Locally Administered vs Multicast MAC Addresses

Two low-order bits in the first octet describe different properties. Reading them separately prevents common vendor-lookup mistakes.

The first octet

Take 02:00:00:12:34:56. The first octet is hexadecimal 02, which is binary 00000010. When transmitted on Ethernet, the low-order bits have defined meanings:

I/G bit, value 1: distinguishes an individual address from a group address.
U/L bit, value 2: distinguishes universal administration from local administration.

The bits are independent. An address can be universal and individual, local and individual, universal and group, or local and group.

Second hexadecimal character	I/G bit	U/L bit	Interpretation
`0, 4, 8, C`	0	0	Universally administered unicast
`2, 6, A, E`	0	1	Locally administered unicast
`1, 5, 9, D`	1	0	Universally administered multicast
`3, 7, B, F`	1	1	Locally administered multicast

Locally administered addresses

Setting the U/L bit tells the local network that the address was assigned outside the normal globally registered allocation process. It does not mean the address is invalid. Common sources include virtual machines, containers, clustered services, manually configured interfaces and operating-system privacy features.

For a locally administered unicast address, the second hexadecimal character is 2, 6, A or E. Examples include 02:00:00:12:34:56 and DA:A1:19:00:00:01. Looking up their first six digits in an OUI table can produce a coincidental or misleading result, so the lookup tools identify the local condition first.

Randomised Wi-Fi addresses

Modern client devices can generate a different local address for each wireless network, and some change it periodically. This reduces passive tracking between networks. The address may remain stable for one saved SSID while differing from the interface’s factory address.

A randomised address does not normally reveal the hardware manufacturer. To identify an authorised device, use evidence such as the wireless authentication identity, device-management record, DHCP hostname or user confirmation rather than trying to reverse the random prefix.

Multicast addresses

Setting the I/G bit creates a group destination. Ethernet multicast is used by protocols including IPv4 multicast, IPv6 neighbour discovery and many service-discovery systems. A switch can forward frames for that group to several interested ports.

Multicast addresses should not be treated as individual endpoints. For example, the well-known IPv4 multicast mapping begins 01:00:5E. Seeing that address in packet data describes group traffic, not a physical interface made by a vendor called out by an ordinary device lookup.

A quick calculation

Remove the separators and convert the first two hexadecimal characters to a number. Test first_octet & 2 for local administration and first_octet & 1 for a group address. These independent masks are safer than memorising a few prefixes.

first_octet = int(mac_address[0:2], 16)
is_multicast = bool(first_octet & 0x01)
is_locally_administered = bool(first_octet & 0x02)

What to do with the result

For universal unicast addresses, continue with a longest-prefix registry lookup. For local unicast addresses, correlate network and authentication records. For multicast addresses, identify the protocol or group mapping instead of searching for an endpoint manufacturer.