Zellio.io

OUI Lookup

Match a MAC prefix to its IEEE-assigned organisation.

Runs locallyWorks offlineShare link carries settings, never your data
Send output toSubnet CalculatorURL Parser & Query InspectorWhat Is My IP & Network TesterBuild a workflow from thisOutput stays on this page until you send it.

Frequently asked questions

What exactly is an OUI?

An Organisationally Unique Identifier — the 24-bit prefix the IEEE assigns to a manufacturer. It appears at the start of every MAC address that company issues, and each block covers roughly 16.7 million addresses.

Can one company hold several OUIs?

Yes, and large manufacturers hold many, acquired over time or through acquisitions. That is why two devices from the same brand can have completely different prefixes.

What do the locally administered and multicast bits mean?

Two flags in the first byte. The locally administered bit means the address was assigned by software rather than the manufacturer — the signature of randomisation or a virtual machine. The multicast bit marks an address meant for a group rather than one interface.

Pro tips

  • Treat a missing vendor as information: it usually means the address is randomised, not that the lookup failed.
  • Check the individual/group bit before chasing an unfamiliar address — multicast and broadcast traffic uses addresses no device owns.
  • Use the vendor name to triage an unknown device on a home network; the manufacturer is often enough to recognise the smart plug you forgot about.
  • Do not rely on MAC filtering as a security control. Addresses are trivially spoofed, and randomisation means legitimate devices change theirs.
  • The Modified EUI-64 output is what you want when tracing how an IPv6 interface identifier was derived from hardware.

About MAC Address Analyzer

A locally administered bit is what phone MAC randomisation sets, which is why a vendor lookup returns nothing for many devices on a network scan. That is the feature working as intended rather than a failed lookup.

Look up an OUI — the first three bytes of a MAC address — against the IEEE registry to find the organisation it was assigned to. It runs entirely in your browser.

Every network interface has a 48-bit MAC address whose first 24 bits — the OUI (Organizationally Unique Identifier) — are assigned by the IEEE to a specific manufacturer. This analyzer looks that OUI up against the full IEEE registry to name the vendor, then decodes the rest of the address: it splits the OUI and NIC portions, reads the individual/group bit to tell you whether the address is unicast or multicast, and reads the universal/local bit to show whether it is universally administered (UAA, burned in) or locally administered (LAA, software-set).

It also normalises the address into every common notation — colon, hyphen, Cisco dot and bare — and derives the Modified EUI-64 interface identifier used in IPv6. The IEEE vendor database is fetched only when this tool is opened, so no other page pays for it.

The vendor lookup fails for a growing share of devices, and that is a privacy feature rather than a fault. Because a fixed hardware address let anyone track a phone as it passed within range of WiFi scanners, iOS and Android now present a different randomised address to each network. A randomised address sets the locally administered bit, so the analyser reports LAA and no manufacturer — which is the correct answer, and the reason MAC-based access control lists are no longer a dependable way to manage devices.

One structural point is worth holding on to: a MAC address does not travel beyond the local network segment. Routers rewrite the layer-two addressing at every hop, so the address a remote website sees is not yours and cannot be. That makes these addresses useful for auditing what is attached to your own network, and useless as a way for anyone on the internet to identify a particular machine.

Common use cases

  • Resolving a vendor prefix seen in a packet capture
  • Building an inventory of hardware vendors from ARP tables
  • Checking whether an address is manufacturer-assigned or randomised
How it comparesNetwork scanners such as Fing or nmap discover devices and look up vendors in one pass, which is what you want for surveying a whole network. This is the single-address version: paste one you already have and get the full decode without installing anything.