All you want to know about the MAC address

Table of contents

What is a MAC address after all?

A device’s MAC address (Media Access Control address) is a unique sequence of numbers assigned to a network interface controller. It’s an identifier communicating at the data link layer of a specific network segment. For the majority of IEEE 802 network technologies, including Ethernet and Wi-Fi, MAC addresses function as network addresses. Thus, MAC addresses will be used in one of the sublayers of the medium access control protocol.

A network node may have a few network interface controllers (NICs), and each of them will have its own unique MAC address. More sophisticated network devices such as routers and multilayer switches could even require several permanent MAC addresses.

What is a MAC address after all?

The manufacturer of a network interface controller (NIC) assigns MAC addresses which are stored in its hardware, such as a card's read-only memory or other firmware. In that event, a MAC address usually encodes the manufacturer's registered identification number and could be called the burned-in address (BIA). It may also be referred to as an EHA (Ethernet hardware address), hardware address or physical address, unlike a programmed address, in which the host device issues commands to the NIC so as to use an arbitrary address.

The original IEEE 802 MAC address is derived from the original Xerox Ethernet addressing scheme. This 48-bit address space potentially contains 2^248 or 281,474,976,710,656 possible MAC addresses.


How to find my MAC address?

You may need to know the MAC address of your computer to configure your network connection, such as MAC address filtration on the access point, etc. In this case, you need to be able to find your MAC address.

Following the instructions below, you will be able to obtain your computer's or phone's MAC address. These instructions refer to different operating systems, such as Windows OS family, MacOS family, and most Linux distributions.

Find MAC address on different platforms


What MAC sizes are there?

MAC-48 or EUI-48: 48 bits: 01:41:93:AB:CD:EF

EUI-64: 64 bits: 01:41:93:FF:FF:AB:CD:EF

The EUI-64 numbering system encompasses both MAC-48 and EUI-48 identifiers by a simple translation mechanism. To convert a MAC-48 into an EUI-64, copy the OUI, append the two octets FF-FF and then copy the organization-specified extension identifier.

What MAC sizes are there?

The same procedure is used to convert an EUI-48 into an EUI-64, but the sequence inserted will then be FF-FE. In both cases, the process could be trivially reversed when necessary.

Organizations issuing EUI-64s are cautioned against issuing identifiers that could be confused with these forms. The IEEE policy is to discourage new uses of 48-bit identifiers in favor of the EUI-64 system.

IPv6 — one of the most prominent standards that uses a Modified EUI-64 — treats MAC-48 as EUI-48 instead (as it is chosen from the same address pool) and toggles the U/L bit (as this makes it easier to type locally assigned IPv6 addresses based on the Modified EUI-64). This results in extending MAC addresses (such as IEEE 802 MAC address) to Modified EUI-64 using only FF-FE (and never FF-FF) and with the U/L bit inverted.


What are a universal address and a local administered address?

A MAC address is called a universally administered address (UAA) when it's set by the manufacturer or a locally administered addresses (LAA) when it's assigned by the system administrator.

For a universally administered address, the first three octets (in transmission order) identify the organization that issued the identifier and are known as the Organizationally Unique Identifier (OUI). The following three (MAC-48 and EUI-48) or five (EUI-64) octets are assigned by that organization in nearly any manner possible, subject to the constraint of uniqueness.

The IEEE has a target lifetime of 100 years for applications using MAC-48 space, but it encourages the adoption of EUI-64s instead.

What are a universal address and a local administered address?

A locally administered address is assigned to a device by a network administrator, overriding the burned-in address. Locally administered addresses do not contain OUIs.

Universally administered and locally administered addresses are distinguished by setting the second-least-significant bit of the most significant byte of the address. This bit is also referred to as the U/L bit, short for Universal/Local, which identifies how the address is administered.

If the bit is 0, the address is administered universally. If it is 1, the address is administered locally. In the example address 06-00-00-00-00-00 the most significant byte is 06 (hex), the binary form of which is 00000110, where the second least significant bit is 1. Therefore, it is a locally administered address. Consequently, this bit is 0 in all OUIs.


What is a EUI?

The Extended Unique Identifier (EUI) is a common identifier of objects, which is globally unique. Any universally administered MAC address is an EUI but not the other way around.

What is a EUI?

What is an Organizationally Unique Identifier (OUI)?

An OUI is a 24-bit globally unique assigned number. An OUI is assigned with a MA-L identifier block and is referenced by various standards. It can be used to identify an organization or company which requires a globally unique identifier. The OUI is usually linked to other bits that are assigned by an organization, and together they make a globally unique EUI-48 or EUI-64. EUI-48 and EUI-64 may be used as universally unique MAC addresses, as is the case in the family of IEEE 802® standards. For example, the Ethernet MAC Address is an EUI-48 unique to one particular Ethernet interface. However, there are other uses of the OUI, like as a company identifier in the SNAP protocol.

What is an Organizationally Unique Identifier (OUI)?

What is a 36-bit Organizationally Unique Identifier (OUI-36)?

The OUI-36 is a registry activity name, which was replaced by the MA-S registry product name as of January 1, 2014. It includes both a unique 36-bit number used in some standards and the assignment of a block of EUI-48 and EUI-64 identifiers by the IEEE Registration Authority. The owner of a previously assigned OUI-36 registry product may continue to use the assignment.

What is a 36-bit Organizationally Unique Identifier (OUI-36)?

Currently, the OUI-36 only refers to a 36-bit unique number used in some standards. The OUI-36 of the MA-S assignment may be appended with 12 organization-supplied bits to form an EUI-48, or with 28 organization-supplied bits to form an EUI-64 (the identifier blocks assigned with an MA-S). Applications using an MA-S should make no assumptions about the bit pattern present in the (24-bit most-significant) OUI portion of the assigned OUI-36.


What types of assignments are you tracking?

We are tracking the following assignment types: MA-L, MA-M, MA-S, and IAB.

What types of assignments are you tracking?

What is a MA-L, MA-M, MA-S assignment?

There are currently 3 different size blocks of MAC Addresses available. All three could be used to generate universally administered MAC-48 and MAC-64.

NameFull namePreviously namedNumber of Addresses
MA-LMAC Address Block LargeOUI (Organizationally Unique Identifier)224 ~= 16 Million
MA-MMAC Address Block Medium-220 ~= 1 Million
MA-SMAC Address Block SmallOUI-36 (encompasses IAB Assignments)212 ~= 4,096
What is a MA-L, MA-M, MA-S assignment?References:

What is an Individual Address Block (IAB)?

The Individual Address Block is an inactive registry activity, which was replaced by the MA-S registry product as of January 1, 2014. The owner of a previously assigned IAB may continue to use the assignment until its exhaustion. The IAB was used by organizations and companies that required less than 4097 unique 48-bit numbers (EUI-48) and thus found little sense in buying their own OUI. The IAB uses a MA-L (and OUI) belonging to the IEEE Registration Authority, linked with 12 additional IEEE-provided bits (for a total of 36 bits), leaving only 12 bits for the IAB owner to assign to their individual devices (up to 4096). Unlike an OUI, which allows assigning values in various different number spaces (for example, EUI-48, EUI-64, and the various CDI number spaces), the Individual Address Block could only be used to assign EUI-48 identifiers. All other potential uses based on the OUI from which the IABs are allocated are reserved, and remain the property of the IEEE Registration Authority. It should also be noted that, between 2007 and September 2012, the OUI value 00:50:C2 was used for IAB assignments. After September 2012, the value was changed to 40:D8:55. Applications using EUI-48 values assigned under an IAB should have made no assumptions about the bit pattern present in the (24-bit most-significant) OUI portion of the assigned numbers.

