself or your router's device list.

**Why does my phone show no vendor, or the wrong one?**

Phones and laptops use private or random Wi-Fi addresses by default, and these are locally administered, so no manufacturer is registered for them. An address that does name a brand may come from a different chip supplier than the brand you expect, because many devices use a module made by someone else.

**How do I tell a randomized MAC address from a real one?**

Look at the second hex digit. If it is 2, 6, A or E, the locally administered bit is set and the address was probably made up by software. We label these as likely randomized, unless the prefix is a known virtual machine or company ID. It is a strong hint rather than proof, because a person can also set an address by hand.

**Is there a list I can download?**

We do not offer a bulk download of the list. The IEEE publishes it on its own site, and our lookup, REST endpoint and MCP tool answer one question at a time or up to 500 addresses at once.

**How up to date is the data?**

Every answer shows the date of the IEEE snapshot it came from. A company that registered a prefix after that date will not appear until the next refresh. If a brand-new device shows no vendor and its address does not look randomized, that is the most likely reason.

**Does it work for IPv6 addresses built from a MAC?**

Yes, when you give us the MAC. A device can build the last 64 bits of an IPv6 address from its MAC address by inserting `ff:fe` in the middle and flipping the locally administered bit of the first byte. If you only have the IPv6 address, take its last 64 bits, flip that bit back (a first byte of `02` becomes `00`) and remove the `ff:fe`.