MAC Address Lookup: Identify Device Manufacturers by OUI Prefix

What a MAC Address Lookup Actually Does

Every network interface card — in your laptop, your phone, your smart thermostat, your office printer — ships with a 48-bit hardware identifier called a MAC address (Media Access Control). It is written as six pairs of hexadecimal digits separated by colons or hyphens: AA:BB:CC:DD:EE:FF. The first three bytes (AA:BB:CC) form the Organizationally Unique Identifier, or OUI, which is assigned to the manufacturer by the IEEE. The last three bytes (DD:EE:FF) are assigned by the manufacturer to uniquely identify each device they produce.

A MAC address lookup takes those first three bytes and queries them against the IEEE's public OUI registry. The result tells you which company manufactured the network interface. If the OUI is 3C:22:FB, that is Apple. If it is 00:50:56, that is VMware. If it is B8:27:EB, that is the Raspberry Pi Foundation. This sounds simple, and it is — but it is also one of the most practical tools available for network inventory, rogue device detection, and forensic investigation.

The reason this matters is that networks accumulate devices. An enterprise with 500 employees might have 2,000 connected devices at any given time: laptops, phones, printers, access points, IoT sensors, security cameras, badge readers. When a new MAC address appears on the network, knowing the manufacturer is the first step in figuring out what it is and whether it belongs there.

How MAC Addresses Work

A MAC address occupies 48 bits, expressed as 12 hexadecimal characters. The IEEE designed this space with specific structure. The address is divided into two halves: the upper 24 bits identify the organization that manufactured (or was assigned) the interface, and the lower 24 bits are a serial number that the manufacturer assigns however they choose. This gives each OUI holder up to 16,777,216 unique addresses — enough for most manufacturers, though large companies like Apple and Samsung hold dozens of OUIs.

Two individual bits in the first byte carry special meaning. The least significant bit of the first byte is the I/G (Individual/Group) bit. When it is 0, the address refers to a single interface (unicast). When it is 1, it refers to a group of interfaces (multicast). The broadcast address FF:FF:FF:FF:FF:FF has all bits set to 1, meaning every device on the local segment should receive the frame. The second-least significant bit is the U/L (Universal/Local) bit. When it is 0, the address is universally administered — meaning the manufacturer assigned it and it should be globally unique. When it is 1, the address is locally administered — meaning someone (or some software) overrode the factory-assigned value.

  3C : 22 : FB : 01 : AB : 9E
  \________/    \________/
     OUI         Device ID
  (manufacturer)  (serial)

First byte (3C = 0011 1100):
  Bit 0 (I/G): 0 → Unicast (single device)
  Bit 1 (U/L): 0 → Universally administered (factory-set)

Common OUI examples:
  3C:22:FB  → Apple, Inc.
  00:50:56  → VMware, Inc.
  B8:27:EB  → Raspberry Pi Foundation
  00:1A:2B  → Ayecom Technology Co., Ltd.
  DC:A6:32  → Raspberry Pi Trading Ltd
  F8:28:19  → Liteon Technology Corporation

The hex notation itself varies by convention. IEEE uses hyphens (3C-22-FB), Unix and Linux systems use colons (3C:22:FB), Cisco uses dots with groups of four (3C22.FB01.AB9E), and Windows historically displayed hyphens. All represent the same 48-bit value. A MAC lookup tool should accept any of these formats.

The IEEE OUI Database

The IEEE Standards Association is the global authority for OUI assignments. When a hardware manufacturer wants to produce network interfaces, they purchase an OUI from IEEE, which costs around $3,745 for a standard MA-L assignment. That OUI is then theirs exclusively — no other manufacturer will be assigned the same prefix. The registry is public and freely downloadable, which is what makes MAC lookups possible.

As of 2026, the IEEE registry contains over 40,000 OUI assignments. But the system is more nuanced than a single 24-bit prefix. IEEE offers three assignment sizes to accommodate organizations of different scales:

• MA-L (MAC Address Block Large): The classic 24-bit OUI. Gives the holder 16.7 million unique addresses. Used by large manufacturers like Intel, Apple, and Cisco.
• MA-M (MAC Address Block Medium): A 28-bit prefix, giving the holder about 1 million addresses. Costs less than MA-L and suits mid-size manufacturers.
• MA-S (MAC Address Block Small): A 36-bit prefix, giving the holder 4,096 addresses. Designed for small-run hardware or IoT device makers who need fewer addresses.