What is an Individual Address Block (IAB)?

What is the structure of a MAC address?

In universally administered addresses the first 24-bit, 28-bit or 36-bit identify the organization that issued the identifier.

MAC-64 examples:

  • 00:09:8C:12:34:56:78:90, where 00:09:8C is MA-L block and 12:34:56:87:90 is interface controller specific
  • CC:1B:E0:21:23:45:67:89, where CC:1B:E0:2 is MA-M block and 1:23:45:67:89 is interface controller specific
  • 70:B3:D5:88:A1:23:45:67, where 70:B3:D5:88:A is MA-S block and 1:23:45:67 is interface controller specific
What is the structure of a MAC address?

What are unicast and multicast addresses?

There are also two different types of Ethernet addresses - unicast and multicast.

If the least significant bit of the most significant octet of an address is set to 0 (zero), the frame is meant to reach only one receiving NIC. This type of transmission is called unicast. A unicast frame is transmitted to all nodes within the collision domain, which typically ends at the nearest network switch or router. A switch will forward a unicast frame through all of its ports (except for the port that originated the frame) if the switch has no knowledge of which port leads to that MAC address, or just to the proper port if it does have the knowledge. Only the node with the matching hardware MAC address will accept the frame; network frames with non-matching MAC-addresses are ignored, unless the device is in a promiscuous mode.

What are unicast and multicast addresses?

If the least significant bit of the most significant address octet is set to 1, the frame will still be sent only once; however, NICs will choose to accept it based on criteria other than the matching of a MAC address: for example, based on a configurable list of accepted multicast MAC addresses. This is called multicast addressing.


Notational conventions

The standard (IEEE 802) format for printing MAC-48 addresses in a human-friendly form is six groups of two hexadecimal digits, separated by colons (:) or hyphens (-), in transmission order (e.g. 01-41-93-62-98-ab or 01:41:93:62:98:ab).

This form is also commonly used for EUI-64. Another convention used by networking equipment uses three groups of four hexadecimal digits separated by dots (.) (e.g. 0141.9367.98ab), again in transmission order.

The standard notation, also known as canonical format, for MAC addresses is written in transmission bit order with the least significant bit transmitted first, as seen in the output of the iproute2/ifconfig/ipconfig command, for example.

IEEE 802.3 (Ethernet) and IEEE 802.4 (Token Bus) both send the bytes (octets) over the wire, left-to-right, with the least significant bit in each byte first, whereas IEEE 802.5 (Token Ring) and IEEE 802.6 send the bytes over the wire with the most significant bit first. As a result, there may be confusion when an address in the latter scenario is represented with bits reversed from the canonical representation. For example, an address in canonical form 12-34-56-78-9A-BC would be transmitted over the wire as bits 01001000 00101100 01101010 00011110 01011001 00111101 in the standard transmission order (with the least significant bit first). But for Token Ring networks, it would be transmitted as bits 00010010 00110100 01010110 01111000 10011010 10111100, in most-significant-bit-first order. The latter might be incorrectly displayed as 48-2C-6A-1E-59-3D. This is referred to as bit-reversed order, non-canonical form, MSB format, IBM format, or Token Ring format, as explained in RFC 2469. The canonical form is generally preferred and used by all modern implementations.

When the first switches supporting both Token Ring and Ethernet came out, some did not distinguish between canonical form and non-canonical form and so did not reverse MAC address bits as required. This led to cases of duplicate MAC addresses in the field.


What's the difference between EUI-48 and MAC-48?

Historically, both EUI-48 and MAC-48 were concatenations of a 24-bit OUI (Organizationally Unique Identifier) assigned by the IEEE and a 24-bit extension identifier assigned by the organization with that OUI assignment (NIC).

The distinction between EUI-48 and MAC-48 identifiers is merely nominal: MAC-48 is used for network hardware; EUI-48 is used to identify other devices and software. (Thus, by definition, an EUI-48 is not in fact a "MAC address", although it is syntactically indistinguishable from one and assigned from the same numbering space.)

The IEEE now considers the label MAC-48 to be an obsolete term formerly used to refer to a specific type of EUI-48 identifier that addresses hardware interfaces within existing 802-based networking applications. Therefore, it is unlikely to be used in the future. Instead, the proprietary term EUI-48 should serve this purpose.

The EUI-48 is expected to have exhausted its address space by the year 2100.


Is MAC address assigned permanently, or it could be changed?

Although it is intended to be a permanent and globally unique identification, one can change the MAC address on most modern hardware. Changing MAC addresses is necessary in network virtualization. It could also be used in the process of exploiting security vulnerabilities. This procedure is called MAC spoofing.


How could I get MAC address of my website visitor?

A host cannot determine from the MAC address of another host whether that host is on the same link (network segment) as the sending host, or it is on a network segment bridged to that network segment.

MAC is short for Media Access Control, where media refers to the local transmission media. A MAC address is not broadcast beyond the LAN of the device it is connected to, as it is locked in the internal network. Whereas source and destination IP-Addresses remain the same and are therefore used for long-distance routing decisions, the source and destination MAC addresses will indicate the next hop.

The MAC address stored in the packet changes on every hop of its journey. Due to that, the MAC address stored in the packets which are received by your server will be the MAC address of your point of presence’s router or the equipment of your ISP.

The only way to get the visitor's MAC address is to run code on his laptop, from the browser. There is no way to do it since it would be a breach of privacy or security.

There are several workarounds like running Active-X controls for Internet Explorer only or running XPCOM for Mozilla Firefox only. But these approaches require extension installation or a prompt from the user, so they wouldn't work for collecting all the visitors’ MAC addresses in background.


MAC address randomization in WiFi probe requests

To prevent third parties from using the MAC address to track devices, several vendors have implemented MAC address randomization. This follows the idea to use disposable interface identifiers in order to improve users’ privacy. In practice, this implies that probe requests no longer use the real MAC address of the device. For example, a new MAC address can be used for each scan iteration, where one scan iteration consists of sending probe requests on all usable channels.

However, since a specification on MAC address randomization does not yet exist, iOS, Windows, and Linux, all implemented their own variants of MAC address randomization.

Linux

Linux added support for MAC address randomization during network scans. The address should be randomized for each scan iteration. The mvm module of the iwlwifi driver supports randomization since kernel 3.18. The brcmfmac driver added support for this in kernel 4.5.

The privacy-oriented Linux distribution Tails does not support MAC address randomization during network scans. Instead, it generates a new random MAC address at boot. This random address keeps the first 3 bytes of the original address, the Organization Unique Identifier (OUI), and only randomizes the last three bytes. While not as optimal as periodical address changes, it does prevent tracking over extended periods of time.

Windows

Microsoft supports randomization since Windows 10. Enabling randomization is possible if the hardware and driver support it. Interestingly, not only does Windows use random addresses for probe requests, it also uses a random address when connected to the network.

To assure the client always uses the same address when connecting to a particular network, a per-network address is calculated as follows: addr = SHA‌-256(SSID, macaddr, connId, secret).

Here SSID is the name of the network, macaddr the original MAC address, and connId a parameter that changes if the user removes (and re-adds) the network to its preferred network list. The secret parameter is a 256-bits cryptographic random number generated during system initialization, unique per interface, and kept the same across reboots. Bits in the most significant byte of addr are set so it becomes a locally administered, unicastaddress.

This hash construction is similar to the generation of IPv6 interface identifiers as proposed in RFC 7217. It assures that systems relying on fixed MAC addresses continue to work as expected, e.g., when authentication is performed based on the MAC address. Users can also manually instruct the OS to daily update the per-network address randomly.

