Enter any MAC address to validate the format, identify the device vendor from the OUI prefix, check unicast or multicast type, and convert between colon, dash, and dot notation instantly.
✓Verified: IEEE 802 MAC address standard & OUI registry — April 2026
📱 MAC Address Analyzer & OUI Lookup
Enter in any format: colon (00:1A:2B:3C:4D:5E), dash (00-1A-2B-3C-4D-5E), or dot (001A.2B3C.4D5E)Enter a valid 48-bit MAC address (12 hex digits in any format).
OUI / Vendor
—
⚠️ Disclaimer: OUI vendor data is based on major IEEE assignments. Not all OUIs are in this database. For a complete lookup, verify against the official IEEE OUI registry at standards.ieee.org/regauth/oui.
Was this calculator helpful?
✓ Thanks!
Sources & Methodology
✓MAC address structure and OUI identification follow IEEE 802 standard. OUI = first 24 bits of MAC. Bit analysis per IEEE 802.3: bit 0 of first octet = I/G flag (0=unicast, 1=multicast). Bit 1 of first octet = U/L flag (0=universal, 1=local).
The official IEEE registry of Organizationally Unique Identifiers. Every manufacturer purchasing a block of MAC addresses registers their OUI here. This is the authoritative source for MAC address vendor identification worldwide.
The foundational IEEE standard defining MAC address format, structure, the 48-bit addressing scheme, the I/G (Individual/Group) bit, and the U/L (Universal/Local) administration bit used in this calculator.
IETF RFC documenting how IEEE 802 MAC addresses are used in internet protocols, covering address format conventions, multicast ranges, and the relationship between MAC addressing and IP protocols.
MAC Address Guide: OUI, Format, Bits & Device Identification
Every device that connects to a network has a MAC address burned into its hardware. Understanding the structure of a MAC address lets you identify device manufacturers, detect anomalies on your network, troubleshoot Layer 2 connectivity issues, and understand how switches forward traffic. This guide covers every aspect of MAC addresses with worked examples, the OUI system, bit-level analysis, and practical network engineering applications.
MAC Address = OUI (24 bits) + NIC Specific (24 bits) = 48 bits totalBit 0 of Octet 1: I/G flag — 0 = Unicast, 1 = Multicast/BroadcastBit 1 of Octet 1: U/L flag — 0 = Universal (IEEE), 1 = Local (random/manual)OUI = first 3 octets = identifies the manufacturer
Example: 00:1A:2B:3C:4D:5E
First octet = 00 = 0000 0000 in binary
Bit 0 (I/G) = 0 → Unicast address (individual device)
Bit 1 (U/L) = 0 → Universally administered (real hardware address)
OUI = 00:1A:2B → identifies the manufacturer
MAC Address Format Comparison
The same 48-bit MAC address is written in three different notation formats depending on the operating system and network equipment. All are equivalent and represent identical addresses.
Format
Separator
Example
Used By
Colon notation
: colon
00:1A:2B:3C:4D:5E
Linux, macOS, Wireshark
Dash notation
- hyphen
00-1A-2B-3C-4D-5E
Windows ipconfig
Dot notation
. dot (groups of 4)
001A.2B3C.4D5E
Cisco IOS show commands
Common OUI Prefixes: Identify Devices at a Glance
Network engineers frequently identify device types and manufacturers directly from the OUI prefix. Memorizing common OUI blocks speeds up network troubleshooting significantly.
OUI Prefix
Vendor
Common Device Type
00:17:F2
Apple
MacBooks, iPhones
00:50:F2
Microsoft
Windows network adapters
00:00:0C
Cisco
Routers, switches
00:12:FB
Samsung
Android phones, smart TVs
00:50:56
VMware
Virtual machine adapters
52:54:00
QEMU/KVM
Virtual machines (local)
00:1A:11
Google
Nest, Chromecast, WiFi
DC:A6:32
Raspberry Pi
Pi 4 on-board WiFi
The I/G and U/L Bits: Reading MAC Address Flags
The first octet of a MAC address contains two critical flag bits that classify the address type. The least significant bit (bit 0) is the Individual/Group flag. When this bit is 0, the address is a unicast address identifying a single device. When it is 1, the address is a multicast or broadcast address. The broadcast address FF:FF:FF:FF:FF:FF has all bits set to 1. The second least significant bit (bit 1) is the Universal/Local flag. When 0, the address is universally administered by the IEEE through the OUI system. When 1, the address is locally administered, meaning it was manually configured, randomly generated by software, or assigned by a hypervisor for virtual machines.
💡 Detecting virtual machine adapters: MAC addresses with the U/L bit set (locally administered) are commonly used by hypervisors (VMware uses 00:50:56, QEMU uses 52:54:00, VirtualBox uses 08:00:27). If you see locally administered addresses on your network that you cannot identify, they are likely from VMs or randomized mobile device addresses. MAC randomization on iOS and Android also sets the U/L bit to 1.
