Outlivo
ToolsGuidesAboutPrivacyTerms
Outlivo

63 free online tools for developers, students, and creators. Fast, safe, and easy to use.

Popular Tools

JSON ToolkitPassword Security HubImage ToolkitPDF ToolkitDiff & Code CompareInvoice Generator

Categories

Developer ToolsFinance CalculatorsSEO UtilitiesDesign ToolsText ConvertersSecurity Tools

Help & Legal

All ToolsGuidesAboutContactPrivacyTerms

© 2026 Outlivo. All rights reserved.

Independently created & operated by Pradhumn Pawar.
HomeGuidesMAC Address Architecture & OUI Vendor Lookup: EUI-48, Bit Masks & Packet Analysis
Network
By Pradhumn Pawar•12 min read•Published: 2026-08-20

MAC Address Architecture & OUI Vendor Lookup: EUI-48, Bit Masks & Packet Analysis

Complete technical guide to MAC address architecture: IEEE OUI assignments, EUI-48 vs EUI-64, multicast/local bit masks, randomized MAC addresses, and network troubleshooting.

Interactive Companion Utility

Try it hands-on with Outlivo MAC Address / OUI Lookup

Free MAC address & OUI lookup. Identify device manufacturers, hardware vendors, and randomized MAC addresses instantly. Fast client-side database search.

Open MAC Address / OUI Lookup

1. Anatomical Breakdown of IEEE EUI-48 and EUI-64 Identifiers

Media Access Control (MAC) addresses serve as the foundational hardware layer identifiers operating at Data Link Layer 2 of the OSI reference model. Standard Ethernet, Wi-Fi (IEEE 802.11), and Bluetooth physical network interfaces utilize 48-bit numerical hardware addresses formatted according to the IEEE Extended Unique Identifier (EUI-48) standard. An EUI-48 identifier is composed of exactly 48 binary bits, conventionally represented as 12 hexadecimal digits organized into six octets delimited by colons (`00:1A:2B:3C:4D:5E`), hyphens (`00-1A-2B-3C-4D-5E`), or periods in Cisco tri-octet notation (`001a.2b3c.4d5e`). Structurally, the 48 bits are divided into two equal 24-bit halves: • Organizationally Unique Identifier (OUI): The first 24 bits (three octets) are assigned by the Institute of Electrical and Electronics Engineers (IEEE) Registration Authority to identify the network hardware manufacturer (e.g., Apple, Cisco, Intel, Samsung). • Network Interface Controller (NIC) Specific Identifier: The remaining 24 bits (three octets) are assigned sequentially or pseudorandomly by the manufacturer to uniquely identify the physical device. In IPv6 auto-configuration (SLAAC) and Zigbee/6LoWPAN mesh architectures, the 64-bit EUI-64 format is employed instead. EUI-48 addresses are translated into EUI-64 by splitting the OUI and NIC halves and inserting the fixed 16-bit sequence `0xFFFE` (Hexadecimal) directly into the center. To inspect, normalize, or audit any physical hardware address against the official IEEE vendor registry in real time, utilize the MAC Address / OUI Lookup tool directly in your browser.

2. The Critical Mechanics of the I/G and U/L Bit Masks

Embedded within the very first octet of any IEEE 802 MAC address are two specialized bit flags that govern how Ethernet switches and network adapters handle frame delivery. Understanding these two bits is essential for network engineers diagnosing switching loops, multicast packet drops, and device tracking anomalies: • The I/G (Individual / Group) Bit: Bit 0 of the first octet (the least significant bit of the first byte transmitted on the wire). - When set to `0`, the address denotes an Individual address (Unicast frame destined for a single physical network interface card). - When set to `1`, the address denotes a Group address (Multicast or Broadcast frame destined for multiple listening nodes). For example, the universal broadcast address `FF:FF:FF:FF:FF:FF` has its I/G bit set to 1. Similarly, standard IPv4 multicast addresses begin with the IEEE prefix `01:00:5E`, where the initial byte `0x01` has its least significant bit set to 1. • The U/L (Universal / Local) Bit: Bit 1 of the first octet (the second least significant bit of the first byte). - When set to `0`, the address is Universally Administered, meaning it was officially allocated by the IEEE to a registered manufacturer and is guaranteed to be globally unique. - When set to `1`, the address is Locally Administered, meaning it was assigned by a network administrator, generated by virtualization software (e.g., Docker, VMware, Hyper-V), or synthesized by mobile operating system privacy engines (e.g., Apple iOS Private Wi-Fi addresses). When inspecting hexadecimal notation, any first octet whose second hex digit is 2, 6, A, or E (e.g., `x2:xx:xx`, `x6:xx:xx`, `xA:xx:xx`, `xE:xx:xx`) represents a locally administered randomized address.
IEEE 802 MAC Address First Octet Flag Bit Layout
First Octet Bit Layout:
Bit Position:  7   6   5   4   3   2   1   0
             ┌───┬───┬───┬───┬───┬───┬───┬───┐
             │ b7│ b6│ b5│ b4│ b3│ b2│U/L│I/G│
             └───┴───┴───┴───┴───┴───┴───┴───┘
                                       │   │
  U/L: 0 = Universal (IEEE Assigned) ──┘   │
       1 = Local (Randomized/Virtual)      │
                                           │
  I/G: 0 = Individual (Unicast) ───────────┘
       1 = Group (Multicast/Broadcast)

