Bit 0 — individual or group
Set means the address identifies a group of receivers rather than one interface. Broadcast, the IPv4 and IPv6 multicast mappings, and the 802.1 bridge protocols all live here.
The first three bytes usually identify the manufacturer — but two bits inside the very first byte decide whether that is true at all.
Set means the address identifies a group of receivers rather than one interface. Broadcast, the IPv4 and IPv6 multicast mappings, and the 802.1 bridge protocols all live here.
Set means the address was assigned by whoever runs the network, not by the IEEE. No registry contains it. Randomised phone addresses, virtual machines, bonded interfaces and VRRP are all in this range.
Three block sizes, and they nest: a 36-bit assignment sits inside a 24-bit block held by the IEEE itself. Matching the shorter one first is the standard mistake.
Because those two flag bits sit in the low end of the first octet, the first byte of a registered address is always even. It is why a randomised address is easy to spot once you know: the second hex digit will be 2, 6, A or E.
Most group addresses are not a mystery — they are a protocol, mapped into the address space in a documented way.
| Address | What it is | Where you see it |
|---|---|---|
| FF:FF:FF:FF:FF:FF | Broadcast — every interface on the segment. | ARP requests, DHCP discovery. |
| 01:00:5E:xx:xx:xx | IPv4 multicast (RFC 1112). The low 23 bits are copied from the group address. | mDNS, IGMP, streaming. |
| 33:33:xx:xx:xx:xx | IPv6 multicast (RFC 2464). The low 32 bits are copied from the group address. | Neighbour discovery, router advertisements. |
| 01:80:C2:00:00:00 | The IEEE 802.1 control plane. | Spanning tree, LACP, LLDP. |
| 01:00:0C:CC:CC:CC | Cisco’s control plane. | CDP, VTP, PAgP. |
| 00:00:00:00:00:00 | Unspecified. Not assigned to anything. | A driver or a capture that filled the field with nothing. |
A MAC address is a layer-2 identifier. It is used to deliver a frame across one network segment, and a router replaces it at every hop — so the address never travels beyond the local network. A web server does not see yours; your own switch does.
That makes it genuinely useful for the things it is used for on a network you run: identifying which device holds a DHCP lease, finding which switch port something is plugged into, and reading a packet capture. It also makes MAC-based access control close to worthless as a security measure, because the address is transmitted in clear text in every frame and can be changed by one command on any operating system. Hiding a wireless network’s name is the same category of protection.
The vendor lookup is a diagnostic hint rather than an inventory: it tells you which manufacturer holds the block, which is often a chipset vendor rather than the brand on the case. An unexpected vendor on a network is worth a look; an expected one proves very little, since the field is as forgeable as the rest of the address.
Because it is not a real hardware address. Current iOS, Android, Windows and macOS all generate a random MAC address per network by default, to stop venues and networks tracking a device between visits. A randomised address has the locally-administered bit set, which means no IEEE registry contains it and no manufacturer can be named. Any site that names a vendor for such an address has invented one. The device's real hardware address still exists and is still registered, but it is not what the device presents.
It means the lookup only checked the first three bytes. Some 24-bit blocks — 00:50:C2 and 40:D8:55 among them — are registered to the IEEE itself and subdivided into thousands of smaller 28-bit and 36-bit assignments for organisations that do not need sixteen million addresses. Matching the first three bytes finds the parent block and reports the registration authority as the manufacturer. The longest assignment has to win, which is what this tool does.
The three sizes of IEEE address block. MA-L — what people mean by 'OUI' — fixes the first 24 bits and gives the holder about 16.7 million addresses. MA-M fixes 28 bits, giving about a million. MA-S fixes 36 bits, giving 4,096, and is what a small manufacturer buys. There is also the legacy IAB registry, now closed to new assignments, which worked like MA-S, and the CID registry, which is for protocol identifiers rather than for addressing interfaces.
Not from the address itself. It identifies a network interface, and the registry says only which organisation holds the block it came from — the manufacturer, not the owner. A MAC address also does not cross a router: it is visible on the local network segment and nowhere else, so a web server never sees yours. Where MAC addresses have been used for tracking, it has been by Wi-Fi infrastructure observing devices in range, which is exactly why address randomisation became the default.
It is the signature of an address derived from a MAC. Stateless autoconfiguration built the host half of an IPv6 address by flipping one bit of the hardware address and inserting ff:fe in the middle, which meant the address disclosed the interface's MAC — stable across every network the device joined, and a near-perfect tracking identifier. RFC 8981 privacy addresses replaced it and are now the default, so a modern device's IPv6 address usually has no ff:fe in it. Seeing one tells you something about the device's configuration.
No. The IEEE registries are published here as static JSON files split by address prefix, and the lookup fetches only the file covering your prefix — a few kilobytes — then matches locally. The address never leaves the browser. The index is built from the IEEE registries at build time, so a block assigned very recently may not be in it yet, and the page says so rather than reporting the address as unassigned.
Addressing plans, segmentation, and the migrations that depend on getting them right the first time. We do the design as well as the running of it — and we will tell you when the simpler answer is the right one.