MAC Address Tool

MAC NETWORKING OUI
Share:
By Checked against sources by , Founder & Architect, RECATOOLS Published Updated Last reviewed

Generate random MAC addresses (locally administered by default), or read any MAC: its flag bits and, where a 24-bit lookup can tell, the holder of its block.

RT-DEV-070 · Developer Tools
Your browser is too old for this tool’s interactive features. Please update to Safari 13.1, Chrome or Edge 80, Firefox 74 or newer.

MAC Address Tool

The built-in table names the holders of 155 MA-L prefixes (53 organisations, among them Apple, Samsung, Cisco, Intel, Dell and HP), each checked against the IEEE listing of 12 Oct 2026, which had 40,319 MA-L rows that day. It also knows the 438 prefixes the IEEE holds as containers for smaller MA-M, MA-S and IAB blocks: for those it says how many bits name the holder instead of guessing. A prefix outside the table is reported as not in the table, which says nothing about whether it is assigned. A locally administered address has no registered maker, and the tool says so.

📅 Research current as of 12 Oct 2026 · Sources: IEEE Registration Authority MA-L, MA-M, MA-S, IAB and CID listings (12 Oct 2026); IEEE Guidelines for Use of EUI, OUI and CID
Standards, published formulas, and reference data are revised over time — check against a current authoritative source before relying on these figures.
Advertisement
After results · AD-W1 Responsive · Post-tool — peak engagement

How to use the MAC address tool

Pick Generate or Lookup

Generate creates random MACs for testing, lab environments, or virtual machine MAC pools. Lookup reads the two flag bits of an address and, for a factory-style address, which organisation holds its block.

Generate: choose format and quantity

Output format covers colon-separated (Linux/Unix style), dash-separated (Windows), Cisco dotted-quad, or no separator. Quantity 1–500. Toggle locally-administered (recommended for test) and unicast/multicast.

Optionally fix a prefix

A prefix of 6, 7 or 9 hex digits (the IEEE's 24-, 28- and 36-bit block sizes) is kept and the rest randomised. The prefix carries its own flag bits, so it has to agree with the boxes: with Locally administered ticked, a vendor's prefix is refused, because addresses inside a block the IEEE assigned to a company could duplicate real devices. Use a local prefix such as 02:AB:CD for a test pool, or untick the box to generate inside a vendor's block on purpose; the tool then says whose block it is.

Lookup: paste any MAC

The Lookup tab accepts colon, dash, space and Cisco-dot forms, with or without leading zeros (macOS arp prints a:b:c:…). It reports unicast or multicast, universal or local, and then what the registry can and cannot say: a block holder from the built-in table, an IEEE container that only 28 or 36 bits can resolve, no registered maker for a local address, or the broadcast and all-zeros values for what they are.

Advertisement
After how-to · AD-W2 Responsive

MAC addresses — the 48-bit identifier built into every network card

A MAC address (Media Access Control address) is a 48-bit identifier assigned to an Ethernet, Wi-Fi or Bluetooth interface, normally set by its manufacturer. It is written as six pairs of hex digits (e.g. 00:0A:27:23:45:67). In a universally administered address the leading bits identify a block the IEEE Registration Authority assigned to an organisation, the first 24 bits (the OUI) for the largest blocks, and the organisation chooses the rest. Each value is meant to be used once. The IEEE itself says it "makes a concerted effort to avoid duplicate assignments but does not guarantee that duplicate assignments have not occurred" (IEEE RA guidelines).

OUI registration — how vendors get their prefix

Companies that build network hardware register OUIs with the IEEE. The IEEE assigns blocks in three sizes: an MA-L (which includes a 24-bit OUI) gives 224 — about 16.7 million — EUI-48 values, an MA-M 220 (about a million) and an MA-S 212 (4,096). First-time customers cannot buy an MA-L; they start with an MA-M, an MA-S or a company ID, and a repeat customer must certify it has used 95% of its current block before getting another (IEEE, Guidelines for Use of EUI, OUI and CID). The public IEEE MA-L listing had 40,319 rows on 12 Oct 2026. By registered name, Apple holds 1,573 of them, Huawei Technologies 1,416 and Cisco Systems 1,257; Huawei's two main registered entities together hold 2,086.