Android

Android strating from 6.0 uses randomization for background scans if the driver and hardware support it. Android versions before 6.0 do not support randomization.

iOS

Apple added MAC address randomization to its devices starting from iOS 8. In iOS 8, randomized addresses are only used while unassociated and in sleep mode. iOS 9 was extended to also use randomization in what Apples calls location and auto-join scans. This means that randomization is now also used when the device is active, i.e., when the screen is turned on.

-

This FAQ section is based on the Why MAC Address Randomization is not Enough: An Analysis of Wi-Fi Network Discovery Mechanisms publication. Please refer to it for further detailed analysis.


How to detect a Virtual Machine by its MAC address?

Our MAC Address API outputs a field called macAddressDetails.virtualMachine. If it detects that a Virtual Machine is using this MAC address, it outputs its vendor name (e.g. ”VMWare”). Otherwise, it outputs “Not detected”.

To detect the Virtual Machines, we build our VM Knowledge Base, which stores information about known relations between MAC addresses and Virtual Machines, and patterns, based on which the Virtual Machines assign MAC addresses to the virtual network interfaces.

This information comes from the two sources:

  • We constantly scan the Internet for such information. It’s systemized, stored and verified.
  • Our research team installed the Virtual Machines and performed experiments, trying to identify patterns on how their network interfaces receive MAC addresses.
How to detect a Virtual Machine by its MAC address?

Virtual Machine’s MAC ranges

Detection rules which don't have their dedicated page yet

Virtual Machine NameOUI or rangeReferences
Red Hat Xen, XenSource, Novell Xen00:16:3E:00:00:00 to 00:16:3E:FF:FF:FFhttps://wiki.xenproject.org/wiki/Xen_Networking
https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx
https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms
Microsoft SCVMM (System Center Virtual Machine Manager)00:1D:D8:B7:1C:00 to 00:1D:D8:F4:1F:FFhttp://techgenix.com/mac-address-pool-duplication-hyper-v/
https://docs.microsoft.com/en-us/system-center/vmm/network-mac?view=sc-vmm-1807
https://blogs.technet.microsoft.com/gbanin/2014/08/27/how-to-solve-mac-address-conflict-on-hyper-v/
Microsoft Virtual PC / Virtual Server00:03:FF:00:00:00 to 00:03:FF:FF:FF:FFhttps://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx
https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms/
https://blogs.technet.microsoft.com/medv/2011/01/24/how-to-manage-vm-mac-addresses-with-the-globalimagedata-xml-file-in-med-v-v1/
SWsoft00:18:51:00:00:00 to 00:18:51:FF:FF:FFhttps://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx
bhyve by FreebsdF58:9C:FC:00:00:00 to 58:9C:FC:FF:FF:FF

https://macaddress.io/statistics/company/17619

Nutanix AHV50:6B:8D:00:00:00 to 50:6B:8D:FF:FF:FFhttps://macaddress.io/statistics/company/17388
KVM (proxmox)54:52:00:00:00:00 to 54:52:FF:FF:FF:FFhttps://www.centos.org/forums/viewtopic.php?t=26739
Hetzner vServer (based on KVM and libvirt)96:00:00:00:00:00 to 96:00:FF:FF:FF:FFSelf tested

We are warmly welcoming your thoughts and suggestions with regard to this article. Please feel free to contact us!


How to recognise a VMware's virtual machine by its MAC address?

Summary

#Range or PrefixVendorVirtual Machine
100:50:56VMWareVMware vSphere, VMware Workstation, VMware ESX Server
200:50:56:80:00:00 → 00:50:56:BF:FF:FFVMWareVMware vSphere managed by vCenter Server
300:0C:29VMWareStandalone VMware vSphere, VMware Workstation, VMware Horizon
400:05:69VMWareVMware ESX, VMware GSX Server
500:1C:14VMWareVMWare

OUIs registered by VMWare, Inc

There are 4 OUIs registered by VMware, Inc:

OUIAssignment Type
00:50:56MA-L
00:1C:14MA-L
00:0C:29MA-L
00:05:69MA-L

Detection Rule 1

Affects products: VMware vSphere, VMware Workstation, VMware ESX Server

Signature: OUI is 00:50:56

Conditions

When the administrator assigns the MAC address manually to a virtual machine, this OUI prefix is set automatically. The last 3 octets should be set manually.

However, administrators can set any MAC address to their virtual machines.

However, administrators can set any MAC address to their virtual machines.

References

Example MACs generated

  • 00:50:56:11:22:33
  • 00:50:56:12:23:34
  • 00:50:56:33:A1:BB

Tested on

  • VMware vSphere 5.5, standalone
  • VMware VMware Workstation 15

Detection Rule 2

Affects products: VMware vSphere managed by vCenter Server

Signature: MAC address belongs to the range [00:50:56:80:00:00; 00:50:56:BF:FF:FF]

Conditions

According to the VMware OUI allocation scheme, a MAC address has the format of 00:50:56:XX:YY:ZZ, where 00:50:56 represents the VMware OUI, XX is calculated as (80 + vCenter Server ID), and YY and ZZ are random two-digit hexadecimal numbers.

Based on this scheme, we can determine the vCenter Server Unique ID, from the servers' MAC address:

  • Take the 4th octet: for 00:50:56:97:12:34, it would be 97
  • Subtract 0x80: 0x97 - 0x80 = 0x17
  • Rebase it from Base-16 to to Base-10. In our example, it would be 0x17 → 23
  • vCenter Server Unique ID = 23
Based on this scheme, we can determine the vCenter Server Unique ID, from the servers' MAC address:

References

Example MACs generated

  • 00:50:56:A5:12:34
  • 00:50:56:A5:A0:12
  • 00:50:56:90:A4:BA

Tested on

  • vCenter Server 5.5, 6.5

Detection Rule 3

Affects products: Standalone VMware vSphere, VMware Workstation, VMware Horizon

Signature: OUI is 00:0C:29

Conditions

According to the VMware OUI allocation scheme, the hypervisor generates MAC addresses that consists of the VMware OUI 00:0C:29 and the last three octets of the virtual machine UUID in hexadecimal format. The virtual machine UUID is based on a hash calculated by using the UUID of the ESXi physical machine and the path to the configuration file (.vmx) of the virtual machine.

The virtual machine UUID is based on a hash calculatedThe virtual machine UUID is based on a hash calculated

References

Example MACs generated

  • 00:0C:29:4E:C6:49
  • 00:0C:29:49:92:99
  • 00:0C:29:5C:F3:BA

Tested on

  • vSphere 5.5, 6.5, VMware Workstation 15

Detection Rule 4

Affects products: Outdated VMWare solutions: VMware ESX, VMware GSX Server

Signature: OUI is 00:05:69

Conditions

According to the VMware OUI allocation scheme, the hypervisor generates MAC addresses that consists of the VMware OUI 00:05:69 and the last three octets generated by the following algorithm:

  • The first 16 bits are set to the same values as the last 16 bits of the console operating system’s primary IP address.
  • The final eight bits of the MAC address are set to a hash value based on the name of the virtual machine’s configuration file.

For example, if a machine's IP address was 192.34.14.81 (or in hex, 0xc0220e51) and the configuration file was hashed to the value of 95, the MAC address would have the following value: 00:05:69:0e:51:95

References:

Example MACs generated

  • 00:05:69:0e:51:95

Detection Rule 5

Affects products: VMware products

Signature: OUI is 00:1C:14

References:

Example MACs generated

  • 00:1C:14:00:11:22

Virtual Machine’s MAC ranges


How to recognise a Parallels' virtual machine by its MAC address?

