MAC Addresses, Explained

The basics

What a MAC address is and how the pieces fit together.

What is a MAC address?

A Media Access Control address is a 48 bit identifier burned into a network interface at the factory. It identifies one interface on one local network segment, which is what lets a switch decide which port a frame should leave by.

It is not an internet address. IP addresses route traffic between networks and change as a device moves; a MAC address never leaves the local segment and, traditionally, never changed at all. A laptop with Wi-Fi and Ethernet has two of them, one per interface.

Where is the OUI in a MAC address?

The Organizationally Unique Identifier is the first 24 bits, which is the first three octets. It identifies the organization that registered the block with the IEEE. In 00:1B:C5:09:40:00, the OUI is 00:1B:C5.

That size is now formally called MA-L, for MAC Address Block Large. It is still the most common registration and the one people mean when they say OUI.

What are OUI-28 and OUI-36?

They are smaller blocks carved out of a single 24 bit prefix. OUI-28 is now called MA-M and covers 28 bits, giving the registrant a bit over a million addresses. OUI-36 is called MA-S and covers 36 bits, or 4,096 addresses.

Because they nest inside a 24 bit prefix, the first three octets are shared between many unrelated companies. That is why a correct lookup has to match the longest prefix rather than stopping at the first three octets.

What is an IAB?

An Individual Address Block is a 36 bit assignment from a registry the IEEE retired in 2014. It is functionally identical to an MA-S. Existing IABs remain valid and are still in this database, but no new ones have been issued for over a decade.

Nearly every IAB in existence lives under two IEEE-owned prefixes, 00:50:C2 and 40:D8:55, which between them hold thousands of separate registrants.

What is a CID?

A Company ID is a 24 bit identifier that looks exactly like an OUI but is explicitly not for globally unique MAC addresses. CIDs always have the locally administered bit set, which means an address built from one can never collide with a real manufacturer assignment.

They are used for protocol identifiers and for locally administered addressing schemes. There are only a couple of hundred of them.

Lookups and results

Why a lookup returns what it does, and why it sometimes returns nothing.

Why does my MAC address return no result?

Three common reasons. The prefix may genuinely be unassigned; the IEEE has handed out only a fraction of the space. The address may be locally administered, meaning software chose it rather than a manufacturer. Or the device may be randomising its address for privacy.

You can tell the second case at a glance. If the second hex digit is 2, 6, A, or E, the locally administered bit is set and there is no registration to find, no matter which lookup service you use.

Why do phones show a different MAC address on every network?

Since roughly 2020, every major mobile operating system generates a fresh, locally administered MAC address per network by default. Apple calls it Private Wi-Fi Address, Android calls it randomised MAC, and Windows calls it random hardware addresses.

The reason is tracking. A stable MAC address broadcast in every Wi-Fi probe request is a durable identifier that shopping centres, airports, and anyone with an antenna can use to follow a person between visits. Randomisation breaks that.

The practical consequence for network administrators is that MAC-based allowlists and DHCP reservations no longer work reliably on consumer devices.

Two lookup sites disagree about who owns a prefix. Which is right?

Usually both are reading the same IEEE data, and the difference is that one of them stops at the first 24 bits. If the address falls inside an MA-M, MA-S, or IAB block, the 24 bit prefix belongs to a parent registrant while the specific address belongs to someone else entirely.

This site always returns the most specific block that contains the address, which is the registrant that actually made the device.

The company name looks wrong or out of date.

We publish the IEEE registry exactly as filed and never edit records. Companies are acquired, rename themselves, and rarely bother updating a registration from 1998, so a prefix can carry a name that has not existed for twenty years.

Corrections have to go through the IEEE Registration Authority. Once the registrant updates their filing, the change reaches this site on the next daily import.

Can I find a specific device from its MAC address?

No. A MAC address identifies a manufacturer and a block, not a unit, an owner, or a location. There is no public registry mapping addresses to individual devices, and the manufacturer has no obligation to keep one.

The address is also only visible on the local network segment. It does not travel across the internet, so it cannot be used to look anything up remotely.

History

How a 48 bit number ended up on every network interface ever made.

Where did MAC addresses come from?

They come from Ethernet, invented at Xerox PARC in 1973 by Robert Metcalfe and David Boggs. The original experimental Ethernet used 8 bit addresses assigned by hand, which worked because the whole network was one building.