Why the first three bytes often cannot name the holder

Not every block is an MA-L. On 12 Oct 2026, 438 of the MA-L rows were held by "IEEE Registration Authority" itself, as containers for other organisations' smaller blocks: the MA-M listing (28-bit, 6,628 blocks), the MA-S listing (36-bit, 7,226) and the closed IAB listing (36-bit, 4,575) sit inside them, apart from 128 MA-M blocks filed under nine prefixes that are not in the MA-L listing at all. So 18,429 of the 58,310 organisations' blocks in those four listings, 31.6%, share their first three bytes with other holders or with no MA-L row at all, so a three-byte lookup can name only the IEEE, or nobody. Being small, those blocks hold about 1% of the addresses the IEEE has assigned: the share of blocks is not a share of devices, and nothing here measures how many devices that is. The prefix 00:50:C2 is one of these containers: the IEEE says it held IAB assignments between 2007 and September 2012, after which 40:D8:55 was used (IEEE RA FAQ). The tool above carries the container prefixes, so for those addresses it tells you how many bits name the holder; it does not carry the smaller listings themselves.

The two flag bits — universal versus local, unicast versus multicast

The first byte of every MAC carries two flag bits with significant operational meaning. Bit 0 (LSB) distinguishes unicast (sent to one specific device) from multicast (sent to a group); when set, the MAC is multicast. Bit 1 distinguishes universally administered (the address comes from a block the IEEE assigned) from locally administered (set by an OS, hypervisor or administrator); when set, the MAC is locally administered. For test labs and virtual machines, setting the local bit keeps generated addresses out of the blocks the IEEE assigns to companies, with one historical exception: the IEEE says "approximately 18" identifiers given to early Ethernet makers before 1985 have that bit set, and the listing of 12 Oct 2026 has exactly 18 (among them 3Com's 02:60:8C and Digital Equipment's AA:00:00–AA:00:04). The generator never draws from those. Local does not mean unique: the IEEE says "Local addresses are not globally unique, and a network administrator is responsible for assuring that any local addresses assigned are unique within the span of use." The tool above defaults to locally administered for test addresses, and refuses a vendor prefix while that box is ticked.

Two whole-address values are special. FF:FF:FF:FF:FF:FF is, in the IEEE's words, the multicast (group) address "indicating all stations on a network", the broadcast address, and is not a valid EUI; it is also the value the IEEE recommends as the null, the default for an unknown EUI-48. 00:00:00:00:00:00 falls in Xerox's block, but "though assigned to an organization, have not been and will not be used by that assignee as an EUI", and values like it "shall not be used as identifiers". Within the local space, the optional IEEE 802c scheme divides addresses into four quadrants by two more bits (RFC 8948); the Lookup tab names the quadrant, which only means something on a network that uses the scheme.

Private Wi-Fi addresses — what phones show networks now

Modern phones and many laptops no longer show Wi-Fi networks their hardware MAC address. From Android 10 the framework uses a randomised MAC by default, set "by setting the locally administered bit to 1, and the unicast bit to 0", with the other 46 bits random (Android Open Source Project); Apple's private Wi-Fi address requires iOS 14 or later, and Apple says that by default a device uses "a different MAC address for each Wi-Fi network" (Apple Support; Apple's page does not say how the address is formed). The rules differ. Since iOS 18 an Apple device keeps a Fixed private address on WPA2-or-stronger networks and a Rotating one, changed every 2 weeks, on weak or open ones. Android's default is a persistent random address per network that stays the same until a factory reset. From Android 12 a non-persistent mode exists, but only for networks a network-suggestion app requests it for, or open networks without a captive portal when a device setting that is off by default is on; even then the address is re-randomised only when the DHCP lease has expired and more than 4 hours have passed, or when it is more than 24 hours old. A second hex digit of 2, 6, A or E means a unicast address with the local bit set: one set by software rather than drawn from a maker's block, such as Android's private Wi-Fi addresses, a virtual machine's address or one an administrator chose. No registry can name a maker for it. A changing address is not anonymity on its own: RFC 9724 reports that other identifiers, such as the DHCP client identifier, "can be correlated".

