MAC address lookup
Turn any MAC address or OUI prefix into the hardware vendor behind it, straight from the IEEE registry.
Look up a MAC address vendor
Looking up vendor...
1st Octet Binary Dissection
- U/L Bit (Bit 1): 0 (Universally Administered / IEEE Registered)
- I/G Bit (Bit 0): 0 (Unicast / Individual Device)
Address Format Variations
00:18:0A:45:67:8900-18-0A-45-67-890018.0a45.678900180A456789WiFi Network & Enterprise Policy Impact: Factory MAC Detected
This device is presenting a factory-assigned Universal MAC address. Network access control (NAC) systems and DHCP servers can reliably identify the vendor hardware profile and bind persistent IP reservations or security policies.
What the OUI tells you
The first three octets of a MAC address form the Organisationally Unique Identifier (OUI), assigned by the IEEE to the hardware manufacturer. Looking it up identifies anonymous devices in your DHCP tables, flags rogue hardware, and clarifies network inventory during troubleshooting.
Good to know
- Modern smartphones and laptops use randomized private MAC addresses, which have no registered vendor in the IEEE registry.
- The locally-administered bit (the second least significant bit of the first octet) identifies whether an address is private or factory-assigned.
- Accepts full MAC addresses or 6-hex OUI prefixes with colon, hyphen, Cisco dot, or no separators.
IEEE MAC address architecture: EUI-48 and OUI breakdown
A Media Access Control (MAC) address is a 48-bit identifier (EUI-48) assigned to network interface controllers (NICs) for data link layer communication (Layer 2 in the OSI model). The address is split into two equal 24-bit segments:
1. OUI Prefix (24 bits / 3 octets)
The Organisationally Unique Identifier is assigned by the IEEE Registration Authority to a hardware vendor. It guarantees global uniqueness across physical manufacturers.
2. NIC Identifier (24 bits / 3 octets)
The Extension Identifier is assigned sequentially by the hardware manufacturer to each manufactured physical network adapter, providing 16,777,216 distinct addresses per OUI block.
Enterprise WiFi and networking hardware OUI reference
Enterprise network administrators frequently audit connected client lists and wireless controllers to identify access points, switches, and client hardware. Here are standard IEEE OUI prefixes for major enterprise infrastructure vendors:
| Manufacturer | Common OUI Prefixes | Device Category |
|---|---|---|
| Cisco Systems | 00:00:0C / 00:01:42 / 00:1E:F7 | Enterprise Routing & Switching |
| Cisco Meraki | 00:18:0A / e0:cb:bc / 88:15:44 | Cloud Managed WiFi & APs |
| HPE Aruba Networking | 00:0B:86 / 24:DE:C6 / 94:B4:0F | Enterprise Access Points |
| CommScope Ruckus | 00:1D:2D / 58:B6:33 / C8:03:F5 | High-Density WiFi APs |
| Juniper Mist | 5C:5B:35 / D4:20:B0 / 84:D3:43 | AI-Driven Enterprise APs |
| Fortinet | 00:09:0F / 70:4C:A5 / 90:6C:AC | Security Gateways & FortiAP |
| Ubiquiti UniFi | 74:83:C2 / 78:8A:20 / AC:8B:A9 | Commercial & Pro WiFi |
| Apple Inc. | F0:18:98 / 3C:22:FB / BC:D1:D3 | iOS, iPadOS & macOS Clients |
| Samsung Electronics | 00:12:47 / 34:14:5F / 98:0C:82 | Android & Smart Devices |
| Zebra Technologies | 00:04:F2 / 00:23:68 / 84:24:8D | Enterprise Handheld Scanners |
Private MAC address randomization and captive portal impact
Operating systems such as Apple iOS (Private Wi-Fi Address), Google Android (MAC Randomization), and Microsoft Windows generate synthetic MAC addresses to prevent third-party location tracking across distinct physical WiFi networks.
Randomized addresses always set the U/L (Universal/Local) bit to 1. In hexadecimal notation, this means the second character of the first octet is always 2, 6, A, or E (for example: 02:xx:xx, 06:xx:xx, 0A:xx:xx, or 0E:xx:xx).
Operational challenges for guest WiFi deployments:
- Captive Portal Re-Authentication: If a device rotates its MAC address upon reconnecting, legacy splash portals cannot recognize the returning session and force guests through redundant login forms.
- DHCP Pool Exhaustion: Each synthetic MAC claims a fresh IP lease from the DHCP server, exhausting available subnet scopes in high-traffic venues like shopping centres and transport hubs.
- Distorted Footfall Metrics: Hardware-level visitor counting registers 1 physical user as 4 to 5 unique visitors over time, invalidating commercial dwell time analytics.
How Purple reconciles randomized devices for visitor analytics
Purple eliminates captive portal friction and preserves venue analytics integrity by shifting authentication from volatile hardware MAC addresses to verified guest identities:
- Multi-Source Identity Correlation: Maps verified user logins (RADIUS 802.1X SecurePass, social credentials, SMS verification, or single sign-on) to secure session tokens.
- Passpoint & Hotspot 2.0 Roaming: Installs encrypted Passpoint profiles that connect visitors automatically without splash screen interruptions, irrespective of MAC rotation settings.
- 99.8% Analytics Accuracy: Unifies footfall, dwell time, and repeat visit metrics across venues without compromising end-user mobile privacy.
Frequently asked questions
What is a MAC address OUI and how does the IEEE assign it?
An Organisationally Unique Identifier (OUI) is a 24-bit number assigned by the IEEE Registration Authority to hardware manufacturers. It forms the first three octets (24 bits) of a 48-bit MAC address (EUI-48), identifying the manufacturer such as Cisco, Apple, or Intel.
How do you detect whether a MAC address is randomized or factory-assigned?
Look at the second least significant bit of the first octet (the U/L bit). If this bit is 1, the address is Locally Administered (LAA), meaning it was randomly generated by iOS, Android, or Windows. In hexadecimal, if the second character of the first octet is 2, 6, A, or E (e.g. x2:xx:xx, x6:xx:xx, xA:xx:xx, xE:xx:xx), the MAC is randomized.
What is the difference between unicast and multicast MAC addresses?
The least significant bit of the first octet (the I/G bit) determines whether the frame targets an individual station (0 = Unicast) or a group of stations (1 = Multicast or Broadcast). Standard client devices use Unicast addresses, whereas protocols like mDNS and streaming video use Multicast addresses starting with 01:00:5E.
How does MAC address randomization impact guest WiFi and captive portals?
Because mobile devices rotate randomized MAC addresses per SSID or periodically, legacy captive portals that track visitors solely by MAC address will treat returning visitors as new devices, prompting repeated logins and creating duplicate visitor records that inflate footfall metrics.
How does Purple reconcile randomized MAC addresses for venue analytics?
Purple links guest sessions to verified identities (such as email, SMS verification, social login, or Passpoint 802.1X profiles) rather than relying on hardware MAC addresses. This correlates visits across rotated MAC addresses, delivering 99.8% analytics accuracy without requiring visitors to disable private addresses.
MAC randomization skewing your counts?
Address rotation on iOS and Android can inflate raw footfall metrics. Purple reconciles guest signals through multi-source correlation, restoring analytics integrity.
Book a 20-min demoNetforge Network Multi-Tool
Run offline network health checks, path analysis, and latency diagnostic scans directly from your desktop.
Download Multi-Tool