MAC Address Randomisation: How Each Platform Behaves
A decade ago a phone's WiFi adapter exposed the same MAC address everywhere it went. A shopping centre only had to scatter sniffers around to reconstruct a visitor's route from that one identifier. To close that hole, the major platforms introduced MAC address randomisation. It is a clear win for privacy, and a practical nuisance for network administration. The full background on tracking is in the privacy implications of MAC addresses.
Randomisation happens in two phases
Scanning. When a phone looks for available networks it broadcasts probe requests. Source addresses in this phase have been randomised for years, and usually change on every scan, which is aimed squarely at passive tracking of the shopping-centre kind.
Association. The address actually used once the device joins a network. Policy here varies by platform, and this is the part that causes administrative friction.
Association address policy by platform
| Platform | Default | Address stability |
|---|---|---|
| iOS / iPadOS 14+ | On per SSID | Stable within a network, can be disabled per network |
| Android 10+ | On per SSID | Stable within a network, some builds rotate periodically |
| Windows 10/11 | Off, can be enabled globally or per network | Optional daily rotation once enabled |
| macOS 15+ | On | Offers a fixed and a rotating setting |
The key point is that on most platforms the random address is fixed per SSID. The same phone keeps one address on your home router and uses a different one on the office network. Address-based identification still works inside a single network, while cross-network tracking does not.
How to tell a random address
Look at the second hex character of the first byte. If it is 2, 6, A or E, the locally administered bit is set, which marks a random address, and a lookup on the query page will never find a vendor. The full rule is in reading the first byte of a MAC address.
This also explains a common sight: a router client list full of devices showing "unknown vendor". They are not counterfeit hardware, just ordinary phones with private addressing turned on.
What it means for network management
MAC filtering is effectively dead. It should never have been treated as a security control in the first place; randomisation just makes that obvious. See why WiFi MAC filtering is not a security measure.
Static DHCP reservations break. Handing out a fixed IP by MAC stops working once the client changes address. You need a different identifier, or the user has to disable the private address for that network.
Billing and quota systems need rework. Campus and hotel networks that treat a MAC as a user identity are hit hardest. The sound replacement is real authentication such as 802.1X, covered in 802.1X and MAC authentication bypass.
Inventory needs a new anchor. Asset registers keyed on MAC need additional fields, discussed in using MAC addresses for network inventory.
Practical advice
On a network you control, the right response is not to defeat randomisation but to accept that a MAC address is no longer a stable identity. Servers and printers that need fixed addressing do not randomise anyway, so only personal mobile devices are affected. Let those use dynamic DHCP, move identity to 802.1X or a captive portal, and the architecture ends up cleaner than before.