Summary

#Range or PrefixVendorVirtual Machine
100:1C:42ParallelsParallels Virtual Machine

OUIs registered by Parallels, Inc

There are 1 OUI registered by Parallels, Inc:

OUIAssignment Type
00:1C:42MA-L

Detection Rule 1

Affects products: All Parallels products

Signature: OUI is 00:1C:42

Conditions

When a new virtual machine is created, Parallels generates a MAC address using its only registered OUI – 00:1C:42.

The virtual machine UUID is based on a hash calculated

Example MACs generated

  • 00:1C:42:15:41:57
  • 00:1C:42:51:E1:25
  • 00:1C:42:82:CD:E5

Tested on

  • Parallels Desktop 14

Known Pattern 1

Affects products: All Parallels products

Signature: MAC matches the pattern:

  • x2-xx-xx-xx-xx-xx
  • x6-xx-xx-xx-xx-xx
  • xA-xx-xx-xx-xx-xx
  • xE-xx-xx-xx-xx-xx

Conditions

For the manually generated MAC-addresses, Parallels recommends using MAC address with OUI 00:1C:42.

Parallels recommends using MAC address with OUI 00:1C:42

However, it is possible to set a manually generated address, which is required to be LLA and Unicast. These two requirements encoded in bits, result in the following patterns:

  • x2-xx-xx-xx-xx-xx
  • x6-xx-xx-xx-xx-xx
  • xA-xx-xx-xx-xx-xx
  • xE-xx-xx-xx-xx-xx

If a MAC address matches the pattern, it does not necessary mean that it's a Parallels Virtual Machine.

All manually generated MAC addresses for the Parallels Virtual Machines which are not using the OUI 00:1C:42 match the pattern.

All manually generated MAC addresses for the Parallels Virtual Machines which are not using the OUI 00:1C:42 match the pattern.

References

Virtual Machine’s MAC ranges


How to recognise a Docker container by its MAC address?

Summary

#Range or PrefixVendorVirtual Machine
102:42DockerDocker container

Detection Rule 1

Affects products: Docker container

Signature: The first two octets are = '02:42'

Conditions

According to the v1.7 documentation, all the Docker containers have the same prefix in their MAC addresses – '02:42:' if generated automatically. The remaining 4 octets of the MAC address is a container's IPv4 address printed in hex. For example, '02:42:ac:11:00:02' is for the '172.17.0.0/16' subnetwork.

Information about this rule has been removed from the recent version documentation, but it remains valid.

Docker containers have the same prefix in their MAC addresses – 02:42

Here's the source code of the MAC address generator used in Docker v18.09:

func genMAC(ip net.IP) net.HardwareAddr {
    hw := make(net.HardwareAddr, 6)
    // The first byte of the MAC address has to comply with these rules:
    // 1. Unicast: Set the least-significant bit to 0.
    // 2. Address is locally administered: Set the second-least-significant bit (U/L) to 1.
    hw[0] = 0x02
    // The first 24 bits of the MAC represent the Organizationally Unique Identifier (OUI).
    // Since this address is locally administered, we can do whatever we want as long as
    // it doesn't conflict with other addresses.
    hw[1] = 0x42
    // Fill the remaining 4 bytes based on the input
    if ip == nil {
        rand.Read(hw[2:])
    } else {
        copy(hw[2:], ip.To4())
    }
    return hw
}

Still, the administrator can specify any custom MAC address for the container by using the '--mac-address=MACADDRESS' option. Docker does not check if manually specified MAC addresses are unique.

Administrator can specify any custom MAC address for the container

References

Example MACs generated

  • 02:42:AC:11:00:02

Tested on

  • Docker v18.06.1-ce

Virtual Machine’s MAC ranges


How to recognise a Microsoft Hyper-V's virtual machine by its MAC address?

Summary

#Range or PrefixVendorVirtual Machine
100:15:5dMicrosoftHyper-V

OUIs registered by Microsoft Corp

There are 41 OUI registered by Microsoft Corp:

OUIAssignment Type
70:BC:10MA-L
B8:31:B5MA-L
F0:6E:0BMA-L
CA:12:5CMA-L
F0:1D:BCMA-L
EC:83:50MA-L
EC:59:E7MA-L
D4:8F:33MA-L
D0:92:9EMA-L
C8:3F:26MA-L
C4:9D:EDMA-L
BC:83:85MA-L
B8:4F:D5MA-L
9C:AA:1BMA-L
9C:6C:15MA-L
98:5F:D3MA-L
94:9A:A9MA-L
84:63:D6MA-L
80:C5:E6MA-L
74:E2:8CMA-L
5C:BA:37MA-L
48:86:E8MA-L
48:50:73MA-L
3C:83:75MA-L
2C:54:91MA-L
2C:29:97MA-L
28:18:78MA-L
28:16:A8MA-L
20:A9:9BMA-L
20:62:74MA-L
14:9A:10MA-L
10:2F:6BMA-L
0C:E7:25MA-L
0C:41:3EMA-L
00:25:AEMA-L
00:22:48MA-L
00:1D:D8MA-L
00:17:FAMA-L
00:15:5DMA-L
00:12:5AMA-L
00:03:FFMA-L

Only one of them is known to be used by the Hyper-V Virtual Machines – 00:15:5d.

Detection Rule 1

Affects products: Hyper-V Virtual Machines

Signature: OUI is 00:15:5d

Conditions

For dynamic allocation, MAC addresses' range could be set in Hyper-V preferences.

MAC addresses' range could be set in Hyper-V preferences

The default MAC address is calculated on the first start:

  • The first three octets (aa-bb-cc) are Microsoft's IEEE organizationally Unique Identifier, 00:15:5D (which is common on all Hyper-V hosts).
  • The next two octets (dd-ee) are derived from the last two octets of the server's IP address.
  • The last octet (ff) is randomly generated from the range 0x0 – 0xFF.

Administrator can also set any static MAC address manually:

Administrator can also set any static MAC address manually

References

Example MACs generated

  • 00:15:5d:01:8d:00
  • 00:15:5d:01:8d:01
  • 00:15:5d:01:8d:02

Tested on

  • Windows Server 2012 R2

Virtual Machine’s MAC ranges


How to recognise an Oracle Virtual machine by its MAC address?

Summary

#Range or PrefixVendorVirtual Machine
108:00:27Pcs Systemtechnik GmbHOracle VirtualBox 5.2
252:54:00 (Exact MAC: 52:54:00:C9:C7:04)N/AOracle VirtualBox 5.2 + Vagrant
300:21:F6Oracle CorpOracle VirtualBox 3.3
400:14:4FOracle CorpOracle VM Server for SPARC
500:0F:4BOracle CorpOracle Virtual Iron 4

OUIs registered by Oracle corp

There are 15 OUI registered by Oracle corp:

OUIAssignment Type
00:10:E0MA-L
00:00:7DMA-L
00:21:28MA-L
00:01:5DMA-L
00:21:F6MA-L
00:A0:A4MA-L
00:07:82MA-L
00:03:BAMA-L
08:00:20MA-L
2C:C2:60MA-L
00:10:4FMA-L
00:0F:4BMA-L
00:13:97MA-L
00:20:F2MA-L
00:14:4FMA-L

Only some of them are used for the Virtual Machines.

Detection Rule 1

Affects products: Oracle VirtualBox

Signature: OUI is 08:00:27

Details

Once new VM has been created with the VirtualBox GUI, it has a MAC address with OUI prefix set automatically. When the administrator presses "refresh" button, the last 3 octets are changed, but the prefix remains.

Once new VM has been created with the VirtualBox GUI, it has a MAC address with OUI prefix set automatically.

However, it's possible to set a custom MAC with any prefix.

However, it's possible to set a custom MAC with any prefix.

