MAC address whois
How this lookup works
Paste or type an Ethernet MAC address. The tool accepts every common notation you’ll see in a CLI or packet capture:
- Colons —
00:1A:2B:3C:4D:5E - Dashes —
00-1A-2B-3C-4D-5E - Cisco dot notation —
001A.2B3C.4D5E - No separators —
001A2B3C4D5E - Just the OUI fragment (6–11 hex chars) —
001A2B
It normalizes the input, looks up the prefix against the IEEE OUI registries, and returns the assigned vendor plus the MAC’s I/G and U/L flags.
What the registries cover
IEEE issues MAC prefixes in three sizes:
| Registry | Bits | Block size | Use |
|---|---|---|---|
| MA-L | 24 (OUI) | 2²⁴ = 16,777,216 addresses | Large vendors |
| MA-M | 28 | 2²⁰ = 1,048,576 addresses | Mid-sized vendors |
| MA-S | 36 (OUI-36) | 2¹² = 4,096 addresses | Small allocations |
The tool tries the longest prefix first (MA-S → MA-M → MA-L). Within a MA-M or MA-S block, multiple vendors can share the same first 3 octets, so the high nibble of the 4th octet matters.
I/G and U/L bits
The first byte’s low nibble carries two flags from IEEE 802:
- I/G bit (least-significant bit):
0= unicast,1= multicast.FF:FF:FF:FF:FF:FFis the limited broadcast. - U/L bit (second-least-significant bit):
0= globally administered (IEEE-assigned),1= locally administered.
So a first byte of 02, 06, 0A, or 0E (binary xx10xxxx) marks a locally administered address. Modern Android, iOS, and Windows clients use locally administered MACs when MAC randomization is enabled — they won’t appear in the IEEE registry.
Common confusions
02:00:00:00:00:00and similar single-byte-on patterns are valid MACs but usually picked manually for software interfaces (VPN, virtual switches, containers). No vendor.- Cisco’s three-dot format (
001A.2B3C.4D5E) groups in 4 hex chars, not 2 — easy to miscount when reading fromshow mac address-table. - A “vendor match” doesn’t guarantee the device is from that vendor: ODMs and reference designs use the same OUI across many brands (Realtek, MediaTek, Broadcom). Cross-reference with DHCP fingerprints or LLDP when you can.
What this tool does not do
No reverse lookup (“find every MAC owned by Cisco”). No live IEEE search — the registry is static, refreshed periodically. The math runs entirely in your browser; nothing is sent over the network.
Where the data comes from
IEEE publishes the MA-L, MA-M, and MA-S registries as CSVs at standards-oui.ieee.org. A scheduled job on this site converts the three into a compact JSON lookup table (~1.5 MiB total) and ships it alongside the tool. The refresh date is shown under the result.