MA:CV:en:do:rs

Guides

Why a lookup says locally administered or not found

The three results that are not a vendor name, and what each one is telling you.

Most lookups come back with a company name. When one does not, it is not an error. The address itself is telling you something, and it is usually something useful.

Locally administered

One bit in the first byte of every MAC address says whether the address was assigned by the manufacturer or set by software. Manufacturers use blocks they registered with the IEEE. Software that makes up an address is supposed to set this bit, and it is called the locally administered bit.

You can see it without doing any maths. Look at the second character of the address. If it is 2 , 6 , A or E , the address is locally administered. So 02:11:22:33:44:55 and DA:7B:... were made up by something, while 00:11:... and D8:7B:... came from a manufacturer's block.

Things that make up addresses:

  • Phones and tablets. iPhones since iOS 14 and Android phones since Android 10 use a random address on each Wi-Fi network by default, so they cannot be tracked from one network to the next. This is by far the most common reason you will see this result.
  • Laptops. macOS has done the same since Sequoia. Windows and Linux can, if the option is turned on.
  • Containers and virtual machines. Docker and most container tools make up addresses. Some virtual machine software does too, though VMware and VirtualBox use registered blocks of their own and show up under those names.
  • Network gear. Bridges, bonded interfaces, some mesh systems and a few enterprise products set the bit on addresses they generate.
Note: There is no vendor to find because no vendor was involved. The address was invented a few seconds, days or weeks ago by the device itself.

How to get the hardware address instead

Every device still has its real, manufacturer-assigned address, and it is shown in the device's own settings even when the network sees a random one. Our guides show where:

If you are looking at your router's device list and want to know what a locally administered entry is, you cannot look it up. Go the other way instead: check the phones in the house and compare their per-network address to the one the router shows.

Not found

The prefix is not in the IEEE registry as of our last update, and the address is not locally administered either. The usual reasons, roughly in order:

  • A typo. One wrong character in the first six changes the vendor entirely. Check the address against the source.
  • A brand new block. The IEEE publishes new assignments all the time, and we pull them multiple times each day. If a device was made last week it may be in a block that was published yesterday. Try again tomorrow.
  • An unregistered address. Some very cheap or counterfeit hardware ships with addresses from blocks nobody registered. There is nothing to look up.
  • A block that was returned. Companies occasionally give blocks back to the IEEE, and the IEEE removes them from the list. Hardware made under the old assignment keeps its address.
Note: Smaller vendors are given smaller blocks, which need the first seven or nine characters of the address to match rather than six. Our lookup handles that automatically, so paste in as much of the address as you have.

Multicast

If the second character is odd, meaning 1 , 3 , 5 , 7 , 9 , B , D or F , the address is a group address. It is not a device at all. It is a label that means "everyone who subscribed to this", and switches deliver frames sent to it to every subscriber.

You will see these in packet captures and some router logs. 01:00:5E starts IPv4 multicast, 33:33 starts IPv6 multicast, 01:80:C2 is used by spanning tree and other switch protocols, and FF:FF:FF:FF:FF:FF is broadcast, meaning everyone. Our lookup checks whether the matching unicast block is registered, which is why 01:00:5E comes back as IANA, and says "multicast" when it is not.