Example MACs generated

  • 08:00:27:3F:FE:0F
  • 08:00:27:78:8D:0D
  • 08:00:27:BB:05:3F
  • 08:00:27:FD:B6:EF

References

Tested on

  • VirtualBox 5.1.26

Detection Rule 2

Affects products: Oracle VirtualBox / Vagrant

Signature: Prefix is 52:54:00, or Prefix is 52:54:00:C9:C7:04

Details

Once a new VM has been created with the Vagrant, it sometimes has a MAC address with prefix 52:54:00. Some virtual machines have the same MAC: 52:54:00:C9:C7:04.

Once a new VM has been created with the Vagrant, it sometimes has a MAC address with prefix 52:54:00.

Example MACs generated

  • 52:54:00:CA:E4:8B
  • 52:54:00:C9:C7:04

Tested on

  • VirtualBox 5.1.26

Detection Rule 3

Affects products: Oracle VirtualBox 3.3

Signature: OUI is 00:21:F6

Details

Oracle wrote in their blog that they used OUI 00:21:F6 for virtual machines. This VirtualBox version isn't supported anymore.

References

Detection Rule 4

Affects products: Oracle VM Server for SPARC

Signature: OUI is 00:14:4F

Details

Domains have been assigned the following block of 512K MAC addresses:

  • 00:14:4F:F8:00:00 ~ 00:14:4F:FF:FF:FF

The lower 256K addresses are used by the Logical Domains Manager for automatic MAC address allocation, and you cannot manually request an address in this range:

  • 00:14:4F:F8:00:00 - 00:14:4F:FB:FF:FF

You can use the upper half of this range for manual MAC address allocation:

  • 00:14:4F:FC:00:00 - 00:14:4F:FF:FF:FF

References

Detection Rule 5

Affects products: Oracle Virtual Iron 4

Signature: OUI is 00:0F:4B

References

Virtual Machine’s MAC ranges


How to find my MAC address on Windows?

On Windows, you have at least two possible ways to get your MAC address: via 'cmd.exe' and by 'Network and Sharing Center'.

The first way

The first way is getting a list of your network interfaces in the console.

  1. Press Win key and R to initiate the Run dialogue. Enter cmd and click Ok.Press Win key and R to initiate the Run dialogue. Enter cmd and click Ok.
  2. When the cmd.exe window appears, you can enter the command.
    > ipconfig /all
    Find the right virtual or physical interface and look at the "Physical address".

    In this output you can find the right virtual or physical interface and look at the "Physical address" line, where you can find your MAC address.

    How do you choose the right interface? Look at the name of an interface, which should contain Wi-Fi wireless adapters and Ethernet for wired ones. You also need to check the "Description" line: it should contain the name of your Wi-Fi adapter or network card. In any event, it cannot contain words such as "Proxy", "VPN", "Virtual", etc.

The second way

The second way is by using the GUI application "Network and Sharing Center".

  1. To open this application, press Win and search by entering the name or just right-click on the networking icon in theTray and choose Open Networking and Sharing Center.

    The window of "Network and Sharing Center" will appear. If you have an active connection, you can click on the connection name Ethernet 3.

    Choose "Open Networking and Sharing Center".Click on the connection name.
  2. Then, click on Details.Then, click on "Details".
  3. Now you can see all the details of the connection.Now you can see all the details of the connection.
  4. If you don't have any active connections, or if you need to know a MAC address of an unused adapter, you can open Network and Sharing Centerand click on Change adapter settings.Open "Network and Sharing Center" and click on "Change adapter settings"
  5. After this, you will see a list of your network connections. Here you can choose any connection and right-click on them, then click on theStatus.You will see a list of your network connections.
  6. The Ethernet 3 Status modal window will appear, so, as you can see in the previous example, you need to click on Details and look at thePhysical address field.You need to click on "Details".Look at the "Physical address" field.

Find MAC address on different platforms


How to find my MAC address on Mac OS X?

These instructions explain how to find MAC address on your device with Mac OS X.

The first way

  1. Select System Preference from the Apple menu.

    Select "System Preference" from the "Apple menu".
  2. Then, select Network.

    Then, select Network.
  3. On the next screen select Wi-Fi and click on Advanced.

    On the next screen select "Wi-Fi" and click on "Advanced".
  4. On this screen, you will see the MAC address. Also, you can click on the Hardware tab.

    On this screen, you will see the MAC address.You can click on the "Hardware" tab.

The second way

  1. Select About This Mac from the Apple menu.

    Select "About This Mac" from the "Apple menu".
  2. Then click on System Report.

    Select "About This Mac" from the "Apple menu".
  3. Here you can see your MAC address.

    Select "About This Mac" from the "Apple menu".

The third way

  1. Yet another way to get your MAC address on newer versions of Mac OS X is a search for the network Utility.app, if you have this, you launch the application.

    Launch "network Utility.app".

Using terminal

Another way to find MAC address on Mac OS X is by using the terminal.

  1. Launch the terminal.

    Launch the terminal.
  2. Type ifconfig in the terminal.

    Type ifconfig in the terminal.

Find MAC address on different platforms


How to find my MAC address on Linux?

The first way

For Linux, you can always use the universal way: the command line!

  1. You can do so by executing one of these commands.

    $ ifconfig
    enp2s0f0  Link encap:Ethernet  HWaddr b8:88:e3:b0:f3:f0
              UP BROADCAST MULTICAST  MTU:1500  Metric:1
              RX packets:0 errors:0 dropped:0 overruns:0 frame:0
              TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:1000
              RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
              Interrupt:16
    
    lo        Link encap:Local Loopback
              inet addr:127.0.0.1  Mask:255.0.0.0
              inet6 addr: ::1/128 Scope:Host
              UP LOOPBACK RUNNING  MTU:65536  Metric:1
              RX packets:1969 errors:0 dropped:0 overruns:0 frame:0
              TX packets:1969 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:1000
              RX bytes:198134 (198.1 KB)  TX bytes:198134 (198.1 KB)
    
    wlp3s0    Link encap:Ethernet  HWaddr a4:17:31:79:1e:01
              inet addr:192.168.1.43  Bcast:192.168.1.255  Mask:255.255.255.0
              inet6 addr: fe80::4828:6227:27b9:2670/64 Scope:Link
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:111214 errors:0 dropped:0 overruns:0 frame:0
              TX packets:76742 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:1000
              RX bytes:87608671 (87.6 MB)  TX bytes:13789254 (13.7 MB)
    
    $ ip address show
    1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
        link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
        inet 127.0.0.1/8 scope host lo
           valid_lft forever preferred_lft forever
        inet6 ::1/128 scope host
           valid_lft forever preferred_lft forever
    2: enp2s0f0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
        link/ether b8:88:e3:b0:f3:f0 brd ff:ff:ff:ff:ff:ff
    3: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
        link/ether a4:17:31:79:1e:01 brd ff:ff:ff:ff:ff:ff
        inet 192.168.1.43/24 brd 192.168.1.255 scope global dynamic wlp3s0
           valid_lft 21562sec preferred_lft 21562sec
        inet6 fe80::4828:6227:27b9:2670/64 scope link
           valid_lft forever preferred_lft forever
    
  2. As you can see, there is a lot of output, but we are only interested in MAC addresses (They are underlined in red).

    We are only interested in MAC addresses (They are underlined in red).These screenshots show that my computer has three network interfaces.

    These screenshots show that my computer has three network interfaces: lo - Local loopback, enp2s0f0 - my ehternet adapter andwlp3s0 - my Wi-Fi adapter.

The second way

If you are using Ubuntu 16.04, you can find your MAC addresses via GUI.

  1. Open All Settings application and click on Network.

    Open "All Settings" application and click on "Network".
  2. Select Wireless and choose the connection you have plugged in and click on the blue arrow.

