MAC OUI (Vendor) Validator

OUI lookup: identifying the manufacturer behind a MAC address

An OUI (Organizationally Unique Identifier) is the first 24 bits of a MAC address — the three leading octets — that identify the device manufacturer. The IEEE Registration Authority assigns OUIs for a one-time fee (currently about USD 3,000 for an MA-L block); the holder is then free to combine those bits with any of 2²⁴ = 16,777,216 lower-order combinations to mint unique MAC addresses for its products. Validating an OUI means looking up those three bytes in the IEEE public registry and returning the company name.

OUI lookup powers tools you use every day: Wireshark resolving "Apple, Inc." in a packet capture, your router showing "Samsung Galaxy" in the DHCP client table, antifraud systems flagging mismatches between expected and actual hardware, network audit suites (Lansweeper, ManageEngine, NetBrain) generating inventories automatically.

Famous OUIs you will see in the wild

• 00:50:56, 00:0C:29, 00:05:69 — VMware (virtual machine NICs)
• 08:00:27 — Oracle VirtualBox
• 52:54:00 — QEMU / KVM (locally administered range used by libvirt)
• 00:1A:11, 00:1B:0D, 00:23:04 — Cisco Systems
• 3C:5A:B4, 60:F8:1D, F0:18:98 — Apple, Inc.
• 9C:8E:CD, 00:15:5D — Microsoft (Hyper-V virtual NICs)
• B8:27:EB, DC:A6:32 — Raspberry Pi Foundation
• 00:11:32, BC:5F:F4 — Synology

Brazilian operators occasionally allocate OUIs to their own hardware brands. Examples include 8C:1F:64 (NETSURF / Brazil) and several BC:01:01 blocks assigned to local engineering firms — the IEEE site lists each.

OUI is not the only block: MA-S, MA-M, MA-L and CID

The IEEE actually issues several block sizes:

• MA-L (Multi-address Large) — the classic 24-bit OUI, 16M addresses per assignee.
• MA-M (Medium) — 28-bit prefix, ~1M addresses, cheaper for niche vendors.
• MA-S (Small) — 36-bit prefix, only 4,096 addresses, ideal for IoT startups.
• CID (Company ID) — used when uniqueness is not required (e.g. locally administered groups).

For MA-M and MA-S you cannot identify the vendor by reading just the first 3 bytes — the full prefix length must be matched against the IEEE registry. A good lookup tool checks all three lists.

Where to get the OUI database

The IEEE publishes the registry as plain CSV and text files: standards-oui.ieee.org/oui/oui.csv, oui28.csv and oui36.csv. They are updated several times a week. Public mirrors and APIs include wireshark.org/tools/oui-lookup.html (web tool with downloadable manuf file) and macvendors.com (free JSON API with rate limits). NPM packages such as oui-data, oui and macaddress wrap the same data offline. Brazilian regulator ANATEL does not issue OUIs — every Brazilian-made router or set-top box still has to register with the IEEE in the US.

Privacy: MAC randomization and locally administered addresses

Since iOS 14 (2020) and Android 10 (2019), phones generate a random MAC per Wi-Fi network. The U/L bit of the first byte is set to 1, marking the address as locally administered. These randomized MACs do not point to a real manufacturer — the "OUI" portion is meaningless. A good lookup tool should detect the U/L bit and report "Locally administered / randomized" instead of guessing a vendor. This breaks legacy presence-detection systems that pinned identities to a MAC.

FAQ

Is OUI lookup free?

Yes. The IEEE registry is published as a free public CSV; you can also use free APIs like macvendors.com (with rate limits) or download the Wireshark manuf file for offline use. Only the registration of a new OUI costs money — looking one up is always free.

Can an OUI change owner?

No. Once assigned, an OUI is permanent — even if the company is acquired or goes out of business. That is why you still see old names like "Digital Equipment Corporation" or "3Com" in modern databases. New owners get a brand-new OUI.

Do randomized MACs have an OUI?

Technically yes — the first three bytes still exist — but they do not point to a real manufacturer. The U/L bit is set to 1, meaning locally administered. A correct lookup tool reports "Random / LAA" and refuses to guess a vendor.

Why does my virtual machine MAC start with 00:50:56?

That is one of VMware's OUIs. VirtualBox uses 08:00:27, Hyper-V uses 00:15:5D, and QEMU/KVM commonly uses the locally administered range 52:54:00. Knowing those prefixes is useful when auditing a network for unauthorised virtual machines.