How to detect a Virtual Machine by its MAC address? | FAQ | MAC Address Vendor Lookup
Frequently asked questions

How to detect a Virtual Machine by its MAC address?

Our MAC Address API outputs a field called macAddressDetails.virtualMachine. If it detects that a Virtual Machine is using this MAC address, it outputs its vendor name (e.g. ”VMWare”). Otherwise, it outputs “Not detected”.

To detect the Virtual Machines, we build our VM Knowledge Base, which stores information about known relations between MAC addresses and Virtual Machines, and patterns, based on which the Virtual Machines assign MAC addresses to the virtual network interfaces.

This information comes from the two sources:

  • We constantly scan the Internet for such information. It’s systemized, stored and verified.
  • Our research team installed the Virtual Machines and performed experiments, trying to identify patterns on how their network interfaces receive MAC addresses.
Virtual machine detection simplified schema

Virtual Machine’s MAC ranges

Detection rules which don't have their dedicated page yet

Virtual Machine Name OUI or range References
Red Hat Xen, XenSource, Novell Xen 00:16:3E:00:00:00 to 00:16:3E:FF:FF:FF

https://wiki.xenproject.org/wiki/Xen_Networking

https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx

https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms


Microsoft SCVMM (System Center Virtual Machine Manager) 00:1D:D8:B7:1C:00 to 00:1D:D8:F4:1F:FF

http://techgenix.com/mac-address-pool-duplication-hyper-v/

https://docs.microsoft.com/en-us/system-center/vmm/network-mac?view=sc-vmm-1807

https://blogs.technet.microsoft.com/gbanin/2014/08/27/how-to-solve-mac-address-conflict-on-hyper-v/


Microsoft Virtual PC / Virtual Server 00:03:FF:00:00:00 to 00:03:FF:FF:FF:FF

https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx

https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms/

https://blogs.technet.microsoft.com/medv/2011/01/24/how-to-manage-vm-mac-addresses-with-the-globalimagedata-xml-file-in-med-v-v1/


SWsoft 00:18:51:00:00:00 to 00:18:51:FF:FF:FF

https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx

bhyve by FreebsdF 58:9C:FC:00:00:00 to 58:9C:FC:FF:FF:FF

https://macaddress.io/statistics/company/17619

Nutanix AHV 50:6B:8D:00:00:00 to 50:6B:8D:FF:FF:FF

https://macaddress.io/statistics/company/17388

KVM (proxmox) 54:52:00:00:00:00 to 54:52:FF:FF:FF:FF

https://www.centos.org/forums/viewtopic.php?t=26739

Hetzner vServer (based on KVM and libvirt) 96:00:00:00:00:00 to 96:00:FF:FF:FF:FF Self tested

We are warmly welcoming your thoughts and suggestions with regard to this article. Please feel free to contact us!

Trusted by the following companies

Flex.com webafrica.co.za wework.com guarddog.ai cybercns.com

and many more...

Download an exhaustive MAC Address Vendor Database for your educational, business or enterprise needs.

Our database comes in the following forms: JSON, CSV, XML, Cisco vendorMacs.xml for maximum compatibility and fast integration into existing systems.

Order database
The data was just refreshed