All free tools IEEE registry on the VPSLake server

MAC Address Lookup

Identify the vendor behind a MAC address or OUI prefix, see whether it is a factory or randomized address, look up whole lists, and rewrite MACs into the notation your switch or script expects.

Look up or convert MAC addresses

59,018 blocks
Any notation works: aa:bb:cc:dd:ee:ff, AA-BB-CC-DD-EE-FF, aabb.ccdd.eeff or bare hex. The first 6 hex digits are enough to find the vendor.

Nothing you enter is saved. Vendor lookups are answered from a copy of the IEEE registry on the VPSLake server; format conversion and the IPv6 interface ID are worked out in your browser.

Identify a device in four steps

Useful when an unknown address shows up in an ARP table, a DHCP lease list or a switch's MAC table.

  1. 1

    Collect the address

    Linux: ip link or ip neigh. Windows: getmac /v or Get-NetAdapter. Cisco: show mac address-table. On a VPS, the provider's panel lists the virtual NIC's MAC.

  2. 2

    Look it up

    Paste one address into Vendor lookup, or a whole list into Bulk lookup.

  3. 3

    Read the vendor and the type bits

    The result names the registered company and its block, and tells you whether the address is unicast or multicast and factory-assigned or locally set (often a randomized phone MAC or a VM).

  4. 4

    Convert if needed

    Use Format converter to rewrite a list for a Cisco ACL, a Windows script or a Linux config, then copy or download it.

How a MAC address is built

A MAC address is 48 bits, written as 12 hex digits. The first 24, 28 or 36 bits are a block the IEEE sold to a company (MA-L, MA-M or MA-S); the rest is the serial number that company gave the interface.

Two bits in the first byte carry meaning. The lowest bit marks a multicast group address. The next one, the U/L bit, marks a locally administered address that software chose instead of the factory.

Virtual machines and hypervisors

Virtual NICs usually get MACs from their hypervisor's block, which makes the vendor a quick hint about the platform: 00:50:56 and 00:0C:29 are VMware, 00:15:5D is Hyper-V and 08:00:27 is VirtualBox.

QEMU and KVM, which power most Linux VPS platforms, default to 52:54:00. That prefix is locally administered rather than an IEEE block, so the tool labels it as a KVM virtual NIC instead of naming a vendor.

Randomized MAC addresses

Current Android, iOS, Windows and many Linux distributions use a random "private" MAC per Wi-Fi network so devices cannot be tracked between hotspots. These addresses have the U/L bit set, so the second hex digit is 2, 6, A or E, and they never match a vendor.

If a device keeps changing address on your network, turn off private addressing for that SSID on the device or match it by hostname instead.

Notations and where they are used

Linux, macOS and most network gear print colon-separated lower case. Windows uses upper-case hyphens. Cisco IOS prints three dotted groups of four. They all describe the same 48 bits, so converting is just reformatting. For the IPv6 address a MAC produces with EUI-64, use the MAC to IPv6 converter.

What a MAC lookup cannot do

A MAC address identifies the maker of a network interface, not its owner or location, and it never travels past the first router, so websites and remote servers cannot see it. MACs are also easy to change, so do not treat a MAC allow-list as strong access control on its own.

MAC Address Lookup FAQ

The Organizationally Unique Identifier is the first 24 bits (6 hex digits) of a MAC address, assigned by the IEEE to one company. Smaller MA-M and MA-S blocks extend it to 28 or 36 bits. Entering just those leading digits is enough to find the vendor.
Either the block was never registered publicly, the address was typed wrong, or the company asked the IEEE to keep the assignment private. Locally administered and randomized addresses never have a vendor because no company owns them.
No. The registry only says which company the block was sold to. Only the local network a device is plugged into (its switch, router or Wi-Fi access point) knows which port or room it is on.
Many brands buy network chips or whole boards from contract manufacturers, so the MAC carries the block of the chip maker or ODM rather than the brand printed on the device.
Up to 100 per bulk lookup, in any mix of notations. The format converter handles up to 1,000 lines and runs entirely in your browser.
Each visitor can run about 60 lookup credits in 10 minutes; a bulk lookup of 100 addresses counts as 5. That covers normal troubleshooting comfortably.
It is imported from the IEEE Registration Authority every month. The import date is shown under each result.