A MAC address's first three bytes are its Organizationally Unique Identifier (OUI), a block assigned by the IEEE to a specific manufacturer — which is why a MAC address can often identify the hardware vendor of a network interface (Apple, Intel, Raspberry Pi Foundation, and so on) without any other context, just from those six leading hex digits. This is genuinely useful for network inventory and troubleshooting: seeing a cluster of unrecognized devices with a Raspberry Pi OUI on a corporate network is a very different finding than a cluster with a printer manufacturer's OUI.
The second bit of the first byte carries specific meaning independent of the vendor lookup: it's the U/L (universal/local) bit, and when set, it marks the address as locally administered rather than globally-unique-and-vendor-assigned — meaning the OUI-based vendor lookup doesn't apply at all, because the address was generated or overridden by software rather than burned in by the manufacturer. The bit immediately below it is the I/G (individual/group) bit, marking multicast versus unicast addressing.
This distinction has become far more relevant since iOS 14 and Android 10 introduced MAC randomization by default for Wi-Fi probing and, in some cases, for the address actually used per network — a privacy feature specifically designed to prevent the OUI-based device tracking that retail analytics and Wi-Fi positioning systems used to rely on. A randomized address always sets the locally-administered bit, which is exactly the tell that lets you distinguish 'this MAC's vendor lookup means nothing, it's a privacy-randomized address' from 'this MAC genuinely traces to a manufacturer.'
This lookup parses the address, checks the U/L and I/G bits first, and — only for addresses that are genuinely globally-assigned — looks up the OUI against a vendor database, so the output correctly distinguishes a real hardware fingerprint from a randomized address that only looks like one.
Edge cases worth knowing
- A MAC address with the locally-administered bit set
- Any address with the second-least-significant bit of the first octet set to 1 (making the first octet's low nibble 2, 6, A, or E, among other combinations) is locally administered — the OUI-based vendor lookup is meaningless for it by definition, whether it's a randomized privacy address, a virtual machine's assigned NIC, or a manually configured address.
- A broadcast address, FF:FF:FF:FF:FF:FF
- This isn't any vendor's OUI — it's the reserved all-ones broadcast address, delivered to every device on the local network segment. This lookup recognizes it as a special reserved address rather than reporting a failed vendor match.
- A MAC address vendor block that's been reassigned or subdivided
- IEEE occasionally reassigns or subdivides OUI blocks as manufacturers merge or cease operating, and a vendor database that isn't kept current will misattribute newer devices. This lookup uses a maintained vendor table but, like any OUI database, may not reflect the very latest IEEE assignments.
Common mistakes
- Using MAC address vendor lookup as a reliable device-fingerprinting mechanism without accounting for MAC randomization on modern mobile devices.
- Assuming every MAC address traces to a real hardware manufacturer, when locally-administered addresses are common in virtualization, containers, and privacy features.
- Treating the OUI vendor as proof of device identity for access-control decisions — MAC addresses are trivially spoofable at the software level regardless of what the OUI claims.
- Confusing the broadcast address or a multicast range with a legitimate unicast device address during network traffic analysis.