MAC Address Tables, ARP, and Layer 2 Forwarding
MAC addresses are the foundation of Layer 2 network operation. When a frame arrives at a switch, the switch records the source MAC address and the port it arrived on in its MAC address table (also called CAM table). When a frame needs to be forwarded, the switch looks up the destination MAC in the table and sends it only to the correct port instead of flooding to all ports. This is what makes switched Ethernet vastly more efficient than legacy hub-based networks. The ARP protocol maps IP addresses to MAC addresses so that Layer 3 devices can build frames. The command arp -a on Windows and Linux shows the current ARP cache mapping IP addresses to MAC addresses of devices on the local network.
Frequently Asked Questions
A MAC (Media Access Control) address is a unique 48-bit hardware identifier assigned to every network interface card by the manufacturer. It is expressed as 12 hexadecimal digits. MAC addresses operate at Layer 2 of the OSI model and are used for local network communication. Unlike IP addresses, MAC addresses are burned into hardware, though they can be spoofed in software.
An OUI (Organizationally Unique Identifier) is the first 24 bits (3 octets) of a MAC address, assigned by the IEEE to identify the manufacturer. For example, a MAC starting with 00:50:F2 belongs to Microsoft. OUI lookup is how network tools identify what type of device is on the network without physical access. The IEEE maintains the full OUI registry publicly.
Windows: Command Prompt, type ipconfig /all, look for Physical Address. macOS: System Settings, Network, select connection, Details, Hardware Address. Linux: ip link show or ifconfig. Android: Settings, About Phone, Status, WiFi MAC Address. iOS: Settings, General, About, WiFi Address. Note that devices with MAC randomization show a different address each time they connect to a new network.
The least significant bit of the first octet determines type: 0 = unicast (single device), 1 = multicast/broadcast (group). Broadcast FF:FF:FF:FF:FF:FF is received by all devices. IPv6 multicast uses addresses starting with 33:33. The unicast/multicast distinction determines how switches handle forwarding: unicast frames go to one port, multicast frames may go to multiple ports.
Bit 1 of the first octet is the U/L flag. 0 = universally administered (manufacturer assigned via IEEE OUI system). 1 = locally administered (manually set or randomly generated). Virtual machine adapters, VPN interfaces, and smartphones with MAC randomization use locally administered addresses. You can spot them because the second bit of the first hex digit is set (values 2, 6, A, E in the second nibble).
Colon notation (Linux/macOS): 00:1A:2B:3C:4D:5E. Dash notation (Windows): 00-1A-2B-3C-4D-5E. Dot notation (Cisco): 001A.2B3C.4D5E. All three represent the same 48-bit address. This calculator accepts all three formats and converts between them automatically.
Modern smartphones generate a random locally administered MAC for each Wi-Fi network to prevent location tracking across different networks. The U/L bit is set to 1 to indicate a locally administered address. iOS started MAC randomization in iOS 14, Android in Android 10. You can identify randomized addresses because the U/L bit is set, and the OUI prefix will not match any real manufacturer.
A burned-in address (BIA) is the MAC address programmed into a NIC by the manufacturer at the factory and stored in read-only memory. It is universally administered: the OUI is assigned by IEEE to the manufacturer, and the remaining 24 bits are assigned sequentially. Each BIA should be globally unique. On Cisco routers, the command show interfaces shows the BIA alongside the current active MAC address.
Yes, the OUI prefix identifies the manufacturer, which often implies the device type. Apple OUIs indicate iPhones or Macs. Cisco OUIs indicate routers or switches. VMware OUIs indicate virtual machines. Network management tools use OUI lookup for automatic device classification and inventory. For security monitoring, unexpected OUIs can indicate rogue devices or network intrusions.
MAC spoofing changes a device's MAC address in software to impersonate another device or bypass MAC-based access controls. On Linux: ip link set eth0 address XX:XX:XX:XX:XX:XX. On Windows: Device Manager, Network Adapter, Advanced, Network Address. Networks relying only on MAC filtering for security should use 802.1X port authentication instead, as it provides cryptographic proof of identity that MAC spoofing cannot defeat.
Run arp -a (Windows/Linux) to see the ARP table mapping IP addresses to MAC addresses on the local subnet. On the router admin panel, check the DHCP client list which shows MAC addresses alongside assigned IPs and hostnames. Use nmap with sudo nmap -sn [network]/24 to scan and display MAC addresses. On a managed switch, check the MAC address table with show mac address-table (Cisco) to find which port a device is connected to.
The CAM (Content Addressable Memory) table maps MAC addresses to switch ports. When a frame arrives, the switch records source MAC and port. When forwarding, the switch looks up destination MAC and sends to that port only. The CAM table has limited capacity. A MAC flooding attack fills the table by sending frames with thousands of spoofed source MACs, forcing the switch to flood all traffic to all ports like a hub, enabling packet capture. Port security mitigates this by limiting MAC addresses per port.
IEEE assigns three MAC address block sizes. MA-L (formerly OUI): 24-bit prefix, 16.7 million addresses, used by large manufacturers. MA-M (Medium): 28-bit prefix, 1 million addresses, for smaller manufacturers. MA-S (formerly OUI-36, Small): 36-bit prefix, 4,096 addresses, for companies needing few addresses. All three appear as standard MAC addresses in use; only the IEEE registry reveals which block type was assigned.