Look up the organisation registered to a MAC address block using Wireshark's public vendor database. MA-L, MA-M and MA-S blocks use 24-, 28- and 36-bit prefixes; enter a complete MAC address for the most specific match. Results identify registrations, not device models or owners.
MACsec (IEEE 802.1AE) is the Ethernet link-layer encryption standard. Enterprise deploymen…
The headline feature of Wi-Fi 7 (IEEE 802.11be) is Multi-Link Operation (MLO). Marketing s…
MAC randomization has been the most important client-side privacy defense in mobile networ…
Over the past few years Apple has pushed client-side MAC randomization aggressively: rando…
A log message says MACFLAP, MAC move, or that one MAC address is moving between two ports.…
Capture traffic on a switch uplink and Wireshark suddenly adds a line called 802.1Q Virtua…
Dell prefixes are used on computers and servers. A Dell system may also contain a network interface registered to Intel or another component supplier.
Apple registers address blocks used across its computers and mobile devices. A matching prefix identifies the registered interface vendor, but cannot identify an iPhone or Mac model.
VMware address blocks are associated with virtual network adapters. Their presence may help explain a virtual interface, but manually assigned addresses can use other prefixes.
Huawei registers prefixes for networking and consumer hardware. Use a lookup alongside your switch or wireless inventory; the prefix alone cannot distinguish a phone from network infrastructure.
TP-Link prefixes appear on routers and other network interfaces. One router can have several addresses for LAN, WAN and wireless interfaces; the lookup does not identify which role an address serves.
Intel supplies wired and wireless network interfaces used by many computer brands. An Intel match identifies the interface registration, rather than the brand of the complete computer.
Realtek supplies network interface chips to many hardware manufacturers. A Realtek match can identify a component supplier even when the device carries a different brand.
Cisco prefixes occur on routing, switching and wireless equipment. A switch may expose different addresses for its physical interfaces and logical interfaces; a prefix match alone does not reveal its model.
ASUSTeK registrations occur on computer and networking interfaces. Component suppliers can have separate registrations, so the address may differ from the brand printed on the device.
Hewlett-Packard registrations include historical address blocks. The registry name may reflect the original allocation rather than a current product brand.
Samsung registers blocks for its network interfaces. Privacy features can replace a hardware address with a locally administered one, so a phone may not resolve to Samsung while using Wi-Fi.
H3C registers prefixes used by networking interfaces. Use switch, wireless or asset records to identify the exact device after the registry lookup.
A lookup identifies the organisation registered to the matching address block. It cannot reveal the exact model, serial number, location or owner. The registrant may be a component supplier rather than the device brand.
Read full article →Yes, for ordinary 24-bit MA-L blocks. MA-M and MA-S registrations use 28- and 36-bit prefixes, so six digits may identify only a parent block. Enter the complete 12-digit MAC for a more specific match.
Read full article →A locally administered or randomised address cannot reliably identify a manufacturer. Missing allocations, an outdated database or malformed input can also cause no match. Check the address type and use the original hardware address when appropriate.
Read full article →Colon (40:6C:8F:18:2C:03), hyphen (40-6C-8F-18-2C-03), dotted (406c.8f18.2c03) and unseparated hexadecimal forms are supported, case-insensitive. You can also enter a 6-, 7- or 9-digit registered prefix.