MAC inspector
One address, deep: strict format parsing, U/L and I/G bits, randomized address detection, IEEE block and registrant, EUI-64 and IPv6 link-local.
Enter an address above or pick an example.
What this tool does
The MAC inspector takes one hardware address and explains everything that can be read from it without touching the network. It parses the address strictly, reads the two flag bits in the first octet, looks the prefix up in a snapshot of the IEEE registries, and derives the other forms you might need: the Cisco dotted form, the EUI-64, the IPv6 link-local address and so on. The page title says analyzer rather than lookup on purpose: the registrant is one line in the result, not the point of it.
How it works
A MAC address is 48 bits, written as six octets. The least significant bit of the first octet is the I/G bit: 0 means an individual (unicast) address, 1 means a group (multicast) address. The next bit is the U/L bit: 0 means universally administered, so the first three octets came from an IEEE assignment, and 1 means locally administered, so software or an administrator chose the address. Because the bits are the low bits of the first octet, a locally administered unicast address always has a second hex digit of 2, 6, A or E.
The IEEE sells address blocks in three sizes. MA-L (the classic OUI) is 24 bits and gives the registrant 16.7 million addresses; MA-M is 28 bits and MA-S is 36 bits. Older IAB blocks are the same size as MA-S and were issued from a few IEEE owned prefixes, which is why an address starting with 00-50-C2 or 70-B3-D5 may resolve to a small company rather than to the IEEE itself. The lookup checks the narrowest table first so a nested assignment wins over its parent. CID blocks are company identifiers for use in locally administered space; a CID match never means a factory produced the hardware.
Parsing is strict. The input must match one anchored format; characters are never stripped to force a match, and the result says which format was recognised. That is how an IPv4 address, a hash or a UUID is refused instead of silently turning into a nonsense lookup.
How to read the result
The summary strip gives the canonical colon form and the three verdicts: universally or locally administered, unicast or multicast, and whether the address looks randomized, belongs to a known virtual interface range, or is a well-known reserved address. The bit block shows the first octet in binary with the two flag bits marked. The assignment block names the registrant, the country from the registry record, the registry type and the exact range of the block. The derived forms are each copyable and link onward to the tool that takes them next.
Limitations
- A locally administered address does not identify a manufacturer, even when the digits happen to match a registered prefix. Phones and laptops randomize their Wi-Fi address per network, so the randomized verdict is an inference from one bit, not proof.
- The registrant and country come from the IEEE record. They say who bought the block, not where the device is, who owns it, or what product it is.
- The dataset is a snapshot. New assignments and transfers appear when the snapshot is refreshed; the version is shown in the footer and in the JSON export.
Related guides
Guides on randomized MAC addresses, EUI-64 and IPv6 link-local derivation, and the IEEE registry types are in the guides section.