    Select "Wireless" and choose the connection you have plugged
  3. Now you can see your MAC address.

    Now you can see your MAC address.
  4. You may not have an active connection, so you can try to connect to any available one. Then you can click on the blue arrow, which opens the connection info. Since you aren't connected yet, you need to click on theSettings button.

    You may not have an active connectionOpens the connection info

    If you want to know the MAC address of your wired connection, click on Wired in step 2.

    If you want to know the MAC address of your wired connection, click on "Wired"

Find MAC address on different platforms


How to find my MAC address on iOS?

If you have an iOS device, you can use the following instruction.

Let's consider the steps of this instruction on iPhone SE.

  1. Open Settings.

    Open "Settings"
  2. Tap General.

    Tap "General"
  3. Then, select About.

    Then, select About.
  4. Now you can see your MAC address!

    Now you can see your MAC address!

Find MAC address on different platforms


How to find my MAC address on Android?

To find Wi-Fi MAC address on an Android device, you can use the following instruction.

  1. Open Settings.

    Open "Settings"
  2. Scroll down and select About phone.

    Scroll down and select About phone.
  3. Select Status.

    Select Status.
  4. Well, that's it.

    Well, that's it.

Find MAC address on different platforms


How to recognise MAC address application?

Some MAC addresses and their ranges are reserved for specific use cases by their vendors. Such addresses typically indicate what higher-level protocol is encapsulated in a frame.

Our MAC Address API outputs a field calledmacAddressDetails.application. If it detects that a vendor or standard is using the MAC address, it outputs a list of applications. Otherwise, it outputs an empty array.

Reserved application detection simplified schema

Related topics

Other MAC address applications

The following MAC address ranges have no their dedicated pages yet.

Range or PrefixApplicationConditionsReferences
03:00:00:01:00:00 to 03:00:40:00:00:00User-defined (per 802 spec)EtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
01:00:1D:00:00:00Cabletron PC-OV PC discover (on demand)EtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:00:1D:42:00:00Cabletron PC-OV Bridge discover (on demand)EtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:00:1D:52:00:00Cabletron PC-OV MMAC discover (on demand)EtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:00:3C:00:00:00 to 01:00:3C:FF:FF:FFAuspex Systems (Serverguard)http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:00:10:00:00:20Hughes Lan Systems Terminal Server S/W downloadEtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:00:10:FF:FF:20Hughes Lan Systems Terminal Server S/W requestEtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:00:81:00:00:00Synoptics Network Managementhttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:00:81:00:00:02Synoptics Network Managementhttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:00:81:00:01:00Bay Networks (Synoptics) autodiscoveryEtherType is 0x0802 SNAP type is 0x01A2http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:00:81:00:01:01Bay Networks (Synoptics) autodiscoveryEtherType is 0x0802 SNAP type is 0x01A1http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:20:25:00:00:00 to 01:20:25:7F:FF:FFControl Technology Inc's Industrial Ctrl Proto.EtherType is 0x873Ahttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:80:24:00:00:00Kalpana Etherswitch every 60 secondsEtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:DD:00:FF:FF:FFUngermann-Bass boot-me requestsEtherType is 0x7002http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
01:DD:01:00:00:00Ungermann-Bass Spanning TreeEtherType is 0x7005http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
03:00:00:00:00:10OS/2 1.3 EE + Communications ManagerEtherType is 0x80D5http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
03:00:00:00:00:40OS/2 1.3 EE + Communications ManagerEtherType is 0x80D5http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
03:00:00:00:01:00OSI All-IS MulticastEtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
03:00:00:00:02:00OSI All-ES MulticastEtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
03:00:00:80:00:00Discovery ClientEtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
03:00:FF:FF:FF:FFAll Stations addressEtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:0D:00:00:00 to 09:00:0D:FF:FF:FFICL Oslan MulticastEtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:0D:02:00:00ICL Oslan Service discover only on boothttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:0D:02:0A:3CICL Oslan Service discover only on boothttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:0D:02:0A:38ICL Oslan Service discover only on boothttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:0D:02:0A:39ICL Oslan Service discover only on boothttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:0D:02:FF:FFICL Oslan Service discover only on boothttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:0D:09:00:00ICL Oslan Service discover as requiredhttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:1E:00:00:00Apollo DOMAINEtherType is 0x8019http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:02:04:00:01Vitalink printer messagesEtherType is 0x8080http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:02:04:00:02Vitalink bridge managementEtherType is 0x8080http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:4C:00:00:0FBICC Remote bridge adaptive routing (e.g. to Retix)EtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:4E:00:00:02Novell IPXEtherType is 0x8137http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:6A:00:01:00TOP NetBIOShttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:7C:01:00:01Vitalink DLS Multicasthttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:7C:01:00:03Vitalink DLS Inlinkhttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:7C:01:00:04Vitalink DLS and non DLS Multicasthttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:7C:02:00:05Vitalink diagnosticsEtherType is 0x8080http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:7C:05:00:01Vitalink gatewayEtherType is 0x8080http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:7C:05:00:02Vitalink Network Validation Messagehttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:09:00:00:01HP ProbeEtherType is 0x8005 or 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:09:00:00:04HP DTCEtherType is 0x8005http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:26:01:00:01Vitalink TransLAN bridge managementEtherType is 0x8038http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:39:00:70:00Spider Systems Bridgehttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:56:00:00:00 to 09:00:56:FE:FF:FFStanford reservedhttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:56:FF:00:00 to 09:00:56:FF:FF:FFStanford V Kernel, version 6.0EtherType is 0x805Chttp://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:77:00:00:00Retix Bridge Local Management SystemEtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:77:00:00:01Retix spanning tree bridgesEtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:77:00:00:02Retix Bridge Adaptive routingEtherType is 0x0802http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:87:80:FF:FFXyplex Terminal ServersEtherType is 0x0889http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
09:00:87:90:FF:FFXyplex Terminal ServersEtherType is 0x0889http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
44:38:39:FF:00:00 to 44:38:39:FF:FF:FFMulti-Chassis Link Aggregation (Cumulus Linux)http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
FF:FF:00:40:00:01LANtasticEtherType is 0x81D6http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
FF:FF:00:60:00:04LANtasticEtherType is 0x81D6http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060
FF:FF:01:E0:00:04LANtasticEtherType is 0x81D6http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt
https://tools.ietf.org/html/rfc1060

How to recognise a vendor by multicast MAC address?

Although multicast MAC addresses don't usually belong to any vendor, they may be used by the companies who own their unicast neighbors. Typically, such addresses are used for various reserved purposes, within custom protocols or equipment. Change the least significant bit of the most significant octet to 0 in order to get the corresponding unicast OUI - and you will know the vendor. Note that the mechanics described might not work for all the multicast OUIs.

Here is a table of some multicast-unicast OUI twins we discovered:

Multicast OUIUnicast OUI
01:00:5E00:00:5E
01:00:0C00:00:0C
01:00:1D00:00:1D
01:00:3C00:00:3C
01:00:5E00:00:5E
01:00:1000:00:10
01:00:8100:00:81
01:0E:CF00:0E:CF
01:1B:1900:1B:19
01:19:A700:19:A7
01:20:2500:20:25
01:80:2400:80:24
01:80:C200:80:C2
01:DD:0000:DD:00
01:DD:0100:DD:01
09:00:0D08:00:0D
09:00:1E08:00:1E
09:00:0208:00:02
09:00:2B08:00:2B
09:00:4C08:00:4C
09:00:4E08:00:4E
09:00:6A08:00:6A
09:00:0708:00:07
09:00:7C08:00:7C
09:00:0908:00:09
09:00:2608:00:26
09:00:3908:00:39
09:00:5608:00:56
09:00:7708:00:77
09:00:8708:00:87
AB:00:04AA:00:04

What is EtherType?

