Quick answer: what can a MAC vendor lookup identify?
A MAC vendor lookup compares an address prefix with a registration database. It may identify the organization associated with that prefix. It cannot reliably reveal a person's identity, location, exact device model or current owner.
Find a suitable address
Use an address from a device or network that you are authorized to inspect. A router's client list or a local interface report may show one. Check whether you are looking at WiFi, Ethernet or a virtual adapter: a single computer can have multiple interface addresses.
Keep a copied address complete and avoid confusing a MAC address with an IP address. The workspace shows the accepted input format. Common MAC displays use hexadecimal pairs separated by colons or hyphens; normalize the value only as instructed by the tool.
Run the lookup
- Open the MAC Vendor Lookup and enter the address.
- Run the check and review the provider and any cache information.
- Read the local/group-bit analysis before trusting the vendor label.
- Treat a missing match as an inconclusive lookup, not proof that a device is suspicious.
- Compare the result with authorized inventory information if you need to identify hardware.
Vendor lookups use an external provider. Local/group-bit analysis is calculated from the supplied address. Do not submit a confidential inventory simply to populate a public lookup report.
Understand prefix registration
Many familiar examples use a 24-bit organizational prefix, but registration blocks and allocation sizes vary. A prefix result should be interpreted using the database's coverage and the matched block. It is not a universal rule that the first three bytes always identify the physical manufacturer.
Network products can contain components registered to another organization. Virtual interfaces can use software-generated addresses. An organization's registration also does not prove which company currently sells or operates the observed device.
IEEE 802 identifier background: RFC 9542
Private and randomized MAC addresses
Modern devices may use locally administered addresses for privacy or network configuration. The local/universal bit is the second-least-significant bit of the first octet. If it is set, a conventional vendor-prefix conclusion may be misleading. The lowest bit indicates individual versus group addressing.
For example, an address starting with 02 has the local bit set and the group bit clear. That identifies bit properties, not a vendor or a person. It does not indicate malicious behavior. Avoid disabling a device's privacy feature merely to force a recognizable label.
When results do not match your inventory
Check the interface, input and registration coverage first. Then inspect the device's own documentation or your managed inventory. A network interface may be replaced, virtualized or configured with a different address. Database freshness and caching can affect the displayed result as well.
A MAC address is not a dependable remote tracking identifier. It is also not authentication: addresses can be changed or spoofed. Use proper network access controls rather than relying on a vendor label for security decisions.
Common questions
Can this identify an unknown person on my network? No. Investigate using authorized access records and device inventory, not a public vendor-prefix result alone.
Does no match mean a fake address? No. Local addressing, allocation coverage or stale records can explain a missing match.
Continue your investigation
Open the MAC Vendor Lookup. For address representation instead of hardware registration, read the IPv4-mapped IPv6 guide.
No published comments yet. Start the conversation.