MAC Address Lookup
Paste a MAC in any notation — colon, hyphen, or dotted — and get the vendor, all three formats, and what the address's flag bits say about how it will be delivered and where it came from.
Vendor (OUI)
Notations
Flag bits
Read the first octet right-to-left: the last bit is I/G (1 = multicast) and the one before it is U/L (1 = locally administered). They sit at the end because Ethernet sends each octet least-significant-bit first, so they are the first two bits on the wire.
In the NetForge-AI lab you can send a frame and watch the switch populate its MAC address table in real time — then flood, forward, and age the entry out. Seeing the table fill is what makes L2 forwarding click.
Open the labHow to read a MAC address
A MAC address is 48 bits, written as 12 hexadecimal digits. The split is simple: the first 24 bits are the OUI, assigned by IEEE to a manufacturer, and the last 24 bits are that manufacturer's serial allocation for the individual interface. Together they are meant to be globally unique — one address, one NIC, anywhere in the world.
Two bits inside the first octet carry meaning beyond identity. The last bit is I/G: 0 for a unicast frame aimed at one NIC, 1 for a multicast frame aimed at a group. The bit before it is U/L: 0 when the vendor burned the address in, 1 when software assigned it. This is why 01:80:C2:00:00:00 — the spanning tree BPDU destination — starts with an odd octet, and why a VMware NIC starting 00:50:56 is still universally administered while a randomized phone Wi-Fi address is not.
This tool ships 121 curated vendor prefixes covering the network equipment, hypervisors, and consumer NICs that actually turn up in labs and captures, rather than the full IEEE registry — which is several megabytes and would make the page slow for no teaching benefit. Structural analysis works for every valid address regardless.
MAC address FAQ
What is an OUI in a MAC address?
The Organizationally Unique Identifier is the first three octets (24 bits). IEEE assigns it to a manufacturer, who then allocates the remaining 24 bits to individual interfaces. So 00:1A:2F identifies the vendor and the last three octets identify that vendor's specific NIC.
How do I tell a unicast MAC from a multicast MAC?
Look at the least-significant bit of the first octet — the I/G bit. 0 means unicast (one destination NIC), 1 means multicast (a group). An odd first octet is therefore always multicast: 01:80:C2 (spanning tree) and 01:00:5E (IPv4 multicast) both start odd. FF:FF:FF:FF:FF:FF is the all-ones broadcast.
What does a locally administered MAC address mean?
The second-least-significant bit of the first octet is the U/L bit. When it is 1, software assigned the address rather than the manufacturer burning it in — typical of hypervisor NICs, HSRP and VRRP virtual MACs, and the randomized addresses phones use for Wi-Fi privacy. Such an address has no meaningful vendor to look up.
Why do routers show MACs as 001a.2f3c.4d5e?
It is the same 48 bits in a different notation — three groups of four hex digits instead of six pairs. Router CLIs favour it, Windows uses hyphens, and Linux and packet captures use colons. This tool prints all three so you can paste whichever your device expects.
Can a MAC address be changed?
Yes. The burned-in address lives in the NIC, but essentially every operating system lets you override the address it transmits. That is why a MAC is useful for identifying devices on a trusted LAN and useless as a security control on an untrusted one.
More free tools: Subnet Calculator · IP to Binary Converter · Port Number Lookup · All tools