A single MAC address range might be reserved for different applications depending on the extra data sent in the Ethernet frame. For instance, the application depends on EtherType. It's a 2-octet field following the Source MAC address. It helps determine which protocol is encapsulated in the frame payload.

Ethernet frame schema

The "CF" series MAC addresses

The OUIs prefixed "CF" (CF:00:00 to CF:FF:FF) are reserved by IANA for use in the Point-to-Point Protocol (PPP) or when vendors don't need an IEEE-assigned OUI.

These OUIs are both multicast and locally administered at the same time.

Summary

Range or PrefixApplication
CF:00:00:00:00:00 - CF:00:00:FF:FF:FFReserved
CF:00:00:00:00:00Used for Ethernet loopback tests

References


How to recognise a Broadcast MAC address application?

The MAC address FF:FF:FF:FF:FF:FF is a special one reserved for broadcast messaging. The frames which are routed to such address are supposed to reach all the hosts connected to the network.

Broadcast MAC address

Here are some common applications of the broadcast address. They strictly depend on the EtherType field.


How to recognise a Virtual Router ID by MAC address?

Virtual Router redundancy protocol is a standard protocol which helps group a number of routers into one virtual router in order to increase availability and reliability of routing paths

Summary

Range or PrefixApplication
00:00:5E:00:01:00 - 00:00:5E:00:01:FFIPv4 Virtual Router Redundancy Protocol
00:00:5E:00:02:00 - 00:00:5E:00:02:FFIPv6 Virtual Router Redundancy Protocol

Detection Rule

If the MAC address looks like 00-00-5E-XX-XX-YY, where XX is 00-01 (for IPv4 frames) or 00-02 (for IPv6 frames), YY will be Virtual Router Identifier.

This mapping provides for up to 255 IPv4/IPv6 VRRP routers on a network.

References


How to recognise an IP frame by MAC address?

Summary

Range or PrefixApplication
01:00:5E:00:00:00 - 01:00:5E:7F:FF:FFIPv4 Multicast (EtherType is 0x0800)
33:33:00:00:00:00 - 33:33:FF:FF:FF:FFIPv6 Multicast. IPv6 neighbor discovery (EtherType is 0x86DD)
00:00:5E:00:52:13 - 00:00:5E:00:52:13Proxy Mobile IPv6
00:00:5E:FE:C0:00:02:00 - 00:00:5E:FE:C0:00:02:FFIPv4 derived documentation
00:00:5E:FE:C6:33:64:00 - 00:00:5E:FE:C6:33:64:FFIPv4 derived documentation
00:00:5E:FE:CB:00:71:00 - 00:00:5E:FE:CB:00:71:FFIPv4 derived documentation
00:00:5E:FE:EA:C0:00:02IPv4 multicast derived documentation
00:00:5E:FE:EA:C6:33:64IPv4 multicast derived documentation
00:00:5E:FE:EA:CB:00:71IPv4 multicast derived documentation
01:00:5E:FE:C0:00:02:00 - 01:00:5E:FE:C0:00:02:FFIPv4 derived documentation
01:00:5E:FE:C6:33:64:00 - 01:00:5E:FE:C6:33:64:FFIPv4 derived documentation
01:00:5E:FE:CB:00:71:00 - 01:00:5E:FE:CB:00:71:FFIPv4 derived documentation
01:00:5E:FE:EA:C0:00:02IPv4 multicast derived documentation
01:00:5E:FE:EA:C6:33:64IPv4 multicast derived documentation
01:00:5E:FE:EA:CB:00:71IPv4 multicast derived documentation
01:80:C2:00:00:20 - 01:80:C2:00:00:2FReserved for use by Multiple Registration Protocol (MRP) applications
02:00:5E:FE:00:00:00:00 - 02:00:5E:FE:FF:FF:FF:FFIPv4 Addr Holders
03:00:00:20:00:00IP multicast address
C0:00:00:04:00:00IP multicast address
03:00:5E:FE:00:00:00:00 - 03:00:5E:FE:FF:FF:FF:FFIPv4 Addr Holders

Detection Rule

If MAC address is in the range of 01:00:5E:00:00:00 - 01:00:5E:7F:FF:FF, its low order 23-bits are mapped to the low-order 24 bits of the IPv4 address. However, since an IP host group address consists of 28 significant bits, the single Ethernet multicast address might map more than to one IP host group address.

The same mechanics is applicable to IPv6, but within the range of 33:33:00:00:00:00 - 33:33:FF:FF:FF:FF.

References


How to recognise a MPLS multicast frame by MAC address?

Multiprotocol Label Switching (MPLS) is a routing technique which provides extra features for the data transport across the enterprise-wide area and service provider networks.

Summary

Range or PrefixApplication
01:00:5E:80:00:00 - 01:00:5E:8F:FF:FFMPLS multicast (EtherType is 0x8847 or 0x8848)
01:00:5E:90:00:00MPLS-TP p2p

Detection rule 1

Each label-switching router (LSR) sets the MAC destination address to the value of 01:00:5E:8X:XX:XX, where X:XX:XX might be 0 or 20-bit value of one of the MPLS lables on the packet's label stack. If the value is 0, an LSR mustn't filter the packet, otherwise an LSR can filter packets in a random manner.

Detection rule 2

The address 01:00:5E:90:00:00 is reserved for the MPLS Transport Profile. According to RFC 7213, an MPLS-TP implementation must use this MAC address while passing any MPLS packets from a point-to-point Ethernet link to the MPLS sub-system.

References



How to recognise Token Ring specific functions by MAC address?

Token Ring is a data link protocol for local area networks. It is based on "ring" topology and "token" passing around the workstations. This technique is supposed to provide fair access to all stations and avoid collisions.

Summary

Range or PrefixApplication
03:00:00:00:00:01NetBIOS (Token Ring)
03:00:00:00:00:02Locate - Directory Server (Token Ring)
03:00:00:00:00:04Synchronous Bandwidth Manager (Token Ring)
03:00:00:00:00:08Configuration Report Server (Token Ring)
03:00:00:00:00:10Ring Error Monitor (Token Ring)
03:00:00:00:00:20Network Server Heartbeat (Token Ring)
03:00:00:00:00:40Ring Parameter Monitor (Token Ring)
03:00:00:00:00:80Active Monitor (Token Ring)
03:00:00:00:04:00LAN Manager (Token Ring)
03:00:00:00:08:00Ring Wiring Concentrator (Token Ring)
03:00:00:00:10:00LAN Gateway (Token Ring)
03:00:00:00:20:00Ring Authorization Server (Token Ring)
03:00:00:00:40:00IMPL Server (Token Ring)
03:00:00:00:80:00Bridge (Token Ring)
03:00:00:20:00:00Single Token-Ring functional address
03:00:00:00:00:08Configuration Report Server (CRS) MAC Group address
03:00:00:00:00:10Ring Error Monitor (REM) MAC Group address
03:00:00:00:00:40Ring Parameter Server (RPS) MAC group address
03:00:00:00:01:00All Intermediate System Network Entities address
03:00:00:00:02:00All End System Network Entities address, and Lobe Media Test (LMT) MAC group address
03:00:00:00:04:00Generic address for all Manager Stations
03:00:00:00:08:00All CONs SNARES address
03:00:00:00:10:00All CONs End System address
03:00:00:00:20:00Loadable Device Generic address
03:00:00:00:40:00Load Server Generic address
03:00:00:40:00:00Generic address for all Agent Stations
C0:00:00:04:00:00Single Token-Ring functional address
03:00:80:00:00:00IPv6 multicast over Token Ring: all-Nodes (FF01::1 and FF02::1) and solicited node (FF02:0:0:0:0:1:FFXX:XXXX) addresses
03:00:40:00:00:00IPv6 multicast over Token Ring: all-Routers addresses (FF0X::2)
03:00:00:80:00:00IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 000
03:00:00:40:00:00IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 001
03:00:00:20:00:00IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 010
03:00:00:10:00:00IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 011
03:00:00:08:00:00IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 100
03:00:00:04:00:00IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 101
03:00:00:02:00:00IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 110
03:00:00:01:00:00IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 111

References


How to recognise an AppleTalk protocols by MAC address?

