{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

Class{{ resultsReady ? computation.values.address_class : '—' }} Administration{{ resultsReady ? shortAdminClass : '—' }} Vendor evidence{{ resultsReady ? vendorBadge : 'Not checked' }}
Common colon, hyphen, dotted, compact, and byte-separated forms are accepted. Only the first non-blank line is processed.
Provider data can be incomplete or stale; treat a returned organization as assignment evidence, not proof of device identity.
Accepted range: 500–15,000 ms. The default is 4,500 ms.
ms
Off is the neutral default. Enable only when the normal proxy path is unavailable and third-party mediation is acceptable.
{{ usePublicFallback ? 'On' : 'Off' }}
FieldValueMeaningCopy
{{ row.label }}{{ row.value }}{{ row.meaning }}

The chart renderer is unavailable. The binary octet and flag values remain in Address profile.

ProviderTransportOutcomeHTTPLatencyMessageCopy
{{ row.provider }}{{ row.transport }}{{ row.outcome }}{{ row.http_status }}{{ row.latency }}{{ row.message }}
Interpretation
{{ note.title }}

{{ note.detail }}

IP Overlap Checker Check IPv4 CIDRs and ranges for exact duplicates, containment, partial overlap, host-bit corrections, and duplicate address coverage.
Port Exposure Summary Checker Turn firewall, scanner, or cloud-rule port rows into a local exposure review that prioritizes risky public listeners and missing ownership.
Blacklist Checker (DNSBL/RBL) Check a mail host or sender IP across selected DNSBLs, distinguish policy listings from resolver errors, and inspect provider evidence.
Internet Protocol (IP) Geolocation Finder Check a public IP, hostname or URL for approximate location and network-owner clues with optional reverse DNS and clear evidence limits.

A MAC address identifies a link-layer source, destination, or group on a local network segment. Switches learn it, wireless controllers associate it with clients, DHCP records pair it with leases, and packet captures show it in Ethernet headers. Once traffic crosses a router, the visible MAC address usually belongs to the local next hop rather than the remote Internet host.

The familiar six-byte form is an EUI-48 address, often written as 44:38:39:FF:EF:57. EUI-64 uses eight bytes. Punctuation and letter case are presentation choices; the hexadecimal bytes carry the meaning. The first octet also contains two flags that can matter more than a vendor name.

I/G bit
The least significant bit of the first octet. Zero means an individual address; one means a group address such as multicast.
U/L bit
The next bit in the first octet. Zero indicates universal administration; one indicates local administration.
OUI
A 24-bit Organizationally Unique Identifier assigned by the IEEE Registration Authority and used as the leading part of some global EUI assignments.

A vendor match is assignment evidence, not device identity. The registered organization may manufacture components used by other brands, an address may be spoofed, and a locally administered address may be randomized, virtual, or manually assigned. Modern Wi-Fi privacy features deliberately use private addresses so the same device is harder to follow across networks.

Special-use patterns need their protocol context. Broadcast, multicast, virtual-router, bridge-control, and all-zero values are not stable identifiers for one endpoint. Strong attribution joins the address with the capture interface, VLAN, observation time, switch or access-point records, DHCP history, and endpoint inventory.

How to Use This Tool:

Normalize the address first, then decide whether sending it to a remote vendor service is appropriate for the investigation.

  1. Enter one EUI-48 or EUI-64 value. Colon, hyphen, dotted, compact, and byte-separated forms are accepted; only the first non-blank line is processed.
  2. Choose a Provider route. Local only performs deterministic parsing without requesting vendor data. Auto tries maclookup.app and then macvendors.com until a usable assignment is returned.
  3. Select Lookup, then confirm the canonical address, EUI format, I/G bit, U/L bit, and any special-use warning before reading the vendor field.
  4. Treat the provider result as prefix-assignment evidence. Compare it with local DHCP, switch, Wi-Fi controller, hypervisor, or packet-capture records before attributing a device.
  5. Enable Public fallback transport only when the normal route fails and third-party mediation is acceptable. The request timeout may be set from 500 through 15,000 ms.