3. IEEE Registration Authority Tiers: MA-L, MA-M, and MA-S Registries

The IEEE Registration Authority offers three distinct allocation blocks to hardware vendors, categorized by the volume of unique device identifiers required: 1. MAC Address Block Large (MA-L / Traditional OUI): Vendors receive a complete 24-bit prefix. This reserves the remaining 24 bits for the manufacturer, providing exactly 2^24 (16,777,216) unique hardware MAC addresses. Major equipment producers like Cisco, Apple, and Intel purchase multiple MA-L allocations. 2. MAC Address Block Medium (MA-M): Vendors receive a 28-bit prefix. The vendor manages the remaining 20 bits, yielding exactly 2^20 (1,048,576) individual device addresses. This tier is designed for mid-sized electronics manufacturers producing smart home appliances or specialized industrial sensors. 3. MAC Address Block Small (MA-S / Formerly OUI-36): Vendors receive a 36-bit prefix. The vendor manages the remaining 12 bits, providing 2^12 (4,096) individual addresses. This tier supports boutique hardware developers and specialized laboratory equipment manufacturers requiring minimal address space. Because of these multi-tier blocks, an accurate OUI database lookup cannot merely match the first three octets; it must evaluate 24-bit, 28-bit, and 36-bit prefix masks sequentially to identify the true registered vendor.

4. Privacy and Ephemeral Identities: MAC Address Randomization in Modern Operating Systems

Historically, every smartphone, tablet, and laptop broadcast its factory-burned universal MAC address during Wi-Fi probe requests. Commercial retail establishments and municipal tracking networks deployed passive Wi-Fi sniffers to monitor pedestrian movement across city centers and shopping malls by logging persistent MAC beacons. To mitigate this pervasive surveillance vector, modern operating systems introduced MAC address randomization: • Apple iOS (iOS 14+) & macOS: "Private Wi-Fi Address" generates a unique, rotating 48-bit locally administered MAC address per Wi-Fi network SSID. • Google Android (Android 10+): Enabled by default on all Wi-Fi connections, synthesizing a randomized MAC per network connection profile. • Microsoft Windows (Windows 10/11): Provides optional "Random hardware addresses" settings for wireless network interfaces. Implications for Network Administrators: Randomized MAC addresses invariably set the U/L bit to 1. If an employee connects a smartphone to a corporate Wi-Fi network, its MAC address will not match any official IEEE hardware vendor in the database because the first octet will contain a 2, 6, A, or E digit. Enterprise network architectures requiring static DHCP reservations, device admission control (802.1X), or asset management must account for randomized interfaces by authenticating endpoints via digital certificates (WPA3-Enterprise) rather than relying on Layer 2 MAC filtering.

5. Layer 2 Troubleshooting: ARP Tables, DHCP Snooping, and Wireshark Packet Filtering

In everyday network operations, MAC address analysis is indispensable for locating rogue devices, resolving IP address conflicts, and diagnosing packet switching failures. Address Resolution Protocol (ARP) Inspection: When two host devices on a local subnet attempt to communicate via IP, they exchange ARP queries to resolve Layer 3 IPv4 addresses to Layer 2 physical MAC addresses. You can inspect local ARP caches on any operating system using standard terminal commands: ```bash # List local ARP resolution table on Linux / macOS arp -a # Display neighbor table with interface bindings on Linux ip neigh show # Query ARP cache on Windows arp -a ``` Wireshark Display Filters for Layer 2 Analysis: Network engineers analyzing packet captures (.pcap) frequently isolate traffic by hardware vendor or broadcast domains using targeted Wireshark display filters: ```text # Filter frames originating from or destined to a specific MAC eth.addr == 00:1a:2b:3c:4d:5e # Filter frames originating from an exact source MAC eth.src == 00:1a:2b:3c:4d:5e # Filter all Ethernet broadcast frames (ARP queries, DHCP discover) eth.dst == ff:ff:ff:ff:ff:ff # Filter all Multicast frames (IPv4 Multicast, mDNS, SSDP) eth.dst[0] & 1 # Filter all locally administered / randomized MAC addresses eth.src[0] & 2 ```

6. Automated OUI Parsing, Normalization & Sanitization in TypeScript and Python

Enterprise network monitoring pipelines and security information event management (SIEM) engines frequently ingest heterogeneous MAC address formats from syslog, netflow, and firewall exports. Standardizing raw strings into compliant EUI-48 notation and identifying local versus universal masks requires robust sanitization logic:
Production-ready TypeScript MAC address normalization and bitwise flag evaluator
// Enterprise MAC Address Normalizer & OUI Extractor in TypeScript
export interface MacAnalysisResult {
  raw: string;
  normalized: string;
  isValid: boolean;
  isMulticast: boolean;
  isLocallyAdministered: boolean;
  ouiPrefix: string;
}

export function parseMacAddress(input: string): MacAnalysisResult {
  // Strip delimiters (colons, hyphens, periods, whitespace)
  const cleaned = input.trim().toLowerCase().replace(/[^a-f0-9]/g, '');

  if (cleaned.length !== 12) {
    return {
      raw: input,
      normalized: '',
      isValid: false,
      isMulticast: false,
      isLocallyAdministered: false,
      ouiPrefix: ''
    };
  }

