MAC地址查询
直接源自 IEEE 注册表，将任何 MAC 地址或 OUI 前缀转换为其背后的硬件厂商。
查询 MAC 地址厂商
Look up vendor to identify this OUI
First octet, bit by bit
- U/L Bit (Bit 1): 0 (Universally Administered / IEEE Registered)
- I/G Bit (Bit 0): 0 (Unicast / Individual Device)
Address format variations
00:18:0A:45:67:8900-18-0A-45-67-890018.0a45.678900180A456789WiFi network and enterprise policy impact: factory MAC detected
This device is presenting a factory-assigned Universal MAC address. Network access control (NAC) systems and DHCP servers can reliably identify the vendor hardware profile and bind persistent IP reservations or security policies.
Solve private MAC randomisation and captive portal re-login friction
iOS has randomised private addresses on by default since iOS 14 and Android since Android 10, so MAC-based visitor identification degrades on most modern handsets. Purple correlates sessions by authenticated identity instead - 802.1X SecurePass, social login or SMS verification - so a returning guest is recognised without a second sign-in.
OUI 能告诉您什么
MAC 地址的前三个字节构成了组织唯一标识符 (OUI)，由 IEEE 分配给硬件制造商。通过查询，可以识别 DHCP 表中的匿名设备、标记异常硬件，并在排障过程中理清网络资产。
值得了解
- 现代智能手机和笔记本电脑使用随机的私有 MAC 地址，这些地址在 IEEE 注册表中没有注册的厂商。
- 本地管理位（第一个字节的次低有效位）用于识别地址是私有的还是出厂分配的。
- 支持完整的 MAC 地址或 6 位十六进制的 OUI 前缀，可包含冒号、连字符、Cisco 点号或无分隔符。
IEEE MAC address architecture: EUI-48 and OUI breakdown
A Media Access Control (MAC) address is a 48-bit identifier (EUI-48) assigned to network interface controllers (NICs) for data link layer communication (Layer 2 in the OSI model). The address is split into two equal 24-bit segments:
1. OUI Prefix (24 bits / 3 octets)
The Organisationally Unique Identifier is assigned by the IEEE Registration Authority to a hardware vendor. It guarantees global uniqueness across physical manufacturers.
2. NIC Identifier (24 bits / 3 octets)
The Extension Identifier is assigned sequentially by the hardware manufacturer to each manufactured physical network adapter, providing 16,777,216 distinct addresses per OUI block.
Enterprise WiFi and networking hardware OUI reference
Enterprise network administrators frequently audit connected client lists and wireless controllers to identify access points, switches, and client hardware. Here are standard IEEE OUI prefixes for major enterprise infrastructure vendors:
| Manufacturer | Common OUI Prefixes | Device Category |
|---|---|---|
| Cisco Systems | 00:00:0C / 00:01:42 / 00:1E:F7 | Enterprise Routing & Switching |
| Cisco Meraki | 00:18:0A / e0:cb:bc / 88:15:44 | Cloud Managed WiFi & APs |
| HPE Aruba Networking | 00:0B:86 / 24:DE:C6 / 94:B4:0F | Enterprise Access Points |
| CommScope Ruckus | 00:1D:2D / 58:B6:33 / C8:03:F5 | High-Density WiFi APs |
| Juniper Mist | 5C:5B:35 / D4:20:B0 / 84:D3:43 | AI-Driven Enterprise APs |
| Fortinet | 00:09:0F / 70:4C:A5 / 90:6C:AC | Security Gateways & FortiAP |
| Ubiquiti UniFi | 74:83:C2 / 78:8A:20 / AC:8B:A9 | Commercial & Pro WiFi |
| Apple Inc. | F0:18:98 / 3C:22:FB / BC:D1:D3 | iOS, iPadOS & macOS Clients |
| Samsung Electronics | 00:12:47 / 34:14:5F / 98:0C:82 | Android & Smart Devices |
| Zebra Technologies | 00:04:F2 / 00:23:68 / 84:24:8D | Enterprise Handheld Scanners |
Private MAC address randomization and captive portal impact
Operating systems such as Apple iOS (Private WiFi Address), Google Android (MAC Randomization), and Microsoft Windows generate synthetic MAC addresses to prevent third-party location tracking across distinct physical WiFi networks.
Randomized addresses always set the U/L (Universal/Local) bit to 1. In hexadecimal notation, this means the second character of the first octet is always 2, 6, A, or E (for example: 02:xx:xx, 06:xx:xx, 0A:xx:xx, or 0E:xx:xx).
