What a MAC address is
A MAC (Media Access Control) address is the hardware identifier burned into — or assigned to — a network interface such as a Wi-Fi radio or Ethernet port. It's 48 bits long, normally written as six pairs of hexadecimal digits, and it operates at Layer 2 of the network stack. Switches use it to deliver frames to the right device on the same local network. Unlike an IP address, a MAC address doesn't travel across the internet — it only has meaning within a single network segment.
How a MAC address is structured
The first three octets are the OUI (Organizationally Unique Identifier), which the IEEE assigns to a manufacturer — so the OUI is what lets a lookup name the vendor. The last three octets are chosen by that manufacturer to make each interface unique. Looking up the OUI above against the IEEE registry is exactly how the vendor field in the tool is resolved.
Common formats
- Colon —
3C:5A:B4:00:1A:2B(most common) - Hyphen —
3C-5A-B4-00-1A-2B(common on Windows) - Cisco / dotted —
3c5a.b400.1a2b(three groups of four) - Bare —
3c5ab4001a2b(no separators)
They all encode the same 48 bits; the separators are purely cosmetic, which is why the tool accepts any of them.
The two special bits in the first octet
The very first byte carries two flags worth knowing about:
Unicast vs. multicast (the I/G bit)
The least-significant bit of the first octet is the Individual/Group bit. If it's 0 the address is unicast (one specific interface); if it's 1 it's multicast (a group). Addresses like 01:00:5E:… are multicast.
Universal vs. local (the U/L bit)
The next bit indicates whether the address is universally administered (assigned from a real vendor OUI) or locally administered (set by software). A locally administered address won't match any vendor — which is the giveaway that you're looking at a randomized or virtual MAC.
MAC randomization & privacy
To stop networks from tracking devices by their permanent MAC, modern phones and laptops generate a random, locally administered address — often a different one per Wi-Fi network. If a vendor lookup comes back empty and the tool reports the address as locally administered, that's usually why.