Skip to content
EnterraHost
Products
Tools
Hosting Email Support Client Area Find a domain

MAC address vendor. What the first three octets tell you

A MAC address vendor lookup names the organization that the IEEE assigned a hardware address prefix to. That is all it names, and the limit is worth understanding before you use the result to decide what a device is.

You can look up any hardware address without an account. This is what comes back and what it is worth.

What a MAC address contains

A hardware address is 48 bits, normally written as six pairs of hexadecimal digits. The first three octets are the Organizationally Unique Identifier, which identifies the organization that the IEEE issued the prefix to. The remaining three are assigned by that organization, which is what makes the whole address unique.

RFC 9724, the Internet standard on randomized and changing MAC addresses, describes that split and also notes a detail most people miss. Two bits in the first octet are not the vendor's to choose. They are set by the standard, and one of them is the whole reason a lookup sometimes returns nothing.

What a MAC address vendor lookup does not tell you

It does not tell you the device, the model or the operating system. Every laptop from one manufacturer shares prefixes, and a prefix registered to a network chip vendor can appear in hardware sold under a completely different brand. Identifying the prefix tells you who registered it, which is a useful clue and not an identification.

It also cannot tell you where the device is. A hardware address says nothing about location. The confusion comes from the fact that a device carries the same address everywhere, so it can be used to recognize a device across sightings. That is recognition rather than location, and it needs somebody observing the device at each point.

And it cannot be looked up from the internet. A MAC address is used within a local network and does not travel beyond it. Every hop between you and a server replaces the hardware addresses with its own, so nothing outside your own segment ever sees the address on your network card. If somebody claims to have found your device by its MAC from a web server log, they are describing something that does not happen.

Why a modern device returns no vendor at all

Most phones and most laptops now connect to Wi-Fi using an address they generate themselves rather than the one burned into the hardware. They are not hiding from you. They are stopping shops, airports and anybody else with a receiver from logging the same permanent identifier every time the device passes.

On Android, randomization is on by default for new networks and the generated address is bound to the network, so the same device presents a different address on your network than it does anywhere else. iOS does the same per access point. Windows generates one per network and can change it daily.

Those generated addresses are not allocated by any registry, so there is no vendor to find. A good lookup says so plainly rather than guessing. This tool reports the address as locally administered, or reports that no registered vendor exists, which is the true answer and not a failure of the lookup.

One consequence catches people out in the other direction as well. Android's own description of the behavior notes that a device which previously connected to a network using its real hardware address keeps using it for that network, so a device can present a genuine vendor prefix on one network and a generated one on the next.

The bit you can check by eye

The second-least-significant bit of the first octet marks whether the address is universally administered or locally administered. In practice that means the second character of the address tells you which kind you are holding.

An address beginning 0, 4, 8 or C in that position is universally administered and its prefix should be registered to somebody. One beginning 2, 6, A or E was set locally, by the operating system or an administrator, and will usually have no vendor at all.

This is worth knowing because it turns a confusing answer into an immediate one. If a lookup returns nothing for a device, read that second character first. If it is one of the locally administered set, there is nothing to find and no amount of retrying will change it.

What the lookup is for

A network engineer uses this to identify hardware. Something is plugged into a switch port, or appeared in a list of connected devices, and the address in front of you belongs to a prefix registered to a specific manufacturer. That narrows down what the thing is, and combined with the switch port or the address it was given, it usually settles the question without a site visit.

The tool also reports which IEEE registry block the prefix came from and the full registry entry behind it, so the answer is traceable rather than a bare company name. It is a lookup for the question "what is this", which is different from a diagnostic and no less useful for it.

Reading the rest of the address

Broadcast addresses and locally generated ones are the two cases where the answer is not a vendor. Everything else should resolve to a name, and a name that looks wrong usually means the prefix was reassigned at some point rather than that the lookup failed.

If the device you are identifying is one you can reach, the server check covers the other direction, testing what answers on a host rather than who built the hardware.

Every guide in this category is on the Mini Tools page.