How to detect a Virtual Machine by its MAC address? | FAQ | MAC Address Vendor Lookup
Frequently asked questions
? ? ?

How to detect a Virtual Machine by its MAC address?

Our MAC Address API outputs a field called macAddressDetails.virtualMachine. If it detects that a Virtual Machine is using this MAC address, it outputs its vendor name (e.g. ”VMWare”). Otherwise, it outputs “Not detected”.

To detect the Virtual Machines, we build our VM Knowledge Base, which stores information about known relations between MAC addresses and Virtual Machines, and patterns, based on which the Virtual Machines assign MAC addresses to the virtual network interfaces.

This information comes from the two sources:

  • We constantly scan the Internet for such information. It’s systemized, stored and verified.
  • Our research team installed the Virtual Machines and performed experiments, trying to identify patterns on how their network interfaces receive MAC addresses.
Virtual machine detection simplified schema

Virtual Machine’s MAC ranges

Detection rules which don't have their dedicated page yet

Virtual Machine Name OUI or range References
Red Hat Xen, XenSource, Novell Xen 00:16:3E:00:00:00 to 00:16:3E:FF:FF:FF

https://wiki.xenproject.org/wiki/Xen_Networking

https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx

https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms


Microsoft SCVMM (System Center Virtual Machine Manager) 00:1D:D8:B7:1C:00 to 00:1D:D8:F4:1F:FF

http://techgenix.com/mac-address-pool-duplication-hyper-v/

https://docs.microsoft.com/en-us/system-center/vmm/network-mac?view=sc-vmm-1807

https://blogs.technet.microsoft.com/gbanin/2014/08/27/how-to-solve-mac-address-conflict-on-hyper-v/


Microsoft Virtual PC / Virtual Server 00:03:FF:00:00:00 to 00:03:FF:FF:FF:FF

https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx

https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms/

https://blogs.technet.microsoft.com/medv/2011/01/24/how-to-manage-vm-mac-addresses-with-the-globalimagedata-xml-file-in-med-v-v1/


SWsoft 00:18:51:00:00:00 to 00:18:51:FF:FF:FF

https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx

bhyve by FreebsdF 58:9C:FC:00:00:00 to 58:9C:FC:FF:FF:FF

https://macaddress.io/statistics/company/17619

Nutanix AHV 50:6B:8D:00:00:00 to 50:6B:8D:FF:FF:FF

https://macaddress.io/statistics/company/17388

KVM (proxmox) 54:52:00:00:00:00 to 54:52:FF:FF:FF:FF

https://www.centos.org/forums/viewtopic.php?t=26739

Hetzner vServer (based on KVM and libvirt) 96:00:00:00:00:00 to 96:00:FF:FF:FF:FF Self tested

We are warmly welcoming your thoughts and suggestions with regard to this article. Please feel free to contact us!

Have questions?

We work hard to improve our services for you. As part of that process we welcome your feedback, questions and suggestions. Please let us know your thoughts and feelings, and any way in which you think we can improve our product.

Shoot us an email to support@macaddress.io or just fill in the contact form.

The data was just refreshed