MAC versus IP — what each one actually identifies

The classic exam-question distinction: a MAC address identifies a network interface (Layer 2 of the OSI model); an IP address identifies a host on a network (Layer 3). MACs are used for delivery within a single broadcast domain (your local switch, your home Wi-Fi); IPs are used for routing across networks. Every packet has both. The source and destination MAC are rewritten at every hop, while routers normally forward the IP addresses unchanged, unless one of them performs network address translation, which maps IP addresses "from one group to another" (RFC 3022). This is why ARP (Address Resolution Protocol) exists: to map a destination IP within your subnet to the corresponding MAC for the next-hop delivery. Most users will never see a MAC address consciously, but every byte of internet traffic depends on the layered MAC/IP cooperation working correctly.

The registry lists 00:00:00 as Xerox, yet the all-zeros address will never be used

01

An IEEE MA-L block gives its holder 224 ≈ 16.7 million EUI-48 values; a first-time customer cannot buy one and starts with a smaller MA-M or MA-S.

02

The IEEE's public MA-L listing had 40,319 rows on 12 Oct 2026, and 438 of them were held by the IEEE itself as containers for smaller blocks.

03

By registered name, Apple holds the most MA-L prefixes, 1,573, ahead of Huawei Technologies (1,416) and Cisco Systems (1,257), counted on 12 Oct 2026. Huawei's two main registered entities together hold 2,086.

04

The "locally administered" bit (second from the bottom of the first byte) separates an address set by software, such as an Android private Wi-Fi address or a virtual machine's, from one drawn from a maker's block. Any unicast first byte whose second hex digit is 2, 6, A or E (02, 1A, DE) has it set.

05

Since iOS 18, an Apple device chooses a Rotating private address — replaced every two weeks — by default when it joins an open or weakly secured network.

06

EUI-64 extends the identifier to 64 bits. RFC 4291 builds an IPv6 interface ID from a MAC by inserting FF:FE in the middle and inverting the universal/local bit.

07

Cisco devices traditionally display MACs in dotted-quad format (aaaa.bbbb.cccc) — purely a vendor convention, not a different MAC standard.

08

QEMU's source code (net/net.c) starts a virtual network card left without an address at 52:54:00:12:34. That prefix is in no IEEE listing; its second hex digit is 2, so it sits in the locally administered space.

09

The registry lists 00:00:00 as Xerox Corporation, yet the IEEE says the all-zeros address "will not be used by that assignee as an EUI".

10

Spoofing a MAC address is trivially easy on every major OS (ip link set dev eth0 address ... on Linux). Which is why a MAC allow-list is a weak control on its own; 802.1X authenticates the device or user instead.

Frequently asked questions

A MAC identifies a network interface card (Layer 2 of OSI). An IP identifies a host on a network (Layer 3). MACs are used inside a single broadcast domain; IPs are used for routing between networks. Both exist on every packet. The MAC addresses are rewritten at each hop; routers normally leave the IP addresses alone, though a router doing network address translation (RFC 3022) rewrites them.
Modern phones use a private address for each Wi-Fi network by default: Android 10 and later randomise it, and Apple's private Wi-Fi address requires iOS 14 or later. Since iOS 18 Apple rotates it every two weeks on open or weakly secured networks and keeps it fixed on WPA2-or-stronger ones. Android's default keeps one random address per network until a factory reset; from Android 12 a non-persistent mode applies only to networks an app requests it for, or to open networks when a device setting that is off by default is on, and even then the address changes only after the DHCP lease has expired plus 4 hours, or once it is 24 hours old. Apple and Android both let you change the setting per network.
Mostly no, at the network layer. A spoofed MAC looks identical to a real one, which is why a MAC allow-list on its own is a weak control; certificate-based 802.1X authenticates the device or user instead.
The second-lowest bit of the first byte. When set, the MAC is locally administered (set by software, an OS or an administrator). When clear, it is universally administered: the address comes from a block the IEEE assigned to an organisation. Setting it keeps you out of the blocks the IEEE assigns today, apart from 18 pre-1985 blocks that carry the bit, but it does not make an address unique: the IEEE says local addresses "are not globally unique", and keeping them unique within your network is your job.
They should not: the IEEE assigns each block to one organisation, and the organisation is responsible for using each value once. The IEEE also says it "does not guarantee that duplicate assignments have not occurred", and locally administered addresses are unique only if whoever sets them makes them so. Within a single broadcast domain, duplicate MACs cause connectivity problems.
A 64-bit identifier from the same IEEE family. IPv6 originally built the interface part of an address from the 48-bit MAC by inserting FF:FE in the middle and inverting the U/L bit (RFC 4291). RFC 8064 (2017) recommends against embedding a stable link-layer address in IPv6 interface identifiers and points to RFC 7217's stable, opaque identifiers instead; RFC 8981, which obsoletes RFC 4941, defines temporary addresses.
No. At most a universally administered address names the organisation that holds its block, which is not always the maker, and for nearly a third of blocks (small ones, together about 1% of assigned addresses) the first three bytes cannot even do that. A locally administered address, such as a phone's private Wi-Fi address, names no one. This tool reads bits and a built-in table; it cannot trace or locate anything.
2^48 = 281,474,976,710,656 — about 281 trillion. The IEEE rations it: first-time customers cannot buy a full MA-L, and repeat customers must show 95% use of their current block before getting another.
The IEEE listing names Xerox as the holder of 00:00:00. If the whole address is 00:00:00:00:00:00, it is the all-zeros value, which the IEEE says has not been and will not be used as an EUI, so it names no device, and the Lookup tab says so. Any other address in the block is reported with Xerox as the block holder, which is not proof of who made the device.
The IEEE publishes its MA-L, MA-M, MA-S and IAB listings as public downloads at standards-oui.ieee.org. This tool carries 155 MA-L prefixes from 53 organisations, checked against the 12 Oct 2026 listing (40,319 MA-L rows), plus the 438 container prefixes under which the IEEE assigns smaller blocks. A prefix outside the table is reported as not in the table; for a container it tells you whether 28 or 36 bits name the holder.
No. Both generation (random bytes from crypto.getRandomValues) and lookup (against the built-in tables) run entirely in your browser. No requests are sent. You can confirm via the browser network tab.