This three-tier system means a MAC lookup is not always a simple 24-bit prefix match. If the first 24 bits match an MA-M or MA-S base block, you need to check 28 or 36 bits to identify the actual manufacturer. Most lookup tools handle this transparently, but if you are building your own parser from the raw IEEE data, you need to check all three registries in order: MA-S first (most specific), then MA-M, then MA-L.

# Look up a MAC address OUI using the IEEE public API
curl -s "https://standards-oui.ieee.org/oui/oui.csv" | \
  grep -i "3C-22-FB"
# Returns: MA-L,3C22FB,"Apple, Inc.","1 Infinite Loop..."

# Or use DomScan's MAC lookup for structured results:
curl -s "https://domscan.net/api/mac/3C:22:FB:01:AB:9E" \
  -H "X-API-Key: your-api-key"
# Returns JSON with manufacturer, address, country, block type

The raw IEEE data is published as a CSV file updated roughly weekly. It contains the OUI prefix, the company name, and the company's registered address. Some entries include minimal information (just a name and country), while larger manufacturers often list full street addresses. The data is not real-time — there can be a delay of days to weeks between when IEEE assigns a new OUI and when it appears in the public download. For most practical purposes, this lag does not matter, because new OUIs correspond to upcoming products that have not shipped yet.

MAC Randomization: The Privacy Shift

For decades, the assumption was simple: every device has a fixed, globally unique MAC address, and that address identifies the hardware no matter which network it joins. Retailers tracked shoppers by capturing probe requests from their phones. Airports mapped passenger flows. Advertisers built cross-network profiles. The MAC address was a persistent identifier that most people never thought about.

That assumption broke starting around 2014, and by 2020 it was essentially dead. Apple introduced MAC randomization in iOS 8 for Wi-Fi scanning, then made it the default for all Wi-Fi connections in iOS 14 (2020). Android followed in version 10, randomizing the MAC per network by default. Windows 10 and 11 added the same capability, though it requires manual activation on most configurations. The result: when your iPhone connects to a coffee shop's Wi-Fi, the MAC address the access point sees is not the real hardware MAC — it is a randomly generated address with the locally-administered bit set.

You can tell a randomized MAC from a factory-assigned one by checking the U/L bit (bit 1 of the first byte). If that bit is 1, the address is locally administered — almost certainly randomized by the OS. In hex, this means the second character of the first byte will be 2, 6, A, or E. A MAC address starting with x2:xx:xx, x6:xx:xx, xA:xx:xx, or xE:xx:xx (where x is any hex digit) is overwhelmingly likely to be randomized. This is the single most important thing network administrators need to check before trusting an OUI lookup.

The impact on network operations is significant. DHCP reservations based on MAC address stop working when a device presents a new randomized MAC after an OS update. MAC-based access control lists become useless for personal devices. Network monitoring tools that build device inventories from MAC addresses see phantom devices appearing and disappearing. Captive portals that remember devices by MAC address force users to re-authenticate. Any workflow that assumed MAC = persistent device identity needs to be rearchitected.

Practical Use Cases for MAC Lookups

Despite the complications of randomization, MAC OUI lookups remain valuable in specific contexts — particularly on wired networks, managed enterprise environments, and IoT deployments where randomization is either absent or disabled.

Network Inventory and Asset Discovery

When you scan a network with ARP or NDP and get back a list of 300 MAC addresses, the OUI lookup is the fastest way to categorize them. Addresses resolving to Dell, Lenovo, and HP are likely workstations. Addresses resolving to Cisco, Aruba, or Ubiquiti are network infrastructure. Addresses resolving to Hikvision or Dahua are likely IP cameras. This first-pass categorization saves hours compared to manually investigating each device. On wired Ethernet segments, where MAC randomization rarely applies, this approach is highly reliable.

