MAC Address Lookup

about this tool

Type a MAC address in any notation and get three things: who the IEEE issued the prefix to, what the address itself says about how it was made, and the IPv6 interface identifier derived from it.

"Belongs to nobody" is four different answers

A large share of the addresses you will ever see were not issued by the IEEE. The second-lowest bit of the first octet says so, and most lookup sites stop there and report no vendor.

That is too blunt, because IEEE 802c divides local address space into four quadrants and only one of them is the anonymous case. The quadrant is set by two more bits in the same octet — which is exactly why the second hex character of a locally administered unicast address is always 2, 6, A or E. Those four digits are not a curiosity. They are the quadrants:

| 2nd digit | Quadrant | Who owns it | |---|---|---| | 2 | Administratively assigned | Nobody. This is the randomised case. | | 6 | Reserved | Undefined by IEEE 802c. | | A | Extended Local Identifier | A company — the first three bytes are a Company ID the IEEE assigns and publishes. | | E | Standard Assigned | An IEEE 802 protocol, not a manufacturer. |

So EA-27-01-… has an owner — ACCE Technology Corp. — and a tool that says "no vendor, and naming one would be guessing" is wrong about a quarter of the local space. All 219 Company IDs are loaded here.

The registry also holds eighteen historical local assignments from before the conventions settled, so AA-00-04 really is Digital Equipment Corporation and 02-60-8C really is 3COM. Both turn up constantly in old captures.

Since iOS 14 and Android 10 a phone invents a fresh administratively-assigned address for each network it joins, so a shop or an airport cannot follow it between them. Those are the 2 addresses, and for them "nobody" is the whole and correct answer.

One more trap: a group address has the same bit set without being locally administered in any meaningful sense. The broadcast address is FF-FF-FF-FF-FF-FF; it was defined by IEEE 802, not invented by somebody's software. What an address is outranks what one bit suggests.

Five registries, not one

The IEEE publishes five files and most tools read one.

| Block | Bits | Addresses | Notes | |---|---|---|---| | MA-L | 24 | 16,777,216 | the classic "OUI" | | MA-M | 28 | 1,048,576 | a sixteenth of one | | MA-S | 36 | 4,096 | for small runs | | IAB | 36 | 4,096 | retired for new issues, still live on hardware | | CID | 24 | — | for local addresses, not for hardware |

When the IEEE subdivides a 24-bit block it keeps its own name against the parent. 00-55-DA reads as IEEE Registration Authority — not a manufacturer, a note saying "ask a longer question". One digit in, 00-55-DA-0 is Shinko Technos and 00-55-DA-1 is KoolPOS.

00-50-C2 and 40-D8-55 are the same trap wearing a different hat: they are the Individual Address Block bases, holding about 4,500 assignments in a file published separately. Leave it out and those all answer "IEEE Registration Authority" too.

Everything is searched longest block first, and the placeholder is never presented as a company. Nor is Private, which is the IEEE's marker for a holder who paid to withhold their name — it is a fact about the record, not a company called Private.

A couple of the oldest blocks are genuinely ambiguous. 08-00-30 was issued to Network Research Corporation, the Royal Melbourne Institute of Technology and CERN, all at once. Every holder is listed; reading the file into a plain lookup table silently keeps whichever came last.

About 58,800 assignments, 1.7 MB, fetched from this site the first time you look something up and never with the page. It is rebuilt by scripts/fetch-oui.mjs, which writes the date and the per-file record counts into the file — and the tool refuses a copy whose counts do not add up, because a half-loaded registry reports real addresses as unassigned with complete confidence.

What a MAC address cannot tell you

It maps a prefix to the company that bought the block. That is all.

Not the model, not the owner, not the location. The bits below the assigned prefix belong to the manufacturer and are published nowhere — and how many bits that is depends on the block, so "the last three bytes" is only true for an MA-L holder. An MA-S holder gets twelve.

It mostly does not travel either: a router rewrites both addresses at every hop, so a remote server sees its own router's rather than yours. The exception matters, though, and it is the one below — a host using the old SLAAC scheme puts its MAC inside its IPv6 address, and that does travel.

Nor is it trustworthy. Changing it is straightforward on Linux, driver-dependent on Windows and unreliable on recent macOS, and nothing in the protocol verifies it. MAC filtering stops an accident, not an attacker.

Into an IPv6 address

RFC 4291 turns a 48-bit address into a 64-bit interface identifier by inserting FF-FE in the middle and inverting the universal/local bit. RFC 2464 §4 works the example: 34-56-78-9A-BC-DE becomes 36-56-78-FF-FE-9A-BC-DE, and the host's link-local address is fe80::3656:78ff:fe9a:bcde.

The inversion surprises everyone, and the usual explanation — that the bit means the opposite in an identifier — is not what the RFC says. Its stated motivation is ergonomic: so an administrator can hand-configure ::1 and ::2 rather than ::0200:0:0:1. RFC 7136 later settled it by declaring the bits in an interface identifier meaningless and the whole value opaque.