The 1980 DIX specification, produced by Digital Equipment Corporation, Intel, and Xerox, widened the address to 48 bits and made it globally unique. That decision, made for a coaxial cable network running at 10 Mbit/s, is why the identifier on a 2026 Wi-Fi 7 radio has exactly the same shape.

Why is the very first OUI assigned to Xerox?

Because Xerox administered the registry before the IEEE did. Xerox handed out the first blocks starting at 00:00:00 and worked upward, keeping the earliest ones for itself. 00:00:00 through 00:00:09 are all Xerox, and the company still holds those prefixes today.

The IEEE Registration Authority took over administration in the 1980s. The numbering simply continued from where Xerox left off, which is why the low end of the registry is a fossil record of the early 1980s computer industry.

Why 48 bits?

It was chosen to be comfortably larger than anyone could imagine needing. 48 bits is about 281 trillion addresses, and the designers wanted enough room that nobody would ever have to coordinate address reuse.

They were roughly right. After more than four decades, the IEEE has assigned well under one percent of the space. The pressure that did arrive was economic rather than numeric: a 16.7 million address block is absurd overkill for a company shipping a few thousand sensors, which is why the smaller MA-M and MA-S sizes were introduced.

What happened in 2014?

The IEEE restructured the registries. The OUI, OUI-28, and OUI-36 names were replaced by MA-L, MA-M, and MA-S, and the IAB registry was closed to new registrations because MA-S covered the same need.

The old names never went away in practice. Vendor documentation, network tooling, and most written material about MAC addresses still say OUI, and this site indexes both.

What is EUI-64 and why does my IPv6 address contain my MAC address?

EUI-64 is a 64 bit version of the same identifier scheme. Early IPv6 stateless address autoconfiguration built the host portion of an address by taking the 48 bit MAC address, inserting the fixed bytes FF:FE in the middle, and flipping the universal/local bit.

That meant a device broadcast a stable hardware identifier to every server it contacted, worldwide, which turned out to be a privacy disaster. RFC 4941 privacy extensions and later RFC 7217 stable-but-opaque addresses replaced it, and modern systems no longer derive IPv6 addresses from MAC addresses by default.

Odds and ends

Details that are useless right up until the moment they are not.

What do the two special bits in the first octet do?

Bit 0 of the first octet is the I/G bit. Set, it means the frame is multicast or broadcast rather than addressed to one interface. FF:FF:FF:FF:FF:FF, the broadcast address, is the extreme case.

Bit 1 is the U/L bit. Set, it means the address is locally administered and carries no vendor meaning. Because both bits live in the first octet, you can read a great deal from the second hex digit alone: an even value means a normal, globally unique vendor address.

Why are MAC addresses written in so many formats?

Vendor habit. Colons came from Unix, hyphens from IEEE documents and Windows, and the four-digit dotted form from Cisco IOS. Some tooling drops separators entirely.

They all encode the same twelve hex digits, so every lookup on this site accepts any of them.

Is 00:00:00:00:00:00 a real address?

It is inside Xerox space, and it is a valid pattern, but it is conventionally treated as null. Seeing it in a packet capture or an ARP table almost always means something failed to populate the field rather than that a real Xerox device is on the wire.

What are the strangest entries in the registry?

The registry is full of dead companies, absorbed subsidiaries, and organizations that clearly filled in the form under duress. Several hundred blocks are registered simply as "Private", which the IEEE permits for a fee. Addresses range from full corporate headquarters to a single line naming a country.

Some registrants appear many times over under slightly different spellings of the same company name, because the IEEE treats each filing independently and has no concept of a corporate identity that persists across them.

Can two devices have the same MAC address?

They are not supposed to, but it happens. Manufacturing errors have shipped entire production runs with duplicate addresses, cheap unbranded hardware sometimes reuses a prefix it does not own, and virtual machines and containers generate addresses that can collide.

A duplicate only causes trouble if both devices are on the same network segment, where the symptom is intermittent, deeply confusing connectivity loss for both.

Can I change my MAC address?

Yes. The address burned into the hardware is only a default; every mainstream operating system will let you override what the interface reports. This is what the phones are doing when they randomise.

If you set one manually, set the locally administered bit, which means making the second hex digit 2, 6, A, or E. That guarantees you cannot collide with a real vendor assignment. The generator on this site can do it for you.

The five registry sizes

Each links to a page with live counts from the current import.