MAC address analyser: what the bits say, and what a lookup cannot

What is a MAC address?

A MAC address is the forty-eight-bit name a network interface answers to on its local segment. Every Ethernet frame and every Wi-Fi frame carries one at each end, and switches use nothing else to decide where a frame goes. It is written as twelve hexadecimal digits, usually in pairs separated by colons — though hyphens, Cisco's dotted groups of four, and twelve bare digits are all in circulation and all mean the same thing.

The address is not structureless. Two bits of the first octet carry meaning, and the rest is split between a block the IEEE assigned to some organisation and a serial number that organisation chose. That structure is what lets a tool say something about an address, and — more usefully — what lets it say when nothing can be said.

This analyser reads the address rather than looking it up. It shows every notation, decodes both flag bits, derives the IPv6 interface identifier the address would produce, and tells you whether a vendor lookup on this particular address could give a single answer at all.

How to use it

1. Paste the address in whatever notation you have. Colons, hyphens, Cisco dots or bare digits are all accepted, and the tool will tell you if the grouping does not match the separator. The sample buttons load five addresses, each chosen to show a different thing the bits can say.
2. Read the two flag bits. One says whether the address was ever registered with the IEEE; the other says whether it addresses one interface or a group. They are independent, and between them they explain most of what looks mysterious about an address.
3. Check the vendor panel before trusting any lookup. It names the first twenty-four bits and says whether that prefix is one the IEEE has carved into smaller blocks — because if it is, no three-octet lookup can name a single company.

Why this page will not name the manufacturer

Almost every MAC address tool reads the first three octets, looks them up in a table, and prints a company name. That works for most addresses and is wrong more often than the confident output suggests, for a reason visible in the IEEE's own files.

The IEEE does not run one registry. It runs three, and they hand out blocks of different sizes: MA-L assignments are twenty-four bits, MA-M are twenty-eight, and MA-S are thirty-six. Every one of the 39,898 MA-L rows is exactly six hexadecimal digits, every one of the 6,528 MA-M rows is seven, and every one of the 7,119 MA-S rows is nine — so "the first three octets identify the vendor" is a statement about the largest registry that happens to be repeated about all of them.

The consequence is countable. Of the 53,545 assignments, 14,080 — twenty-six percent — sit behind a twenty-four-bit prefix that more than one organisation holds. There are 439 such prefixes, and one of them, 70:B3:D5, is shared by 3,324 organisations, because that is where the IEEE hands out its smallest blocks. A tool that reads three octets and prints one name is, for any address in that prefix, choosing between three thousand possible answers and showing you one.

The two bits, and the IPv6 address

The least significant bit of the first octet is the individual/group bit. Set, the frame is meant for every interface listening for that address rather than for one; the broadcast address, all forty-eight bits ones, is the extreme case. The next bit up is the universal/local bit, and it says whether the address came from an IEEE assignment at all. Set means locally administered — chosen by whoever runs the network or by the device itself.

That second bit is why your phone's Wi-Fi address changes. Randomised addresses set the local bit, so one bit distinguishes a privacy address from a burned-in one, and no registry can say anything about the former however good the lookup is. This tool says so explicitly rather than showing you an empty vendor field.

The same bit reappears in IPv6. RFC 4291 turns a MAC address into an interface identifier by inserting the octets FF and FE in the middle and inverting the universal/local bit — the appendix says so twice, ending "The only change is inverting the value of the universal/local bit." That inversion is the step implementations forget: a globally unique address, whose bit is zero, produces an identifier whose bit is one. The tool shows the identifier and the link-local address that follows from it.

Honest limitations

There is no vendor lookup here at all, and that is a size decision as much as a correctness one. Trimmed to assignment and organisation name, the three registries come to 1.66 megabytes, or 589 kilobytes compressed — several times what this site is willing to make you download for one page. What is carried instead is the list of 439 ambiguous prefixes, which is about three kilobytes, so the tool can tell you when a lookup would be guessing even though it cannot do the lookup.

That list is a snapshot, and it can only ever be incomplete rather than wrong: the registries gain rows continuously, so a prefix that becomes shared after the fetch date will not be flagged, while nothing flagged will stop being shared. The page prints the date it was fetched. The three registry counts are from the same snapshot.

Finally, an address tells you less than people hope. It identifies an interface on one network segment, it does not travel beyond the first router, and it can be changed in software on essentially every operating system — so it is evidence about a frame, not about a device or a person. The tool takes no view on any address you paste and, since everything runs in your browser, never sees one.

Why is it free?

It is bit arithmetic on six bytes plus a set of 439 strings, and your browser does the lot as you type. No server is involved, so there is nothing to meter and no account to create.

Nothing is uploaded. The address you paste stays in this tab.