Security · 58 tools · nothing uploads

MAC / OUI vendor lookup

Look up a MAC address's OUI against a small bundled table of 16 well-known prefixes, not the IEEE registry (2.9M+ entries, updated continuously, no offline way to bundle it here). "Not in bundled list" means exactly that, not "no vendor exists."

Options

live

MAC / OUI vendor lookup takes a MAC address and prints it in colon form, its first three bytes as the OUI, and the vendor those bytes belong to. Where the locally-administered bit is set the lookup is skipped, since such an address came from no vendor block. The bundled table holds 16 prefixes, so unlisted means unlisted.

Questions

Where does the vendor data come from?

A small table bundled with the site, currently 16 OUIs, hand picked for being well documented and stable. It is not the IEEE registry, which is a multi megabyte, continuously updated file with millions of entries and no offline way to ship it here. The tool blurb and its output both say so.

Why is my device vendor not listed?

Almost always because it is not in those 16 entries. The output says "not in this tool's bundled table of 16 OUIs", which means exactly that and not that no vendor owns the prefix. The bundled set leans towards virtualization vendors such as VMware, VirtualBox, Hyper-V, Xen and QEMU, plus Cisco, Intel, Raspberry Pi, Sun and Google.

Why does it skip the lookup for some addresses?

Because the locally administered bit is set. That address was not assigned from a vendor OUI block at all, so a vendor answer would be meaningless. The tool says the bit is set and stops, rather than reporting a coincidental table hit.

What else does it print?

The MAC in colon notation, the OUI as its first three bytes in colon notation, the vendor line, and a note when the multicast bit is set saying the address is a group address rather than a single interface. That last one comes from the address bits, so it is right regardless of the table.

Can I search the full IEEE list here?

No, and no request is made to look one up. If the prefix is not in the bundled table you will need the IEEE registry or another source. For pure reformatting and the address bits, use the MAC address formatter.

Related Security tools

·→1Subnet / CIDR calculatorCompute network address, broadcast/last address and host count for an IPv4 or IPv6 CIDR block. Pure arithmetic on the address you give it. No lookup, no network.Takes no file·→1IP range parserParse an IPv4/IPv6 range ("start-end" or CIDR) into its address count and the minimal set of CIDR blocks that cover it exactly. Pure arithmetic, no lookup.Takes no file·→1IPv4/IPv6 format convertShow one IP address in every common representation (dotted/expanded, integer, and hex), computed locally.Takes no file·→1IPv6 transition addressesBuild IPv4-mapped/6to4/NAT64 IPv6 forms from an IPv4 address, or decode an IPv6 address back to its embedded IPv4 (and, for Teredo, server/client/port/flags). Reports what pattern was recognised, not whether the address is reachable or in use.Takes no filen→nIPv4 / TCP / UDP header parserDecode an IPv4 header, then its TCP or UDP header if the protocol field says so (checksum verified against the standard Internet checksum, not TCP/UDP's, which need a pseudo-header this tool is not given the source context to build). Give it bytes starting at the IP header, e.g. an Ethernet frame's payload.Runs on each file you dropn→nEthernet frame parserDecode an Ethernet II frame: destination/source MAC, EtherType (unwrapping one 802.1Q VLAN tag if present), and payload length. IEEE 802.3 LLC/SNAP framing is not handled, only Ethernet II.Runs on each file you dropn→nTLS record parserDecode a raw TLS record (RFC 8446 §5.1): content type, version, length, and for a ClientHello/ServerHello, the cipher suites/extensions inside. Give it bytes captured off the wire, not a PEM.Runs on each file you drop·→1MAC address formatterReformat a MAC address between colon, dash, Cisco dot-quad and bare-hex notation, and report the multicast/locally-administered bits.Takes no file