Guide
Why a phone shows different MAC addresses
A changing MAC address can be normal privacy behavior. The address bits and a vendor lookup answer narrower questions than device identity.
Why the address changes
A device needs a link-layer address to use a Wi-Fi network. A fixed hardware address can let observers correlate the same device across networks. Modern operating systems can use a private address for a particular network instead. Apple describes fixed and rotating private-address modes; Android describes persistent per-network and, in some cases, non-persistent modes. The exact rotation schedule depends on the platform, network and settings. A new address is therefore not, by itself, evidence that a new device joined.
Read the first octet
In the first octet, mask 0x02 is the universal/local bit. A set bit means the address is locally administered. Mask 0x01 is the individual/group bit; a normal client address is individual. Android's randomized client addresses set the local bit and clear the group bit. Those two bits give a useful clue, but they do not prove randomness: an administrator can assign a local address, virtual interfaces can use one, and IEEE also defines structured local address space.
A registry lookup identifies an organization that received an address block, not the maker or current user of a device. When the local bit is set, matching the visible prefix to an IEEE block is especially weak evidence. A private address might be different on two networks and might later rotate on the same network. Avoid using a single MAC as a permanent person or asset key.
What to do in an inventory
Record the network and observation time alongside the address. If a managed asset needs a stable identity, use an authenticated inventory ID or a management record rather than assuming a Wi-Fi address will persist. MAC inspector shows the address format, the two bits and any covering assignment with its caveats. Bulk MAC keeps unregistered and locally administered addresses visible in a larger export.