Operational challenges for guest WiFi deployments:
- Captive Portal Re-Authentication: If a device rotates its MAC address upon reconnecting, legacy splash portals cannot recognize the returning session and force guests through redundant login forms.
- DHCP Pool Exhaustion: Each synthetic MAC claims a fresh IP lease from the DHCP server, exhausting available subnet scopes in high-traffic venues like shopping centres and transport hubs.
- Distorted Footfall Metrics: Hardware-level visitor counting registers 1 physical user as 4 to 5 unique visitors over time, invalidating commercial dwell time analytics.
How Purple reconciles randomized devices for visitor analytics
Purple eliminates captive portal friction and preserves venue analytics integrity by shifting authentication from volatile hardware MAC addresses to verified guest identities:
- Multi-Source Identity Correlation: Maps verified user logins (RADIUS 802.1X SecurePass, social credentials, SMS verification, or single sign-on) to secure session tokens.
- Passpoint & Hotspot 2.0 Roaming: Installs encrypted Passpoint profiles that connect visitors automatically without splash screen interruptions, irrespective of MAC rotation settings.
- Identity-keyed metrics: Unifies footfall, dwell time, and repeat visit reporting across venues on the authenticated identity, so a rotated MAC does not split one visitor into several records.
How to look up a MAC address and detect private randomization
Step-by-step methodology to parse a MAC address, identify the hardware vendor via IEEE OUI, analyze binary flags, and detect randomized private addresses.
Input MAC address or OUI prefix
Enter any 48-bit MAC address (EUI-48) or 24-bit OUI prefix in colon, hyphen, Cisco dot, or raw hexadecimal notation into the search field.
Extract OUI and query IEEE vendor registry
The tool extracts the first three octets (24 bits) to look up the registered hardware manufacturer (such as Apple, Cisco, Intel, or Samsung) against the IEEE database.
Analyze binary U/L bit for private randomization
Inspect bit 1 of the first octet. If the U/L bit is set to 1 (hex character 2, 6, A, or E in the second position), the address is a randomized private MAC used by iOS, Android, or Windows.
Check binary I/G bit for transmission mode
Inspect bit 0 of the first octet. A value of 0 indicates an individual Unicast transmission, whereas a 1 denotes Multicast or Broadcast traffic.
Copy normalized MAC notation for network policies
Copy the normalized address in colon (Linux/macOS), hyphen (Windows), or Cisco dot notation to configure DHCP reservations, ACLs, and RADIUS policies.
Frequently asked questions
What is a MAC address OUI and how does the IEEE assign it?
An Organisationally Unique Identifier (OUI) is a 24-bit number assigned by the IEEE Registration Authority to hardware manufacturers. It forms the first three octets (24 bits) of a 48-bit MAC address (EUI-48), identifying the manufacturer such as Cisco, Apple, or Intel.
How do you detect whether a MAC address is randomized or factory-assigned?
Look at the second least significant bit of the first octet (the U/L bit). If this bit is 1, the address is Locally Administered (LAA), meaning it was randomly generated by iOS, Android, or Windows. In hexadecimal, if the second character of the first octet is 2, 6, A, or E (e.g. x2:xx:xx, x6:xx:xx, xA:xx:xx, xE:xx:xx), the MAC is randomized.
What is the difference between unicast and multicast MAC addresses?
The least significant bit of the first octet (the I/G bit) determines whether the frame targets an individual station (0 = Unicast) or a group of stations (1 = Multicast or Broadcast). Standard client devices use Unicast addresses, whereas protocols like mDNS and streaming video use Multicast addresses starting with 01:00:5E.
How does MAC address randomization impact guest WiFi and captive portals?
Because mobile devices rotate randomized MAC addresses per SSID or periodically, legacy captive portals that track visitors solely by MAC address will treat returning visitors as new devices, prompting repeated logins and creating duplicate visitor records that inflate footfall metrics.
How does Purple reconcile randomized MAC addresses for venue analytics?
Purple links guest sessions to verified identities (such as email, SMS verification, social login, or Passpoint 802.1X profiles) rather than relying on hardware MAC addresses. That correlates visits across rotated MAC addresses without asking visitors to turn private addressing off, because the identity rather than the hardware address is what carries between sessions.
MAC randomization skewing your counts?
Address rotation on iOS and Android can inflate raw footfall metrics. Purple reconciles guest signals through multi-source correlation, restoring analytics integrity.
Book a 20-min demoNetforge Network Multi-Tool
Run offline network health checks, path analysis, and latency diagnostic scans directly from your desktop.
Download Multi-Tool