MAC Address Validator

MAC address validation: 48 bits, hex notation and OUI lookup

A MAC (Media Access Control) address is the 48-bit identifier burned into every network interface — Ethernet, Wi-Fi, Bluetooth — and used by the link layer to deliver frames inside a local segment. It is independent of the IP address: an IP can change when you connect to a different network, the MAC normally stays. Standardised by IEEE 802 as EUI-48, the format pre-dates the modern Internet and is still everywhere in DHCP servers, captive portals, firewalls and network audits.

Validating a MAC means confirming it has exactly 12 hexadecimal digits arranged in one of the accepted notations. It does not tell you whether the address is real, currently assigned, or actually present on your network — those checks require ARP, DHCP logs or vendor lookups.

Accepted notations

The 48 bits are written as six octets of two hex digits each (12 hex digits total). The same address can appear in several equivalent forms:

• IEEE / Unix: colon-separated, lowercase by convention — aa:bb:cc:dd:ee:ff.
• IEEE / Windows: dash-separated, uppercase — AA-BB-CC-DD-EE-FF.
• Cisco: three groups of four digits separated by dots — aabb.ccdd.eeff.
• Bare: no separator at all — AABBCCDDEEFF.

A general-purpose regex covering colon and dash forms is ^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$. For Cisco format and bare 12-character form you need additional patterns. Convention is uppercase, but virtually every parser is case-insensitive — accept both. Be strict about which separator is used: mixing colons and dashes in the same address (aa:bb-cc:dd:ee:ff) is malformed.

Unicast, multicast, broadcast — what the first byte tells you

The two least-significant bits of the very first octet carry administrative meaning:

• I/G bit (least-significant of byte 0): 0 = unicast, 1 = group/multicast. Multicast MACs start with the byte 01, 03, 05, ..., FF.
• U/L bit (second-least-significant of byte 0): 0 = universally administered (assigned by the vendor), 1 = locally administered (LAA — set by software, randomisation, virtual machines).
• Broadcast: FF:FF:FF:FF:FF:FF — all 48 bits set, special case of multicast meaning "every device on this segment".

OUI: the first three bytes identify the vendor

The first 24 bits of a universally administered MAC are the OUI (Organisationally Unique Identifier), assigned by the IEEE Registration Authority for a one-time fee. The remaining 24 bits are picked by the vendor — usually a serial number — giving each vendor 16,777,216 possible addresses per OUI. The IEEE keeps the public registry at standards-oui.ieee.org/oui/oui.txt; web mirrors include wireshark.org/tools/oui-lookup.html and macvendors.com. Some well-known OUIs: 00:1A:2B Cisco, 3C:5A:B4 Apple, F0:18:98 Apple, B8:27:EB Raspberry Pi Foundation.

EUI-64 extends EUI-48 to 64 bits and is used by IPv6 SLAAC (Stateless Address Auto-Configuration): the host derives an IPv6 interface identifier by inserting FF:FE in the middle of the MAC and flipping the U/L bit. RFC 7217 / 8064 later recommended using randomised opaque identifiers instead, for privacy.

Privacy: MAC randomisation

Since iOS 14 (2020) and Android 10 (2019), mobile devices generate a different random MAC per Wi-Fi network by default — the U/L bit is set, so you can recognise these as locally administered. Windows 10 also supports per-network MAC randomisation. This breaks legacy captive portals that pin sessions to the MAC and forces network operators to use modern identification (per-user PSK, 802.1X, Passpoint). For validation purposes nothing changes: a random LAA is still a syntactically valid MAC.

FAQ

Is MAC notation case-sensitive?

By convention upper or lower case are both accepted; parsers are case-insensitive. Display style is a stylistic choice — IEEE prefers uppercase, Linux ip link shows lowercase.

Difference between broadcast and multicast MAC?

Broadcast is the single address FF:FF:FF:FF:FF:FF — all 48 bits set, "every device on the segment". Multicast is any address whose first byte has the I/G bit set (least-significant bit = 1) and targets a specific group, e.g. IPv4 multicast 01:00:5E:xx:xx:xx or IPv6 multicast 33:33:xx:xx:xx:xx.

Are randomised MACs valid?

Yes. They have the U/L bit set to 1, marking them as locally administered. Modern phones generate one per SSID for privacy and they are perfectly valid MAC addresses.

Can I block a device by its MAC forever?

No. MAC randomisation defeats MAC-based bans, and a determined user can change the MAC on most operating systems with a single command (ip link set dev wlan0 address xx:xx:xx:xx:xx:xx). MAC filtering is a courtesy mechanism, never a security control.