  // Format into standard IEEE colon-delimited octets
  const octets = cleaned.match(/.{1,2}/g) || [];
  const normalized = octets.join(':');

  // Evaluate flags in the first octet
  const firstByte = parseInt(octets[0], 16);
  const isMulticast = (firstByte & 0x01) === 1;
  const isLocallyAdministered = (firstByte & 0x02) === 2;

  // Extract 24-bit OUI prefix (first 3 octets)
  const ouiPrefix = octets.slice(0, 3).join(':').toUpperCase();

  return {
    raw: input,
    normalized,
    isValid: true,
    isMulticast,
    isLocallyAdministered,
    ouiPrefix
  };
}

// Example usage:
const sample = parseMacAddress('00-1A-2B-3C-4D-5E');
console.log(`Normalized: ${sample.normalized} | OUI: ${sample.ouiPrefix} | Local: ${sample.isLocallyAdministered}`);

7. Common Layer 2 Security Threats: MAC Flooding, Spoofing, and Port Security

Because Layer 2 Ethernet headers were designed for trusting, local broadcast topologies, they are vulnerable to several classical local attack vectors if switches remain unhardened: • MAC Address Spoofing: An attacker configures their network interface with the MAC address of an authorized server, printer, or executive workstation. This can bypass naive MAC-filtering firewalls or intercept unicast frames destined for the victim. Defend by enforcing IEEE 802.1X port-based network access control with EAP-TLS certificate validation. • MAC Flooding Attacks: A compromised device generates thousands of bogus frames per second with random source MAC addresses. When the switch Content Addressable Memory (CAM) table fills to maximum capacity (typically 8,000 to 128,000 entries), the switch enters a fail-open mode, broadcasting incoming frames to every switch port like a legacy hub. This allows attackers to sniff network traffic on the local VLAN. Mitigation: Configure switch port security to limit the maximum number of learned MAC addresses per port (e.g., maximum 2) and shut down the port upon violation (`switchport port-security violation shutdown`). • ARP Cache Poisoning (Man-in-the-Middle): Attackers emit gratuitous ARP responses mapping the default gateway IP to their own MAC address, causing local nodes to route external traffic through the attacker. Mitigation: Enable Dynamic ARP Inspection (DAI) and DHCP Snooping on all access layer switches.

8. Frequently Asked Questions: MAC Addressing, OUI Lookups, and Network Forensics

Q: Can two devices on the internet share the exact same MAC address? A: Yes. Because MAC addresses operate exclusively at Layer 2 within the local broadcast domain (subnet), routers strip Ethernet frames and replace source/destination MAC addresses at every router hop. As long as two duplicate MAC addresses do not reside on the same Layer 2 VLAN or physical broadcast domain, no network collision or routing conflict occurs. Q: Why does my MAC address lookup show "Unknown Vendor" or "Locally Administered"? A: If the lookup tool returns an unknown vendor, your device is almost certainly utilizing MAC address randomization (such as Apple Private Wi-Fi Address or Android Randomization). Check the second hexadecimal digit of the first octet; if it is 2, 6, A, or E, the address was generated locally by your operating system rather than assigned by the IEEE. Q: Is a MAC address considered Personally Identifiable Information (PII) under GDPR? A: Yes. Under European Union Court of Justice precedent and GDPR regulatory guidance, persistent hardware identifiers that can be linked to an individual (such as a device MAC address logged by public Wi-Fi hotspots) constitute personal data subject to privacy compliance and retention restrictions.

Key Takeaways

  • An EUI-48 MAC address consists of 48 bits: the first 24 bits represent the IEEE OUI vendor, while the remaining 24 bits represent the device NIC identifier.
  • The two least significant bits of the first byte determine whether an address is Multicast (I/G bit) and whether it is Universally or Locally Administered (U/L bit).
  • Modern mobile operating systems randomize Wi-Fi MAC addresses for privacy, setting the U/L bit to 1 (digits 2, 6, A, or E).
  • Enterprise networks should enforce 802.1X certificate authentication and port security rather than relying on easily spoofed MAC address filters.
  • EUI-48 addresses translate to IPv6 EUI-64 identifiers by splitting the halves and inserting 0xFFFE into the center.
  • Use the client-side MAC Address / OUI Lookup tool to audit hardware vendors instantly without transmitting device credentials over the network.
PP
Written by Pradhumn PawarAuthor & Site Operator

Founder and engineer at Outlivo. Building privacy-first, client-side web tools, developer utilities, and technical guides. Published on 2026-08-20.

Back to all guides
Launch MAC Address / OUI Lookup