MAC Address Details Lookup

Lookup status

Processed the first MAC address only and ignored {{ extraLinesIgnored }} extra line(s).

MAC address:

Paste one address: AA:BB:CC:DD:EE:FF, AABB.CCDD.EEFF, or AABBCCDDEEFF.

Provider route:

Auto queries maclookup.app then macvendors.com; None keeps lookup offline.

Provider timeout:

Range: 500-15000 ms in 100 ms steps; raise only for slow provider responses.

Proxy fallback:

Enable only after direct vendor evidence fails or browser CORS blocks the route.

Identity action sensitivity:

Balanced fits normal triage; Strict is best before asset or security action.

Field	Value	Copy
{{ row.label }}	{{ row.value }}
No MAC details available Enter one valid EUI-48 or EUI-64 address to populate normalized formats and OUI fields.

Provider	Transport	Status	HTTP	Latency	Message	Copy
{{ row.provider }}	{{ row.transport }}	{{ row.status }}	{{ row.httpStatus }}	{{ row.latency }}	{{ row.message }}
No provider evidence available Use a provider route other than None to record remote vendor lookup attempts.

Priority	Action	Why now	Next check	Cadence	Copy
{{ row.priority }}	{{ row.action }}	{{ row.reason }}	{{ row.next_check }}	{{ row.cadence }}
No identity actions available Run a valid lookup so randomization, special-use, provider, and evidence signals can be ranked.

Embed:

Customize

Include current inputs

Size

Advanced

Width

Height

Aspect ratio

Max height

Collapsible embed

Allow fullscreen

Referrer policy

Sandbox tokens

A Media Access Control address is a link-layer identifier used on a local network segment. Switches learn it, Wi-Fi access points log it, DHCP servers associate it with leases, and packet captures show it because Ethernet and many related link layers need a compact way to identify frame sources and destinations.

The address is often treated like a device fingerprint, but that shortcut can mislead an investigation. A vendor prefix usually points to an assignment record, not a guaranteed product model or owner. The first octet also carries two flags that can outweigh the vendor name: one bit distinguishes individual addresses from group addresses, and another distinguishes globally assigned space from locally administered space.

Modern privacy and virtualization features make those flags practical. Phones and laptops may use private Wi-Fi addresses that differ by network. Virtual machines, containers, routers, and lab systems often use locally assigned prefixes. Protocols also reserve ranges for multicast, bridge control, virtual routers, and broadcast behavior. A lookup is strongest when the structural flags and provider evidence agree with local logs.

MAC address evidence and practical limits
Evidence	What it can support	What it cannot prove alone
Registered prefix or OUI	Likely assignment owner or vendor family when the address is globally administered.	The exact device model, current owner, or whether the address was spoofed.
I/G bit	Whether the address is individual or group-oriented.	That a multicast or special-use value belongs to one endpoint.
U/L bit	Whether the value is locally administered and may be private, random, virtual, or manual.	That a locally administered value is always temporary or malicious.
Local network observations	Repeated sightings, port history, DHCP leases, controller records, or asset inventory matches.	A vendor registry update, provider freshness, or remote attribution by itself.

The shortest vocabulary is EUI-48 for the six-byte form most people call a MAC address, EUI-64 for an eight-byte extended identifier, OUI for the familiar 24-bit assignment prefix, I/G for individual versus group, and U/L for universal versus local. The I/G and U/L bits are the two low-order bits of the first octet, so they appear at the right side when that octet is written in binary.

Good MAC address triage starts with normalization, then flags, then special-use checks, then provider evidence. The vendor name should be treated as corroboration rather than a verdict. For asset actions, access-control decisions, or incident response, compare the lookup with DHCP records, switch tables, Wi-Fi controller history, endpoint-management data, or repeated sightings on the same network.

A lookup cannot turn a changeable link-layer value into a permanent identity. It can show whether the address is structurally valid, which class it belongs to, which provider evidence was available, and which follow-up checks are worth doing before acting.

How to Use This Tool:

Use one address per lookup. The form accepts common EUI-48 and EUI-64 spellings, extracts one MAC-like token from surrounding text, and reports structural fields before remote vendor evidence is trusted.

Paste one value in MAC address. Colon-separated, hyphen-separated, dotted, compact hexadecimal, and byte-separated forms can be normalized when they contain 12 or 16 hexadecimal digits.
Press Lookup. The summary should show the canonical colon form, or a validation message if the input is empty, has no hexadecimal characters, contains invalid characters, or has the wrong length.
If a ticket, log line, or multi-line paste was used, check Parse Note in Vendor Details. When extra lines are ignored, rerun each address separately.
Choose Provider route deliberately. Auto tries maclookup.app first and then macvendors.com when needed, a named provider limits the attempt to one source, and None (local only) skips remote vendor evidence.
Adjust Provider timeout only when provider calls are slow or blocked. The setting is bounded from 500 to 15000 ms.
Enable Proxy fallback only when a direct provider route fails and you are willing to try the alternate transport shown in Provider Evidence.
Set Identity action sensitivity to Strict before asset, security, or access-control action. Keep Balanced for routine triage, or use Relaxed only when weak identity warnings should not dominate the follow-up list.

