Reading the First Byte of a MAC Address: the U/L and I/G Bits

Two flag bits live in the first byte of every MAC address. They determine whether the address was burned in by the manufacturer or generated by software, and whether a frame is destined for one device or a group. Once you can read them, you can classify most addresses at a glance.

Where the flags sit

The two lowest bits of the first byte are flags. Only the remaining six bits contribute to the vendor identifier:

First byte:  b7 b6 b5 b4 b3 b2 b1 b0
                                │  └── I/G bit (least significant)
                                └───── U/L bit (second least significant)

"Least significant" here refers to numeric weight. When the address is written in hex, both bits land in the second hex character of the first byte, the 2 in 02.

The I/G bit: unicast or multicast

A zero means individual, or unicast, and the frame is intended for a single adapter. A one means group, or multicast, and switches forward it to a set of receivers.

So deciding whether an address is multicast is just a matter of checking whether the first byte is odd or even. The first byte of 01:00:5E:... is 0x01, which is odd, and that range is indeed where IPv4 multicast is mapped. FF:FF:FF:FF:FF:FF is all ones, so broadcast is simply a special case of multicast. See how multicast MAC addresses are mapped for details.

The U/L bit: universal or locally administered

A zero means universally administered. The address was allocated by the IEEE to a vendor, should be unique worldwide, and can be traced to a manufacturer. A one means locally administered. The address was generated by local software, the IEEE guarantees nothing about it, and no vendor lookup will succeed.

Combining both bits gives a quick reading of the second hex character:

One shortcut is worth memorising: if the second character is 2, 6, A or E, do not bother looking it up. There is no vendor to find.

Where you actually meet locally administered addresses

The WiFi privacy features in current phones generate a random MAC per network, and those addresses always have the U/L bit set. So when your router's client list shows something like DA:A1:19:..., that is randomisation at work rather than a vendor called "DA:A1:19". See MAC address randomisation for how it works.

Hypervisors also use locally administered addresses at times, and they are common on container networks and bridge interfaces. When you change an adapter's MAC by hand, the correct practice is likewise to set the U/L bit so you cannot collide with a real device.

What this means for lookups

If you enter a locally administered address on the lookup page and get no result, that is not a gap in the database. Addresses of that kind fall outside the IEEE allocation space entirely. Seen the other way round, a failed lookup is often useful information: it suggests the other end has randomisation enabled or is using a virtual interface.