Rogue Device Detection

If your corporate network should only contain Dell workstations and Cisco infrastructure, but an ARP scan reveals a MAC address with a Raspberry Pi or Espressif (ESP32) OUI, that is a red flag. Someone may have plugged in an unauthorized device — a network tap, a rogue access point, or a personal project. OUI-based alerting catches this class of issues quickly: set up a monitor that flags any MAC prefix not on your approved manufacturer list. It is not foolproof (an attacker can spoof a Dell MAC), but it catches casual policy violations and accidental connections.

Forensic Investigations

In digital forensics, DHCP logs and switch port tables often contain MAC addresses long after the device has been disconnected. Looking up the OUI narrows the manufacturer, which narrows the device type. If a breach investigation reveals that the attacker used a device with a MAC in the Alfa Network range (a popular wireless adapter brand among penetration testers), that tells the investigator something different than a MAC in the Intel range. Combined with the timestamp from DHCP, the switch port from SNMP, and the IP from the ARP table, the OUI adds one more dimension to the forensic picture.

IoT Device Identification

IoT devices almost never randomize their MAC addresses. Smart bulbs, sensors, thermostats, industrial controllers, and medical devices use their factory-assigned MAC. This makes OUI lookup particularly effective for IoT inventory. If your facility management team deploys Philips Hue lights, Nest thermostats, and Ring cameras, the OUIs for Signify (Philips), Google, and Amazon will appear predictably. An unknown OUI from a Chinese manufacturer you did not procure might indicate a supply chain substitution or an unauthorized device. DomScan's MAC Address Lookup tool resolves these identifiers instantly.

BYOD Policy Enforcement

Organizations with Bring Your Own Device policies sometimes use OUI lookups as a first-pass filter. If the policy allows Apple and Samsung personal devices but not others, the OUI check provides an initial gate. This is not a security control — it is a policy compliance check. The real enforcement should come from 802.1X authentication and endpoint posture assessment, but the OUI gives the help desk a quick way to identify what class of device someone is trying to connect.

Limitations of MAC Address Lookups

MAC lookups are useful, but treating them as authoritative is a mistake. The limitations are fundamental, not edge cases.

• MAC spoofing is trivial. On Linux, `ip link set dev eth0 address XX:XX:XX:XX:XX:XX` changes the MAC instantly. macOS and Windows have similar one-line commands. Any security control that relies solely on MAC is bypassable in seconds.
• Randomization defeats OUI identification. A randomized MAC has its locally-administered bit set, which means no valid OUI match exists in the IEEE database. The lookup returns nothing useful.
• OUI identifies manufacturer, not model. Knowing a device is made by Apple tells you it could be an iPhone, iPad, MacBook, Apple TV, HomePod, or AirTag. The OUI cannot distinguish between them.
• Virtual machines use software MACs. VMware, VirtualBox, Hyper-V, and KVM all assign MAC addresses from their own OUI ranges. The lookup tells you the hypervisor vendor, not what guest OS is running.
• Some manufacturers share OUIs. Contract manufacturers and ODMs (like Foxconn, Pegatron, Quanta) produce devices for multiple brands. A Foxconn OUI might be a Dell server, a Sony PlayStation, or an HP printer.
• Decommissioned OUIs cause confusion. Companies get acquired, renamed, or dissolved. An OUI assigned to a company that no longer exists will still appear in the registry under its original name.

The practical lesson is straightforward: use MAC OUI lookups for identification hints, not for security decisions. A MAC lookup is evidence, not proof. It belongs in a correlation workflow alongside other signals — DHCP fingerprinting, HTTP user-agent strings, 802.1X certificate attributes, and behavioral analysis.

MAC Lookup in Network Security

The relationship between MAC addresses and network security is more nuanced than most documentation acknowledges. There are three layers worth understanding: MAC filtering, proper authentication, and advanced profiling.

MAC Filtering Is Security Theater

Many home routers and small business access points offer MAC filtering — a whitelist of allowed MAC addresses. The theory is that only approved devices can connect. The reality is that any attacker who can capture a single legitimate frame (which takes seconds with a monitor-mode adapter) can read an approved MAC address from the air and clone it. MAC filtering adds friction for legitimate users who get new devices and zero friction for attackers. Every security professional consensus treats MAC filtering as a checkbox exercise, not a real control.

