Most of the attention in networking goes to IP addresses. They are logical, they change, they route across the world, and they show up in every diagram. But every packet that leaves a device also carries a hardware address burned into the network interface itself, one layer down. That is the MAC address, and when you are staring at an unfamiliar device on your network, it is usually the first useful clue you have.
The MAC Vendor Lookup takes one of those addresses and tells you who made the hardware. Paste in a MAC, and it extracts the manufacturer prefix, checks it against the IEEE registry, and reports the vendor along with a couple of flags encoded in the address itself. This guide explains what it is reading, and how you can put that information to work.
What a MAC address actually is
A standard IEEE 802 address (MAC-48, also called EUI-48) is 48 bits long, written as six hexadecimal octets. Something like 00:1A:2B:3C:4D:5E. Every physical or virtual network interface has one: an Ethernet port, a Wi-Fi chip, a Bluetooth radio, a virtual switch interface on a hypervisor.
The 48 bits split into two halves, and the split is the whole reason a vendor lookup is even possible.
| Portion | Bits | Example | Who assigns it |
|---|---|---|---|
| OUI (Organizationally Unique Identifier) | First 24 | 00:1A:2B |
The IEEE, sold in blocks to vendors |
| NIC-specific | Last 24 | 3C:4D:5E |
The manufacturer, per individual device |
The first three octets are the Organizationally Unique Identifier. Companies that build network hardware, such as Apple, Cisco, Intel, Samsung, or Dell, buy these blocks from the IEEE. The last three octets are assigned by that manufacturer to individual interfaces, which is what keeps every NIC globally distinct. So when you look up a vendor, what the tool is really doing is isolating that first 24-bit OUI and matching it to the registered owner.
The two flags hiding in the first octet
Two bits in the very first octet carry meaning beyond the vendor, and they are easy to miss if you are only reading the hex.
- The I/G bit (Individual/Group) is the least significant bit of the first octet. A
0means the frame is unicast, headed for a single device. A1means multicast or broadcast, meant for many. - The U/L bit (Universal/Local) is the next bit over. A
0means the address was universally administered, assigned by the manufacturer as the IEEE intended. A1means it was locally administered, set by an admin or by software rather than the factory.
That U/L bit is far more relevant now than it used to be. iOS, Android, and Windows all ship with private Wi-Fi addresses, or MAC randomization, turned on by default. When your phone scans for networks, it generates a random, locally administered MAC so it cannot be tracked across locations. If you look up one of those addresses expecting a vendor and get nothing useful, the U/L flag is the tell. The lookup reports it so you know you are staring at a randomized address rather than a real piece of hardware.
What the tool accepts and returns
You do not have to normalize the format yourself. The lookup handles the common notations:
- Colon-separated:
00:1A:2B:3C:4D:5E - Hyphenated:
00-1A-2B-3C-4D-5E - Cisco dot format:
001a.2b3c.4d5e - Bare hex:
001A2B3C4D5E
It strips the separators, pulls out the OUI, and queries the IEEE Registration Authority data (which spans the MA-L, MA-M, MA-S, and IAB block sizes). Back come the manufacturer name (say, Cisco Systems, Apple, or Raspberry Pi Trading Ltd), the OUI prefix block, whether the address is universally or locally administered, and whether it is unicast or multicast.
One thing worth being clear about: the tool reads an address you give it. It does not scan your network, read your ARP or DHCP tables, or watch for rogue devices on its own. That work is yours to do. What the lookup provides is the translation step, turning a hex string into a name and a set of attributes you can act on.
Ways to actually use it
Sorting out an asset inventory. Pull the MAC list from your DHCP leases or a switch's ARP table (arp -a on a workstation gets you started), then run the unknown ones through the lookup. Once you see that a cluster of addresses belongs to Axis Communications, you know those are cameras; HP Inc. points at printers; Yealink means VoIP phones. From there you can tag devices and sort them onto the right VLANs. Pair this with an IP ownership / ASN lookup when you need to trace the routable side of a device too, and a Subnet Calculator when you are laying out those VLANs.
Spotting devices that should not be there. If someone plugs a cheap router or a Raspberry Pi into an office port, it will ask for a DHCP lease like anything else. Feed the new MAC through the lookup and an OUI belonging to, say, the Raspberry Pi Foundation or TP-Link showing up on a corporate segment is worth a second look. The tool does not raise the alarm for you, but it names the manufacturer so you can decide whether the alarm is warranted.
Making packet captures readable. During a Wireshark session, a screen full of hex MACs tells you very little at a glance. Resolving the vendor behind an address helps you pin down which physical switch or interface is behind an anomaly, whether that is ARP poisoning or a spanning-tree loop.
Debugging MAC filtering. Wireless MAC filtering restricts access to a list of approved hardware. It is not real security, since MACs are trivial to spoof, but it is common. When a device that used to connect suddenly cannot, checking the U/L flag often explains it: an OS update flipped on MAC randomization, so the device is now presenting a locally administered address that is not on the list.
Where the lookup stops being enough
MAC addresses are easy to change. Most drivers let a user overwrite the interface's MAC in software, which means an attacker can borrow the OUI of a manufacturer you trust and walk straight past a basic MAC allow-list. A vendor lookup gives you real operational intelligence, but it is not authentication. For anything that has to hold up under pressure, pair it with Layer 3 controls like 802.1X.
Used with that caveat in mind, the lookup is one of those small tools you reach for constantly: identifying gear during an inventory, isolating an unexpected IoT box, cleaning up a packet capture, or working out why a device dropped off the wireless. It turns a string of hex into something you can reason about, which is most of the battle at Layer 2.