How to Identify a Device from a MAC Address

What a MAC address can reveal

A Media Access Control address identifies an interface on a local network segment. For a universally administered address, its leading bits may match a block registered through the IEEE Registration Authority. A lookup can therefore identify the organisation holding that prefix.

The registered organisation may be the device manufacturer, a component supplier, a contract manufacturer or a company acquired by the current brand. A lookup does not reveal a person, a device serial number, its exact model or its present owner.

1. Collect the complete address

Copy all 12 hexadecimal digits when possible. Switch tables, ARP caches, DHCP leases, wireless controllers and endpoint-management tools often use different separators, but these examples represent the same address:

• 00:1B:2C:3D:4E:5F
• 00-1B-2C-3D-4E-5F
• 001B.2C3D.4E5F
• 001B2C3D4E5F

Record where and when you observed it. A switch port and VLAN, access-point name, IP address and DHCP timestamp are often more useful than the vendor result alone.

2. Check the address type

Inspect the U/L bit before trusting a vendor match. Phones, laptops and tablets commonly use a locally administered address for Wi-Fi privacy. Hypervisors, containers and network appliances also create local addresses. In those cases, the visible prefix may have no relationship to the physical interface manufacturer.

The separate I/G bit marks an individual or group address. Multicast addresses describe a destination group rather than one device. Our address-bit guide shows how to distinguish these cases.

3. Perform the vendor lookup

Enter the address in the single lookup tool. The service checks the most specific available IEEE assignment: 36-bit MA-S, then 28-bit MA-M, then a 24-bit MA-L or CID record. This matters because a broad 24-bit assignment can contain a more specific allocation registered to another organisation.

A “vendor not found” result can mean the prefix is new, private, mistyped or outside the installed source data. Confirm the address before treating an unsuccessful lookup as suspicious.

4. Correlate the result

Use at least one independent source before deciding what the device is:

• Switch forwarding table: identifies the physical port or uplink where the address was learned.
• ARP or neighbour table: connects the MAC address to an IP address on the same routed segment.
• DHCP lease: may provide a hostname, client identifier, lease time and requested options.
• Wireless controller: can show an access point, SSID, signal history and authentication identity.
• DNS and inventory: can connect the IP or hostname to an approved asset record.

Be careful around routers and proxies. An ARP table normally shows the next local-hop interface, not the MAC address of a remote internet host. Likewise, a switch may learn many addresses on a trunk, virtualisation host or wireless uplink.

5. Verify safely

For an authorised network, confirm the switch port description, authentication session or asset database. Avoid disconnecting an unknown device merely because its vendor name looks unfamiliar: building controls, phones, printers and embedded controllers often use modules registered to a component supplier.

Document the observation and the evidence used. If a device remains unexplained, normal incident-response procedures such as a restricted VLAN, packet capture or owner verification provide stronger evidence than repeated vendor lookups.