802.1X: Doing Authentication Properly

The correct approach to network access control is 802.1X (IEEE 802.1X-2020), which authenticates devices using certificates or credentials before granting network access. The device presents a certificate to a RADIUS server, which verifies the identity cryptographically. The MAC address is irrelevant to the authentication decision — what matters is the certificate's validity and the identity it asserts. Enterprise environments that implement 802.1X can safely ignore MAC addresses for access control entirely.

Where MAC addresses still play a role in 802.1X environments is MAC Authentication Bypass (MAB). Some devices — printers, IP phones, IoT sensors — cannot participate in 802.1X because they lack a supplicant. For these, the switch falls back to checking the MAC address against a whitelist. This is a known-weak fallback, and best practice is to place MAB devices on a restricted VLAN with limited network access. The OUI lookup helps here: if a device claims to be a printer (matching an HP OUI) but starts scanning the network like a workstation, that behavioral mismatch triggers an alert.

DHCP Fingerprinting as a Complement to OUI

DHCP fingerprinting examines the options a device requests in its DHCP Discover and Request messages. Different operating systems and device types request different combinations of DHCP options in a specific order. An iPhone requests a different set of options than a Windows laptop, and both differ from a Zebra barcode scanner. When you combine the DHCP fingerprint (which identifies the OS and device type) with the OUI lookup (which identifies the manufacturer), you get a much more reliable device classification than either alone.

Network Access Control (NAC) platforms like Cisco ISE, Aruba ClearPass, and Forescout use exactly this approach. They ingest the MAC address (OUI lookup), DHCP fingerprint, HTTP user-agent (if available), and 802.1X certificate attributes to build a device profile. The OUI is one input among many, but it is often the first one available — the MAC address is visible the moment a device sends its first frame, before DHCP or HTTP traffic occurs.

{
  "mac": "B8:27:EB:4F:2C:A1",
  "oui": "B8:27:EB",
  "manufacturer": "Raspberry Pi Foundation",
  "address": "Mitchell Wood House, Caldecote, Cambridgeshire, CB23 7NU, GB",
  "country": "GB",
  "blockType": "MA-L",
  "blockSize": 16777216,
  "isPrivate": false,
  "isMulticast": false,
  "isLocallyAdministered": false,
  "registrationDate": "2012-09-27"
}

Notice the flags in the response: isLocallyAdministered is false, confirming this is a factory-assigned address with a valid OUI. If that flag were true, the OUI lookup would still return the matching prefix entry, but you should treat it with suspicion — the address was likely generated by software rather than burned into hardware.

Running Your Own MAC Lookups

You have several options for performing MAC OUI lookups, depending on whether you need a one-off answer or an automated pipeline.

For quick manual lookups, DomScan's MAC Address Lookup tool takes any MAC address format and returns the manufacturer, country, block type, and registration date. No account needed for basic lookups. For network professionals investigating unknown devices, this is the fastest path from MAC address to manufacturer identification.

For integration into monitoring tools, SIEM platforms, or custom scripts, you want an API. The DomScan API accepts MAC addresses in any common format (colon-separated, hyphen-separated, dot-separated, or raw hex) and returns structured JSON. If you are building a network inventory system that needs to resolve thousands of MAC addresses, the API approach avoids the overhead of downloading and parsing the full IEEE CSV yourself.

For air-gapped environments or offline use, download the IEEE CSV files directly from the IEEE OUI registry. You will need three files: oui.csv (MA-L), mam.csv (MA-M), and oui36.csv (MA-S). Parse them into a local database or hash map, and you can resolve OUIs without any network dependency. The total data set is under 10 MB and updates weekly.

Whichever approach you use, the MAC lookup is a starting point. It answers the question "who manufactured this network interface?" but rarely the deeper questions of "what is this device doing?" or "should it be here?" For those answers, combine the OUI data with the network intelligence tools that provide fuller context: an IP lookup for the device's network address, hosting detection for the infrastructure it communicates with, and a domain profile for any domains it resolves.