Tool
MAC Address Lookup
Identify the manufacturer of any network device from its MAC address OUI.
About
What is a MAC Address?
A MAC (Media Access Control) address is a 48-bit hardware identifier assigned to every network interface card at manufacture. It operates at Layer 2 of the OSI model and is used for device-to-device communication on local networks — switches use MAC addresses to forward frames to the correct port.
The first 3 bytes (24 bits) form the OUI (Organizationally Unique Identifier), assigned by the IEEE to hardware manufacturers. The IEEE maintains a public registry of over 35,000 OUI assignments covering the vast majority of hardware vendors worldwide.
For network engineers, MAC lookups help identify unknown devices on a switch, verify hardware inventory, and detect spoofed addresses during network forensics. For security teams, unexpected vendor identifiers on a trusted network segment can indicate rogue devices or MAC spoofing.
Use Cases
When to Use a MAC Address Lookup
Network Inventory
Identify unknown devices appearing on switch MAC address tables during network audits. Quickly determine if a new device is a managed switch, Wi-Fi AP, or end-user workstation.
Rogue Device Detection
If a MAC address appears on a port that should only have a known device, verify the vendor. An unexpected Chinese hardware vendor on an enterprise port warrants investigation.
DHCP Log Analysis
Map DHCP lease logs to device types during incident response. Correlating MAC vendor with expected device type helps filter false positives when triaging unusual network activity.
MAC Spoofing Detection
Randomized MACs from iOS, Android, and Windows 11 are flagged as locally-administered addresses. A lookup returning no vendor or a mismatched vendor can confirm spoofing on monitored segments.
FAQ
Frequently Asked Questions
What is a MAC address OUI?+
The OUI (Organizationally Unique Identifier) is the first 3 bytes of a MAC address, assigned by the IEEE to hardware vendors. It uniquely identifies the manufacturer of the network interface.
How do I find the MAC address of a device?+
On Windows run 'ipconfig /all' — Physical Address is the MAC. On Linux/Mac run 'ip link show' or 'ifconfig'. On a network switch, run 'show mac address-table' to see all learned MACs per port.
Can a MAC address be spoofed?+
Yes. MACs can be changed in software on most operating systems. iOS, Android, and Windows 10+ randomize MACs for Wi-Fi scanning by default to prevent tracking. A lookup returning an unexpected vendor may indicate spoofing in a forensics context.
Why does my lookup return unknown?+
Not all OUI blocks are in the public IEEE registry. Some are privately registered. Locally administered addresses (bit 1 of byte 1 is set) and randomized MACs from mobile devices will not match any vendor.