Bulk MAC
Paste ARP tables, switch output, DHCP leases or CSV; every address is extracted, annotated with its registrant and block type, and exported as CSV or JSON.
What this tool does
Bulk MAC takes any text that happens to contain hardware addresses, pulls every complete address out of it, and annotates each one with its IEEE registrant, registry type, country, occurrence count and the bit flags that say whether it is locally administered, multicast or probably randomized. The result is a table on the page and a CSV or JSON file you can keep. Typical inputs are ARP caches from Linux, macOS and Windows, a switch's show mac address-table, DHCP lease files, nmap and Wireshark exports, inventory spreadsheets and firewall logs.
How extraction works
The extractor recognises four spellings: colon separated (3c:22:fb:9a:12:34), hyphen separated (3C-22-FB-9A-12-34), Cisco dotted (3c22.fb9a.1234) and bare twelve or sixteen digit hex. Each pattern needs a boundary on both sides, so an address glued to other hex is not split out of it. IPv4 addresses never match because they are decimal with dots in the wrong places. IPv6 literals are skipped as a whole, so the six-octet run insidefe80::3e22:fbff:fe9a:1234 is not reported as a MAC. Hashes, UUIDs and timestamps are longer or shaped differently and are excluded by the boundary rules; a bare run of twelve digits with no letter is treated as a number, not an address. Sixteen digit EUI-64 values are included by default and can be switched off.
Dedupe, which is on by default, collapses repeated addresses into one row with an occurrence count and the line where the address first appeared. With dedupe off, every occurrence gets its own row in input order. The output case option only changes how addresses are printed; matching is case insensitive.
How to read the result
The summary strip counts lines scanned, addresses found, unique addresses, how many look randomized and how many have no registered assignment. In the table, the organisation column is the IEEE registrant for the narrowest block that contains the address, so nested MA-S and IAB assignments show the small company, not the IEEE parent. Locally administered addresses show no organisation because their prefix is not an assignment, even if the digits match one. The flags column carries the same verdicts the MAC inspector gives, and every address links to it for the full explanation.
Privacy and limits
Everything runs in your browser, including reading a loaded file. The only network requests are for static slices of the IEEE dataset, fetched by the first three octets, so the server never sees a complete address. Inputs are processed in batches so the page stays responsive; a paste of tens of thousands of lines shows progress and can be cancelled. The table on the page stops at 2,000 rows, the exports include every row, and extraction stops at 50,000 addresses.
Related guides
See the guides section for reading ARP tables and switch MAC tables, and for what randomized addresses mean for network inventories.