MAC address whois

Try:

OUI registry: IEEE.

How this lookup works

Paste or type an Ethernet MAC address. The tool accepts every common notation you’ll see in a CLI or packet capture:

  • Colons — 00:1A:2B:3C:4D:5E
  • Dashes — 00-1A-2B-3C-4D-5E
  • Cisco dot notation — 001A.2B3C.4D5E
  • No separators — 001A2B3C4D5E
  • Just the OUI fragment (6–11 hex chars) — 001A2B

It normalizes the input, looks up the prefix against the IEEE OUI registries, and returns the assigned vendor plus the MAC’s I/G and U/L flags.

What the registries cover

IEEE issues MAC prefixes in three sizes:

Registry Bits Block size Use
MA-L 24 (OUI) 2²⁴ = 16,777,216 addresses Large vendors
MA-M 28 2²⁰ = 1,048,576 addresses Mid-sized vendors
MA-S 36 (OUI-36) 2¹² = 4,096 addresses Small allocations

The tool tries the longest prefix first (MA-S → MA-M → MA-L). Within a MA-M or MA-S block, multiple vendors can share the same first 3 octets, so the high nibble of the 4th octet matters.

I/G and U/L bits

The first byte’s low nibble carries two flags from IEEE 802:

  • I/G bit (least-significant bit): 0 = unicast, 1 = multicast. FF:FF:FF:FF:FF:FF is the limited broadcast.
  • U/L bit (second-least-significant bit): 0 = globally administered (IEEE-assigned), 1 = locally administered.

So a first byte of 02, 06, 0A, or 0E (binary xx10xxxx) marks a locally administered address. Modern Android, iOS, and Windows clients use locally administered MACs when MAC randomization is enabled — they won’t appear in the IEEE registry.

Common confusions

  • 02:00:00:00:00:00 and similar single-byte-on patterns are valid MACs but usually picked manually for software interfaces (VPN, virtual switches, containers). No vendor.
  • Cisco’s three-dot format (001A.2B3C.4D5E) groups in 4 hex chars, not 2 — easy to miscount when reading from show mac address-table.
  • A “vendor match” doesn’t guarantee the device is from that vendor: ODMs and reference designs use the same OUI across many brands (Realtek, MediaTek, Broadcom). Cross-reference with DHCP fingerprints or LLDP when you can.

What this tool does not do

No reverse lookup (“find every MAC owned by Cisco”). No live IEEE search — the registry is static, refreshed periodically. The math runs entirely in your browser; nothing is sent over the network.

Where the data comes from

IEEE publishes the MA-L, MA-M, and MA-S registries as CSVs at standards-oui.ieee.org. A scheduled job on this site converts the three into a compact JSON lookup table (~1.5 MiB total) and ships it alongside the tool. The refresh date is shown under the result.