Interpreting Results:

Structural fields are deterministic for the submitted hexadecimal value. Vendor fields depend on external assignment data and may be missing or stale.

  • Universally administered makes registry assignment evidence relevant, but it does not prove the current device, owner, model, or authenticity.
  • Locally administered means the prefix should not be treated as a normal globally assigned vendor identity. Randomized and virtual addresses are common examples.
  • Multicast, Broadcast, and another special-use result describe group or protocol behavior rather than one endpoint.
  • No match means the selected provider returned no usable vendor. It does not prove that the address is invalid or unassigned.
  • A derived IPv6 interface identifier or link-local candidate shows a deterministic transformation only. It does not prove that the address is configured or active.

Technical Details:

Parsing removes dots, colons, hyphens, and whitespace, converts the remaining hexadecimal digits to uppercase, and accepts exactly 12 digits for EUI-48 or 16 for EUI-64. The same bytes are then rendered in colon, hyphen, dotted, and compact forms without changing the identifier.

Transformation Core

For EUI-48 input, the Modified EUI-64 interface-identifier candidate is formed by flipping the U/L bit in the first octet and inserting FF:FE between the first and last three octets.

Stage Value Change
EUI-48 input44:38:39:FF:EF:57Six source octets.
Flip U/L bit46:38:39:FF:EF:57First octet 44 XOR 02 becomes 46.
Insert marker46:38:39:FF:FE:FF:EF:57FF:FE is inserted after the first three source octets.
IPv6 IID text4638:39ff:feff:ef57The eight bytes are grouped into four hexadecimal words.
Link-local candidatefe80::4638:39ff:feff:ef57The derived IID is shown under the link-local prefix.

An eight-byte input containing FF:FE in the middle can be reversed to an EUI-48 candidate by removing those two bytes and flipping the U/L bit again. Inputs without that marker are not reported as recoverable EUI-48 values.

Rule Core

The first octet is read as eight bits. Bit 0 is I/G and bit 1 is U/L, counting from the least significant end.

Condition Classification Interpretation
I/G = 0IndividualNormally unicast unless an all-zero special case applies.
I/G = 1GroupMulticast or another group-address pattern.
U/L = 0Universally administeredA global assignment may be relevant to prefix lookup.
U/L = 1Locally administeredThe address may be private, randomized, virtual, or manually assigned.
All EUI-48 bits are 1BroadcastThe Ethernet all-stations address, not one hardware interface.
All bits are 0All-zeroAn unspecified or special value, not a stable individual identifier.
Prefix or pattern Reported use
33:33IPv6 multicast mapping.
01:00:5EIPv4 multicast mapping.
01:80:C2IEEE 802 bridge-control group range.
00:00:5E:00:01VRRP virtual router range for IPv4.
00:00:5E:00:02VRRP virtual router range for IPv6.
00:00:0C:07:ACHSRP virtual router range.

The 24-bit prefix view is the first three octets, while the 36-bit view is the first nine hexadecimal digits. A provider may return an MA-L, MA-M, MA-S, or another assignment block that is more specific than the broad 24-bit prefix. The first usable vendor response wins in Auto mode; failed and no-match attempts remain separate evidence.

Privacy Notes:

Local only keeps address parsing and classification in the browser and makes no vendor request. Every remote provider route sends the normalized address for assignment lookup.

  • Auto mode may send the address to maclookup.app and, when needed, macvendors.com.
  • The optional public fallback adds a third-party transport service between the browser and the vendor provider.
  • A MAC address can be sensitive when joined with location, device, employee, Wi-Fi, or incident records. Use local-only mode when remote attribution is unnecessary or inappropriate.
  • Provider availability, rate limits, database age, and private listings can produce failures or empty attribution.

References: