MAC Address Generator

Not every random 48-bit value is a valid MAC

A MAC address is six bytes, but two bits in the very first byte carry meaning. The least significant bit of the first byte is the individual/group flag: set it and the address is multicast, which will not work as a host address. The next bit is the universal/local flag: clear means the address was assigned by a manufacturer from an IANA-registered range, set means it is locally administered. A generator that ignores these produces addresses that are half multicast and that may collide with real vendor allocations.

Use locally administered addresses for testing

Setting the U/L bit and clearing the I/G bit puts the address in a space explicitly reserved for local assignment, guaranteeing no conflict with any manufacturer's allocation. In practice this means the second hex digit of the address must be 2, 6, A or E. Any generated address whose second digit is something else is either claiming a vendor's OUI or is multicast.

The OUI carries the vendor

The first three bytes are the Organisationally Unique Identifier, purchased from the IEEE, and they identify the manufacturer. This is what lets a network scan report device makes, and it is why generating a random OUI can make test traffic appear to come from a real vendor's hardware. For local testing, the locally administered space avoids the question entirely.

MAC randomisation and why your phone does it

Modern phones present a different randomised MAC to each Wi-Fi network, because a stable MAC broadcast in probe requests let retail analytics and anyone with a receiver track a device across locations. This broke a generation of MAC-based access controls, which was the point. If your captive portal or address reservation relies on a stable MAC, expect it to fail on current mobile operating systems.

MAC filtering is not a security control

MAC addresses travel in cleartext in every frame, including on encrypted Wi-Fi, since the headers are not encrypted. Anyone within range can read an allowed address and set their own interface to match in one command. MAC filtering keeps out casual neighbours and nothing more; WPA2 or WPA3 with a strong passphrase is the actual control.

Related tools

• Port Scanner — Check which common ports respond on a host and understand what each exposed service means. Scan only systems you are authorised to test.
• DNS Misconfiguration — Analyze DNS records (TXT, SPF) for security gaps.
• TLS Compat Tester — Check client-server compatibility for TLS versions.
• Firewall Rule Risk — Evaluate firewall rules for over-permissive exposure.