Paste a MAC address to look up the vendor and manufacturer that registered it. The lookup reads the OUI — the first three bytes of the address — against the IEEE registry, so it works on any hardware address you can pull off a switch, an ARP table or a Wi-Fi scan.
A MAC address is 48 bits, written as six bytes. Those bytes split cleanly in half, and only the first half identifies the vendor.
The first three bytes are the Organizationally Unique Identifier (OUI), which the IEEE Registration Authority assigns to the company that made the network interface. The last three bytes are chosen by that company to make each interface it ships unique. A vendor lookup is therefore an OUI lookup: the tool takes the leading 24 bits and resolves them against the registry.
| Portion | Bits | Assigned by | Identifies |
|---|---|---|---|
| B8:27:EB | First 24 | IEEE Registration Authority | The vendor (OUI) |
| 12:34:56 | Last 24 | The vendor itself | The individual interface |
The same address gets written several ways depending on which vendor's tooling printed it. All of these are the same address, and the lookup accepts each one:
Most OUIs are unremarkable, but a handful come up constantly during triage — they tell you a host is a virtual machine or a single-board computer before you have logged into anything. These are stable, widely used assignments:
| OUI prefix | Registered to | What it usually means |
|---|---|---|
| 08:00:27 | Oracle VirtualBox | A VirtualBox guest NIC |
| 00:15:5D | Microsoft | A Hyper-V virtual machine |
| 00:50:56 | VMware | A vSphere/ESXi assigned address |
| 00:0C:29 | VMware | A VMware Workstation or ESXi guest |
| 52:54:00 | QEMU / KVM | A QEMU or libvirt guest |
| 00:16:3E | Xen | A Xen domU guest |
| B8:27:EB | Raspberry Pi Foundation | A Raspberry Pi 3 or earlier |
| DC:A6:32 | Raspberry Pi Trading | A Raspberry Pi 4 or Compute Module 4 |
A blank result is usually correct rather than a failure. Two bits in the very first byte of a MAC address change what the address means.
The second-least-significant bit of byte one is the U/L (universal/local) bit. When it is set to 1 the address is locally administered — invented by the device or an administrator rather than assigned by the IEEE — so there is no vendor to find. This is exactly what modern phones do: iOS and Android both randomise their Wi-Fi MAC address per network by default, specifically so that a lookup like this one cannot fingerprint the handset. That is a privacy feature working as designed.
The least-significant bit of byte one is the I/G bit, which marks an address as multicast rather than unicast. Broadcast (FF:FF:FF:FF:FF:FF) and multicast addresses are not hardware identifiers at all, so they will not resolve either. A genuinely unregistered OUI on real hardware is rare, but does happen with white-label and counterfeit network cards.
A MAC address identifies a network interface, not a person and not a place. The lookup returns the company that registered the address block — it cannot return an owner, a serial number, a geographic location or a phone number, because none of that is encoded in the address or held in the public registry.
MAC addresses are also link-local: they are rewritten at every routing hop, so a device's MAC address never reaches a server across the internet. Only equipment on the same network segment ever sees it.
A MAC address lookup resolves the first three bytes of a hardware address — the Organizationally Unique Identifier, or OUI — against the IEEE registry to find the vendor that manufactured the network interface. It answers 'who made this device?', not 'which device is this?'.
The Organizationally Unique Identifier is the 24-bit prefix of a MAC address that the IEEE Registration Authority assigns to a manufacturer. The manufacturer then assigns the remaining 24 bits itself, giving it roughly 16.7 million unique addresses per OUI block.
Because it is almost certainly a randomised address. iOS and Android generate a private, per-network Wi-Fi MAC address by default. Randomised addresses set the locally administered bit, which means they are deliberately outside the IEEE registry and have no vendor to look up.
No. A MAC address encodes only the vendor prefix and a vendor-assigned interface number. It carries no owner, location or subscriber information, and no public registry maps addresses to people. It is also stripped at every router, so it never travels beyond the local network segment.
Yes. Most operating systems allow the address to be overridden in software, a practice known as MAC spoofing. A spoofed address is usually locally administered, so it will not resolve to a vendor — and a spoofed address that copies a real OUI will resolve to that OUI's owner rather than to the actual hardware.
No. A MAC address is a fixed hardware identifier used within a single network segment at layer 2, while an IP address is a routable, reassignable address used to move packets between networks at layer 3. A device keeps its MAC address as it moves between networks but is issued a new IP address on each one.