What Is a MAC Address? How OUI Vendor Lookup and Hardware Addressing Work

1. What Is a MAC Address and Where Does It Live?

In the Open Systems Interconnection (OSI) 7-layer model, communications are partitioned into abstraction tiers. While IP addresses operate at Layer 3 (Network Layer) to route packets across global networks, MAC (Media Access Control) addresses operate at Layer 2 (Data Link Layer) to deliver Ethernet frames across local physical wires and Wi-Fi airwaves.

Every Network Interface Card (NIC)—whether an Ethernet port, Wi-Fi antenna, or Bluetooth chip—possesses a hardware address permanently burned into its ROM by the manufacturer. This identifier is formally known as an EUI-48 (Extended Unique Identifier 48-bit) address.

2. The Anatomy of a 48-Bit MAC Address: OUI vs. Device Serial

A standard MAC address comprises 48 bits (6 bytes), typically represented as 12 hexadecimal characters separated by colons or hyphens (for example, F0:18:98:A1:B2:C3).

The 48 bits are divided into two equal halves:

1. First 24 Bits (Octets 1 to 3): The Organizationally Unique Identifier (OUI). Hardware vendors (such as Apple, Cisco, Intel, Samsung, or Raspberry Pi) purchase these registered prefixes from the Institute of Electrical and Electronics Engineers (IEEE) to ensure global uniqueness.

2. Final 24 Bits (Octets 4 to 6): The Network Interface Controller Specific Identifier. The manufacturer assigns these numbers sequentially to produce unique hardware chips.

MAC Address:   F0 : 18 : 98  :  A1 : B2 : C3
               └───────────┘    └───────────┘
                 OUI Prefix      Device NIC ID
              (Apple Inc. OUI)    (Serial Number)

3. Unicast vs. Multicast: The I/G Bit

Deep within the first byte of a MAC address reside two special architectural flags:

- The Individual / Group (I/G) Bit: The least significant bit (Bit 0) of the very first octet determines frame destination scope. If this bit is 0, the frame is Unicast (intended for a single recipient NIC). If this bit is 1, the frame is Multicast or Broadcast (intended for all listening devices on the local VLAN).

- For example, the universal Ethernet broadcast address FF:FF:FF:FF:FF:FF has its I/G bit set to 1, instructing Ethernet switches to flood the frame out of every switchport.

4. Universally Administered vs. Locally Administered (U/L Bit)

The second least significant bit (Bit 1) of the first octet is the Universal / Local (U/L) bit:

- Globally Unique (Bit = 0): Indicates an authentic hardware burned-in address registered with the IEEE OUI registry.

- Locally Administered (Bit = 1): Indicates that the MAC address has been customized by network software, created by a virtual machine hypervisor (VMware, VirtualBox), or randomized by a mobile operating system.

To protect user privacy from Wi-Fi tracking in shopping malls and airports, iOS and Android automatically generate randomized locally-administered MAC addresses when connecting to wireless hotspots.

5. How to Find Your MAC Address Across Operating Systems

You can find the physical MAC address of your device using these quick operating system commands:

# Windows (Command Prompt):
getmac /v
# or
ipconfig /all

# macOS / Linux (Terminal):
ifconfig en0
# or
ip link show