Every network interface (Wi-Fi card, Ethernet chip, Bluetooth radio) ships with a globally unique MAC address assigned by the manufacturer. The first 24 bits — the OUI (Organizationally Unique Identifier) — encode the vendor. IEEE keeps a public registry of which company owns which OUI, and that's how we can tell Apple traffic from Cisco traffic just by looking at an address.
Use cases
- Network audit — identify rogue devices on a LAN.
- DHCP log analysis — see which brand of phone connected to your AP.
- Forensics — correlate captured traffic to device vendors.
FAQ
Why does the lookup sometimes fail? Some OUIs are unallocated, private (locally administered addresses), or assigned after the registry was last updated. Randomised MACs on modern phones also won't resolve to a real vendor.
Can a MAC be changed? Yes — all major OSs allow MAC spoofing. iOS, Android and Windows randomise MACs by default when scanning for Wi-Fi networks for privacy.
Are MAC addresses routable? No. They only identify devices inside a single layer-2 segment. Routers strip and rewrite them at each hop.