Interpreting Results:

Start with fields derived directly from the submitted bytes: Format, Canonical, Address Class, Admin Class, First Octet (Binary), I/G Bit, U/L Bit, Special Use, and Randomization Likelihood. These fields remain useful even when no vendor provider returns a match.

MAC lookup result patterns and interpretation
Result pattern	Supported reading	Follow-up check
Unicast, Universally administered (UAA), and a vendor match	The address looks like a normal individual value with provider-backed assignment evidence.	Open Provider Evidence and confirm the provider, status, HTTP result, latency, and message before using the name in inventory.
Unicast and Locally administered (LAA)	The address may be private, randomized, virtual, or manually assigned.	Compare repeat sightings and local controller records before treating it as a stable device key.
Multicast, Broadcast, All-zero, or a populated Special Use field	The value probably represents a group, protocol mapping, virtual router, bridge-control address, or placeholder.	Follow the protocol context rather than assigning the address to one endpoint.
No vendor match, warning provider rows, or failed provider routes	The address can still be structurally valid when remote attribution is unavailable.	Retry later, switch provider route, raise the timeout, or compare against a trusted local registry.

Vendor Details combines structural fields with provider-derived fields such as Vendor, Organization, Country, Block Type, Block Start, and Block End when a provider returns them. Empty provider fields do not make the address invalid.

Provider Evidence is the audit trail for remote attribution. A passed row with a vendor is stronger than a warning row, and a proxy-mediated row should be treated differently from a direct provider response when repeatability matters.

Identity Actions ranks the practical next checks. Its guidance changes when randomization, special-use space, provider failures, or strict sensitivity make identity assumptions risky.

Technical Details:

EUI-48 contains six octets and EUI-64 contains eight. After separators are removed, valid input must contain 12 or 16 hexadecimal digits. The normalized bytes can then be displayed as colon form, dashed form, dotted form, compact hex, OUI fields, a 36-bit prefix view, and a byte count.

The first octet controls the two most important structural flags. Bit 0 is the I/G bit, where 0 means individual and 1 means group. Bit 1 is the U/L bit, where 0 means universally administered and 1 means locally administered. Because both are low-order bits, they are read from the right side of the first-octet binary display.

Rule Core:

MAC address structural rules
Rule	Displayed outcome	Technical reading
First octet bit 0 equals `0`	Address Class: Unicast	The value is shaped for one interface rather than a group address.
First octet bit 0 equals `1`	Address Class: Multicast	The value represents group traffic unless a more specific special-use rule applies.
First octet bit 1 equals `0`	Admin Class: Universally administered (UAA)	The prefix is more likely to align with globally assigned registry data.
First octet bit 1 equals `1`	Admin Class: Locally administered (LAA)	The value may be private, randomized, virtual, or assigned by a local administrator.
`FF:FF:FF:FF:FF:FF`	Address Class: Broadcast	The value is the layer-2 broadcast address, not a vendor-attributable endpoint.
All bytes are zero	Address Class: All-zero	The value is placeholder or unspecified space rather than a hardware identifier.

Lookup Core:

Structural parsing is local and deterministic. Provider evidence is a separate step that can succeed, warn, fail, time out, or be disabled. In Auto mode, the first usable vendor result becomes the main attribution, while each attempt remains visible in the evidence table.

MAC lookup evidence sources and limits
Evidence field	How it is derived	Limit
OUI (24-bit) and OUI (Hex)	The first three octets of the normalized address.	Useful for broad assignment lookup, but local addresses and smaller registry blocks can weaken assumptions.
Prefix (36-bit)	The first nine hexadecimal digits, formatted as a longer prefix view.	Helpful for OUI-36 style comparison, but provider block fields are stronger when returned.
Local OUI Hint	A small built-in set of common virtualization and documentation prefixes.	Useful for fast triage, not a complete vendor registry.
Vendor, Organization, and Block Type	The selected public lookup provider when a match is returned.	Subject to provider coverage, freshness, rate limits, private listings, and transport failures.

Special-Use Checks:

Several ranges are recognized before a normal endpoint interpretation is trusted. A special-use match should shift the investigation toward protocol behavior, virtual router use, multicast membership, or placeholder handling.

Recognized MAC special-use patterns
Pattern	Typical reading
`33:33:xx:xx:xx:xx`	IPv6 multicast mapping prefix.
`01:00:5E:xx:xx:xx`	IPv4 multicast mapping prefix.
`01:80:C2:xx:xx:xx`	IEEE 802 bridge-control group address range.
`00:00:5E:00:01:xx` or `00:00:5E:00:02:xx`	VRRP virtual router address range.
`00:00:0C:07:AC:xx`	HSRP virtual router address range.

Transformation Core:

IPv6 derived values are calculated from the bytes, not discovered from the network. For EUI-48 input, Modified EUI-64 flips the U/L bit in the first octet, inserts FF:FE between the first three and last three bytes, groups the eight bytes into four hexadecimal words, and places that identifier under fe80:: for a link-local candidate.