Method & sources

How it computes

Random bytes from crypto.getRandomValues. With no prefix the U/L and I/G bits follow the boxes (local unicast by default); draws in the 18 pre-1985 BlockIDs or a registered CID are redrawn. A 6, 7 or 9-digit prefix is kept whole and must agree with the boxes: a vendor prefix is refused while Locally administered is ticked. Lookup reads both flag bits, broadcast and all-zeros, 438 IEEE container prefixes and 155 MA-L holders (IEEE listings, 12 Oct 2026). A local address has no registered maker.

What this tool implements

  • IEEE RA guidelines: an MA-L gives 2²⁴ EUI-48 values, an MA-M 2²⁰ and an MA-S 2¹²; U/L = 1 marks a locally administered address — the page had given the MA-M 4,096 addresses and a USD 3,495 fee it could not source.
  • IEEE MA-L registry, 28 Sep 2026: 40,253 prefixes; Apple 1,573, Huawei Technologies 1,416, Cisco 1,253. About 50 of the tool's 176 built-in rows named the wrong vendor — 00:1A:11 is Google, not Apple — and 14 were unassigned; the table was rebuilt.
  • Apple and AOSP: private addresses are per network, and since iOS 18 rotate every 2 weeks only on weak or open networks — not "every 24 hours". RFC 4291 Appendix A: FF-FE inserted and the U/L bit inverted.
  • Corrected 2026-10-12: with "Locally administered" ticked, a vendor prefix was silently honoured, so the output were universal addresses inside a real vendor block (500 of 500 inside Apple's 00:0A:27). A prefix now has to agree with the ticked bits: a vendor prefix is refused while the box is ticked, and generating inside one (box unticked) carries a warning naming the block.
  • Special values per the IEEE guidelines: FF-FF-FF-FF-FF-FF is the multicast address "indicating all stations on a network" (broadcast), not a valid EUI, and the IEEE's recommended null value; 00-00-00-00-00-00, though in Xerox's block, "will not be used by that assignee as an EUI". Until 2026-10-12 they read as a local multicast and a Xerox unicast address.
  • A locally administered address is reported as having no registered maker, except the 18 pre-1985 BlockIDs with the U/L bit set (reported as registered) and registered CIDs (RFC 8948 ELI quadrant). Until 2026-10-12 it read "Unknown (not in built-in DB)". Local addresses are not called unique: the IEEE says they "are not globally unique".

Sources

Abridged — the full review record for this tool runs longer than the list above.

Advertisement
Pre-footer · AD-W3 728 × 90