Paste a 64-bit identifier back and both readings are shown, because they differ: RFC 4291's modified form inverts the bit, the IEEE's own encapsulation does not. Picking one silently turns a universally administered address into a locally administered one. FF-FF in the middle is accepted as well as FF-FE — that is the older MAC-48 form.

This is only done for unicast addresses. An identifier built from a broadcast or multicast address is a well-formed IPv6 address that no host will ever configure, so it is not offered.

Most systems no longer do any of this. RFC 8064 recommends a stable random identifier instead, because an EUI-64 one carries the hardware address into every address the machine uses — the same tracking problem, one layer up, that MAC randomisation solves below. The IEEE has deprecated the underlying mapping outright.

Everything above happens in the page; the address you type is never sent anywhere. To resolve a name rather than identify a card, the DNS lookup asks this site instead of your browser, and to see the address your own connection arrives from, my IP reports what this site received.

questions

Why does it say the address belongs to nobody?

Because the locally administered bit is set and the address falls in the quadrant that really has no owner. IEEE 802c divides local address space into four, and only one of them — administratively assigned — is the randomised case. You can tell them apart by the second hex character of a unicast address: 2 is administratively assigned and belongs to nobody, A is an Extended Local Identifier built from a Company ID the IEEE publishes, E is assigned by an IEEE 802 protocol, and 6 is reserved. Most lookup sites treat all four as "no vendor", which is wrong for a quarter of the space.

Another site told me the vendor is "IEEE Registration Authority". What does that mean?

It means the site only checked the 24-bit registry. The IEEE subdivides blocks and keeps its own name against the parent, so 00-55-DA reads as IEEE Registration Authority while 00-55-DA-0 is Shinko Technos and 00-55-DA-1 is KoolPOS. The same is true of 00-50-C2 and 40-D8-55, which are the Individual Address Block bases and hold about 4,500 assignments in a separate file that most tools never load. All five registries are searched here, longest block first, and the placeholder is never shown as a manufacturer.

What are the two bits in the first octet?

The lowest bit is I/G: 0 means the frame is for one station, 1 means it is for a group. The next bit up is U/L: 0 means the IEEE issued the address and it is unique worldwide, 1 means it was assigned locally. They are the two least significant bits of the first byte, which is why they change the second hex character rather than the first. Note that a group address can have the U/L bit set without being "locally administered" in any useful sense — the broadcast address is the obvious example.

Can I find out who owns a device from its MAC address?

No. The registry maps a prefix to the company that bought the block, and nothing more — not the model, not the owner, not the location. The bits below the assigned prefix are the manufacturer’s to allocate and are published nowhere. How many bits that is depends on the block: an MA-L holder controls 24, an MA-S holder only 12. Anyone offering to locate a person from a MAC address is selling something that does not work.

Does a MAC address travel over the internet?

Not in the frames themselves — a router rewrites the source and destination at every hop, so a remote server sees its own router’s address rather than yours. There is one important exception: a host using the old SLAAC scheme embeds its MAC in its IPv6 address, and that address does travel. RFC 8064 changed the recommended default to a stable random identifier precisely for that reason.

Why does the first octet change when converting to EUI-64?

Because RFC 4291 inverts the universal/local bit on the way, so 34 becomes 36 and 02 becomes 00, and FF-FE is inserted in the middle to pad 48 bits out to 64. The reason given in the RFC is ergonomic rather than semantic: it lets an administrator hand-configure an identifier as ::1 or ::2 instead of ::0200:0:0:1. RFC 7136 later clarified that the bits in an interface identifier carry no meaning at all and the whole thing should be treated as opaque.

How current is the registry?

It is a snapshot taken on 22 September 2026 of all five IEEE files — MA-L, MA-M, MA-S, IAB and CID — about 58,800 assignments. It is rebuilt by scripts/fetch-oui.mjs, which writes the date and the record counts into the file itself, and the tool refuses to load a copy whose counts do not match. New blocks are issued continuously, so an address assigned after that date will not be found, and the tool says so rather than guessing.

Why do three companies share 08-00-30?

A couple of the oldest blocks really were issued more than once, before the registry was tidied up. 08-00-30 belongs to Network Research Corporation, the Royal Melbourne Institute of Technology and CERN simultaneously, and 00-01-C8 has two holders. Every holder is listed here — reading the file into a plain lookup table keeps whichever happened to be last and presents it as the answer.

Can a MAC address be changed?

On most systems, yes, and that is what the locally administered bit is for. Linux allows it outright; on Windows it depends on whether the network driver exposes the property, and many Wi-Fi drivers do not; on recent macOS it is unreliable. The address is only a label the card puts in the frame and nothing verifies it, which is why MAC filtering stops an accident rather than an attacker.