Example EUI-48 to Modified EUI-64 transformation
Stage	Value	Reading
Input	`44:38:39:FF:EF:57`	Six-byte EUI-48 value.
First octet after U/L flip	`46`	`44` XOR `02` changes the universal/local bit.
Modified EUI-64	`46:38:39:FF:FE:FF:EF:57`	`FF:FE` is inserted before the last three bytes.
SLAAC IID	`4638:39ff:feff:ef57`	The eight bytes are grouped as an IPv6 interface identifier.
Link-local Candidate	`fe80::4638:39ff:feff:ef57`	A deterministic candidate, not proof that a host is using that IPv6 address.

Reverse derivation from EUI-64 back to EUI-48 is meaningful only when bytes four and five are FF:FE. Without that middle pattern, the bytes may still be a valid EUI-64, but there is no safe recovered six-byte MAC value.

Privacy Notes:

A MAC address can become sensitive when it is tied to a person, location, customer network, device inventory, or movement history. Pick the provider route with that context in mind.

Provider route set to None (local only) keeps the lookup to structural parsing, formatting, bit flags, special-use checks, local hints, and IPv6 derived values.
Remote provider routes may send the normalized address to the selected public lookup provider and any enabled fallback transport needed to retrieve evidence.
Provider Evidence shows the provider, transport, status, HTTP result, latency, and message for each attempt so attribution can be audited before use.

Worked Examples:

Normal vendor triage. Enter 44:38:39:ff:ef:57 with Provider route set to Auto. Vendor Details should show Canonical as 44:38:39:FF:EF:57, Format as EUI-48 / MAC-48, and Address Class as Unicast. Use Provider Evidence before copying any returned vendor into inventory.

Private or virtual address. Enter 02:11:22:33:44:55. The U/L bit is set, so Admin Class should read Locally administered (LAA) and Randomization Likelihood should read Likely randomized. Treat that as a caution signal, then compare local sightings before making an identity claim.

Multicast mapping. Enter 33:33:00:00:00:16. The group bit sets Address Class to Multicast, and Special Use should identify the IPv6 multicast mapping prefix. This points to protocol traffic, not one client device.

EUI-64 recovery case. Enter 46:38:39:FF:FE:FF:EF:57. Format should read EUI-64, SLAAC IID should show 4638:39ff:feff:ef57, and Derived EUI-48 should recover 44:38:39:FF:EF:57 because the expected FF:FE pattern is present.

Bad paste cleanup. Paste a ticket line with two addresses on separate lines. If the warning says extra lines were ignored, rerun each address separately. If validation says the address must contain 12 or 16 hexadecimal digits, remove labels, timestamps, interface names, and unrelated tokens until one identifier remains.

FAQ:

Can a MAC lookup prove the device vendor?

No. A vendor result identifies an assignment record or prefix match. It does not prove the exact product model, current owner, or authenticity of the address. Use local inventory and network evidence before acting.

Why does a locally administered address matter?

A locally administered address has the U/L bit set. That pattern is common with private Wi-Fi addressing, virtualization, lab networks, and manual assignments, so long-lived identity assumptions need extra evidence.

What happens when Provider route is set to None?

Remote vendor lookup is skipped. The result still includes normalized formats, OUI fields, first-octet flags, randomization notes, special-use hints, local OUI hints, and IPv6 derived values.

Why can provider evidence warn even when the address is valid?

A structurally valid address can fail remote attribution because of provider coverage, private listings, rate limits, network errors, timeouts, or no returned vendor match. The evidence row explains which part failed.

Why did the lookup reject my pasted value?

After separators and surrounding text are handled, the identifier must contain exactly 12 hexadecimal digits for EUI-48 or 16 hexadecimal digits for EUI-64. Keep one address and remove unrelated text before running the lookup again.

Glossary:

MAC address: A link-layer address used by a network interface on a local network segment.
EUI-48: A 48-bit identifier commonly shown as six octets and often called MAC-48.
EUI-64: A 64-bit extended identifier that can appear in protocol traces and IPv6-related contexts.
OUI: Organizationally Unique Identifier, commonly the 24-bit prefix used as the first vendor lookup clue.
I/G bit: The first-octet bit that distinguishes individual addresses from group addresses.
U/L bit: The first-octet bit that distinguishes universally administered space from locally administered space.
LAA: Locally administered address space, often used for private, randomized, virtual, or manually assigned values.
Modified EUI-64: The IPv6-style transformation that flips the U/L bit and inserts FF:FE into an EUI-48 value.

References:

Guidelines for Use of EUI, OUI, and CID, IEEE Standards Association.
IANA OUI Ethernet Numbers, IANA.
RFC 4291: IP Version 6 Addressing Architecture, IETF.
Use private Wi-Fi addresses on Apple devices, Apple Support.
API Documentation V2, MAC Address Lookup.
MAC Vendor Lookup Tool and API, MACVendors.com.