MAC Address Lookup
Paste a MAC address in any common notation and get the organisation that registered the block from the IEEE registry. Only the first three octets are needed, so a partial address works.
Accepts any MAC format: colon, dash, or dotted notation. Only the first 3 octets (OUI) are used for vendor lookup.
The vendor is who registered the block, not who built the device
The first 24 bits are the Organizationally Unique Identifier, bought from the IEEE Registration Authority; the remaining 24 are assigned by that organisation. So the name is accurate about the registry and often misleading about the object in your hand.
- Contract manufacturers register the blocks. A consumer router, an IP camera or a set-top box commonly reports a manufacturer you have never heard of — correctly. Acquisitions leave the registry entry under the old name for years.
- A virtual NIC reports the hypervisor, not the guest.
00:50:56and00:0C:29say VMware,00:15:5DHyper-V,52:54:00QEMU/KVM. Useful — it tells you the host is a virtual machine — as long as you do not read it as the operating system inside.
No vendor found is now the expected answer
- A locally administered address was never registered. The second-least-significant bit of the first octet is the local/global flag, and when it is set no lookup can return a vendor. That is how modern phones and laptops behave by default: private Wi-Fi addressing on iOS and Android and MAC randomisation on Windows generate one per network, some rotating periodically. The OUI is noise.
- A multicast address is a destination, not an interface. The least-significant bit of the first octet is the individual/group flag.
01:00:5Eprefixes IPv4 multicast,33:33IPv6 multicast, and01:80:C2carries spanning tree and LLDP. Looking up a vendor is a category error. - The IEEE now sells blocks smaller than 24 bits. With an MA-S or MA-M assignment the organisation boundary is 36 or 28 bits, so one 24-bit prefix can be shared by many companies and a three-octet lookup returns the block holder rather than the assignee.
- A
429is a rate limit, not an unknown address. It comes from the upstream registry service. Wait a few seconds and retry.
A MAC address is not an identity
It is software-settable with one command on every mainstream operating system, so it proves only what a frame claimed about itself. That makes it excellent for finding a device on your own switches and worthless as an authentication factor: MAC-based access control keeps honest devices in the right VLAN and stops nobody who does not want to be stopped, which is why 802.1X exists and why MAC authentication bypass is a fallback for printers rather than a security control.
The same weight applies in a log. A duplicate MAC on two ports is far more likely a cheap switch, a bridged virtual machine or a loop than an attack, and an unexpected vendor name is far more likely a replaced NIC than an intruder.
Notations accepted
All four describe the same six bytes; the notation is purely a vendor convention — worth knowing when an address from a Cisco show mac address-table and one from a Windows host look nothing alike.
When to use something else
The next question is usually which switch port the address is on and whether its VLAN is the one intended. vlan-audit checks VLAN consistency across switches that are supposed to agree, and subnet-scanner finds what is live in a range. For the unexpected device on an access port, network-aaa-command-authorization covers the identity side properly, and packet-capture-analysis proves which host actually sent the frame rather than trusting the address in it.