MAC Address Lookup

What a MAC address encodes

A MAC address is 48 bits, usually written as six hex pairs. The first three bytes are the Organisationally Unique Identifier, assigned by the IEEE to a manufacturer; the last three are assigned by that manufacturer to the individual interface. Looking up the OUI therefore tells you who made the network chipset, which is not always the same company as the one whose logo is on the device.

Two bits in the first byte matter

The least significant bit of the first byte is the unicast/multicast flag: 0 for a normal address, 1 for multicast. The next bit is the universal/local flag. When it is set, the address is locally administered, meaning it was not assigned by the IEEE and no OUI lookup will be meaningful. Virtual machines, containers, bonded interfaces and privacy-randomised addresses all use locally administered addresses.

MAC randomisation

If a lookup returns nothing for a phone, randomisation is the likely reason. iOS since version 14 and Android since 10 use a different randomised MAC per network by default, specifically to stop venues tracking devices across visits. Windows and modern Linux offer the same. This has real consequences: MAC-based access control lists and captive portal allowlists break, and Wi-Fi analytics that count unique MACs now overcount badly.

MAC addresses do not cross routers

A MAC address is a layer 2 identifier and is only meaningful on the local network segment. Every time a packet passes through a router the source and destination MAC are rewritten for the next hop. You cannot learn the MAC address of a remote internet host, and any service claiming to provide one is not doing what it says.

Not a security control

MAC addresses can be changed in software on essentially every operating system in one command, and they are broadcast unencrypted in Wi-Fi frames, so anyone nearby can observe a permitted address and clone it. MAC filtering deters casual connection attempts and nothing more. Use WPA3, or WPA2 with a strong passphrase, and 802.1X where the environment justifies it.