A MAC address (Media Access Control address, IEEE 802-2014) is a 48-bit hardware identifier assigned to every network interface — Ethernet card, Wi-Fi radio, Bluetooth chip. It’s the layer-2 address used by switches and access points to deliver frames within a local network. It plays no role in routing across the internet.
Format
d4:81:d7:2c:5f:8a
D4-81-D7-2C-5F-8A
D4.81.D7.2C.5F.8A
d481.d72c.5f8aSix pairs of hex digits — 48 bits total. Different tools use different separators.
Structure
- First 24 bits — the OUI — assigned by IEEE to the manufacturer
- Last 24 bits — assigned by the manufacturer to the specific unit
Looking up the OUI reveals the device vendor:
| OUI | Vendor |
|---|---|
00:1D:0F | Apple |
AC:DE:48 | Cisco Meraki |
F4:5C:89 | Google (Nest, Chromecast) |
B8:27:EB | Raspberry Pi Foundation |
52:54:00 | QEMU virtual |
00:0C:29 | VMware virtual |
Use the MAC address lookup tool to resolve any MAC to its manufacturer.
MAC vs IP Address
| MAC | IP | |
|---|---|---|
| Layer | Data link (2) | Network (3) |
| Scope | Local segment (Wi-Fi, Ethernet) | Global internet |
| Permanence | Usually permanent (or randomized) | Assigned per network |
| Format | 48 bits, hex | 32 bits (IPv4) or 128 bits (IPv6) |
| Used by | Switches, access points | Routers |
A single device has one MAC per interface. It can hold multiple IPs on that interface simultaneously — IPv4 + IPv6, plus aliases.
MAC Address Randomization
Modern operating systems randomize the Wi-Fi MAC per SSID to defeat cross-network tracking:
- iOS 14+ — randomizes by default, per SSID
- Android 10+ — randomizes by default, per SSID
- Windows 10/11 — configurable, off by default
- macOS Sonoma+ — randomizes on public networks
Before randomization, retailers and airports could track individual customers by watching their MAC as they wandered between access points. Randomization broke that. It also breaks MAC-based access control — enterprises now use 802.1X + certificates instead.
Where MAC Addresses Show Up
- DHCP leases — DHCP servers record MAC → IP mappings
- ARP tables — routers map local IPs to MACs
- Wi-Fi access points — connection logs, per-SSID auth
- Enterprise NAC — 802.1X port authentication
- DomainScan tools — the MAC address lookup returns manufacturer identification from any MAC
Why This Matters for Security
- Network access control — many enterprises still gate Wi-Fi by MAC allowlist. Weak against spoofing but common.
- Device inventory — MACs are the most reliable way to identify individual devices across DHCP lease renewals.
- Rogue device detection — an unfamiliar OUI on a corporate network is a signal to investigate.
- Forensics — MAC captured in DHCP logs pinpoints the exact device that held a specific IP at a specific time.
Look up any MAC’s manufacturer with the MAC address lookup tool.
Related
Check the MAC Address glossary entry, the OUI entry, and read about common port numbers — the parallel identifier for network services.
Common Questions
Can a MAC address identify me on the internet?
Not directly. MAC addresses are only visible within your local network (Wi-Fi, Ethernet segment). Routers do not forward MAC addresses; they only forward IP packets. A remote website sees your public IP (usually your ISP's NAT address), not your device's MAC. Local networks — coffee shops, employers, ISPs' own gear — can see and log MACs of connected devices. Modern OSes randomize MAC per SSID to defeat this.
What is the difference between a MAC address and an IP address?
MAC operates at layer 2 (data link) — Ethernet or Wi-Fi frames. IP operates at layer 3 (network) — routed across the internet. A device has one MAC per network interface; that MAC never changes. It has one or more IPs per interface; those change based on the network you join. MAC gets your packet across the local segment; IP gets it across the internet.
What is a locally administered MAC address?
A MAC where the second-least-significant bit of the first byte is 1. Indicates the address is assigned by software, not a hardware manufacturer. Used for VMs, containers, MAC randomization, and manual overrides. The other bit combinations indicate 'universally administered' — assigned by IEEE.
How do I find a device's manufacturer from its MAC address?
Take the first three octets (the OUI) and look them up in the IEEE OUI registry. Tools that automate this — including our MAC address lookup — return the vendor name (Apple, Cisco, Samsung, etc.). Note: if the MAC is randomized, the OUI portion is meaningless; it just decodes to 'private / locally administered'.
Can I change my MAC address?
Yes — most operating systems allow MAC spoofing. macOS: ifconfig en0 ether xx:xx:xx:xx:xx:xx. Linux: ip link set dev eth0 address xx:xx:xx:xx:xx:xx. Windows: adapter properties → Advanced tab. Modern OSes also do this automatically per Wi-Fi network as a privacy feature. Note that some enterprise networks and captive portals may disallow spoofed MACs.