Summary

Range or PrefixApplication
09:00:07:00:00:00 - 09:00:07:00:00:FCAppleTalk zone multicast addresses (EtherType is 0x0802)
09:00:07:FF:FF:FFAppleTalk broadcast address (EtherType is 0x0802)

References


How to recognise a TRILL protocols by MAC address?

Transparent Interconnection of Lots of Links (TRILL) is the IETF specification that enables multipathing in the data center. The TRILL protocol provides transparent Layer 2 forwarding using encapsulation with a hop count and IS-IS link state routing.

Summary

Range or PrefixApplication
00:00:5E:90:01:00 - 00:00:5E:90:01:00TRILL OAM
01:00:5E:90:01:00TRILL OAM
01:80:C2:00:00:40 - 01:80:C2:00:00:4FGroup MAC addresses used by the TRILL protocols

References


How to recognise an IEEE 802.1X MAC address application?

IEEE 802.1X is part of the IEEE 802.1 group of networking protocols which defines standards for passing data across wired or wireless networks.

Range or PrefixApplicationNotes
01:0C:CD:01:00:00 - 01:0C:CD:01:01:FFIEC 61850-8-1 GOOSE Type 1/1AEtherType is 0x88B8
01:0C:CD:02:00:00 - 01:0C:CD:02:01:FFGSSE (IEC 61850 8-1)EtherType is 0x88B9
01:0C:CD:04:00:00 - 01:0C:CD:04:01:FFMulticast sampled values (IEC 61850 8-1)EtherType is 0x88BA
01:1B:19:00:00:00General group addressAn 802.1Q VLAN Bridge would forward the frame unchanged.
01:1B:19:00:00:00Precision Time Protocol (PTP) version 2 over EthernetEtherType is 0x88F7
01:80:C2:00:00:00Bridge Group address Nearest Customer Bridge group address
01:80:C2:00:00:00Spanning Tree Protocol (for bridges) IEEE 802.1DEtherType is 0x0802
01:80:C2:00:00:00Link Layer Discovery ProtocolEtherType is 0x88CC
01:80:C2:00:00:00 - 01:80:C2:00:00:0FThe initial bridging/link protocols block
01:80:C2:00:00:00 - 01:80:C2:00:00:0FIEEE 802.1D MAC Bridge Filtered MAC Group Addresses
01:80:C2:00:00:00 - 01:80:C2:00:00:0FIEEE Pause, 802.3x
01:80:C2:00:00:0AReserved for future standardization
01:80:C2:00:00:0BEDE-SS PEP Address
01:80:C2:00:00:0CReserved for future standardization
01:80:C2:00:00:0DProvider Bridge MVRP address
01:80:C2:00:00:0EIndividual LAN Scope group addressIt is intended that no IEEE 802.1 relay device will be defined that will forward frames that carry this destination address
01:80:C2:00:00:0ENearest Bridge group address
01:80:C2:00:00:0ELink Layer Discovery ProtocolEtherType is 0x88CC
01:80:C2:00:00:0EPrecision Time Protocol (PTP) version 2 over EthernetEtherType is 0x88F7
01:80:C2:00:00:01IEEE MAC-specific Control Protocols group address
01:80:C2:00:00:01Ethernet flow control (Pause frame) IEEE 802.3xEtherType is 0x8808
01:80:C2:00:00:1AGeneric Address for All Agent Stations
01:80:C2:00:00:1BAll Multicast Capable End Systems address
01:80:C2:00:00:1CAll Multicast Announcements address
01:80:C2:00:00:1DAll Multicast Capable Intermediate Systems address
01:80:C2:00:00:1EAll DTR Concentrators MAC group address
01:80:C2:00:00:1FEDE-CC PEP Address
01:80:C2:00:00:01 - 01:80:C2:00:00:0F802.1 alternate Spanning multicastEtherType is 0x0802
01:80:C2:00:00:02Ethernet OAM Protocol IEEE 802.3ah (also known as "slow protocols")EtherType is 0x8809
01:80:C2:00:00:03Nearest non-TPMR Bridge group address IEEE Std 802.1X PAE address
01:80:C2:00:00:03Link Layer Discovery ProtocolEtherType is 0x88CC
01:80:C2:00:00:04IEEE MAC-specific Control Protocols group address
01:80:C2:00:00:05Reserved for future standardization
01:80:C2:00:00:06Reserved for future standardization
01:80:C2:00:00:07MEF Forum ELMI protocol group address
01:80:C2:00:00:08Provider Bridge group address
01:80:C2:00:00:08Spanning Tree Protocol (for provider bridges) IEEE 802.1adEtherType is 0x0802
01:80:C2:00:00:09Reserved for future standardization
01:80:C2:00:00:10All LANs Bridge Management group address (deprecated)
01:80:C2:00:00:10Bridge ManagementEtherType is 0x0802
01:80:C2:00:00:11Load Server generic address
01:80:C2:00:00:11Load ServerEtherType is 0x0802
01:80:C2:00:00:12Loadable Device generic address
01:80:C2:00:00:12Loadable DeviceEtherType is 0x0802
01:80:C2:00:00:13Transmission of IEEE 1905.1 control packets
01:80:C2:00:00:14All Level 1 Intermediate Systems address
01:80:C2:00:00:14OSI Route level 1 (within area)EtherType is 0x0802
01:80:C2:00:00:15All Level 2 Intermediate Systems address
01:80:C2:00:00:15OSI Route level 2 (between area)EtherType is 0x0802
01:80:C2:00:00:16All CONS End Systems address
01:80:C2:00:00:17All CONS SNARES address
01:80:C2:00:00:18Generic address for All Manager Stations
01:80:C2:00:00:19Groupcast with retries (GCR) MAC group address
01:80:C2:00:00:20 - 01:80:C2:00:00:2FReserved for use by Multiple Registration Protocol (MRP) applications
01:80:C2:00:00:21GARP VLAN Registration Protocol (also known as IEEE 802.1q GVRP)EtherType is 0x88f5
01:80:C2:00:00:30 - 01:80:C2:00:00:3FDestination group MAC addresses for CCM and Linktrace messages
01:80:C2:00:00:30 - 01:80:C2:00:00:3FEthernet CFM Protocol IEEE 802.1agEtherType is 0x8902
01:80:C2:00:00:50 - 01:80:C2:00:00:FFUnassigned standard group MAC address
01:80:C2:00:01:00Ring Management Directed Beacon multicast address
01:80:C2:00:01:00FDDI RMT Directed BeaconEtherType is 0x0802
01:80:C2:00:01:01 - 01:80:C2:00:01:0FAssigned to ISO/IEC JTC1/SC25 for future use
01:80:C2:00:01:10Status Report Frame Status Report Protocol multicast address
01:80:C2:00:01:10FDDI status report frameEtherType is 0x0802
01:80:C2:00:01:11 - 01:80:C2:00:01:1FAssigned to ISO/IEC JTC1/SC25 for future use
01:80:C2:00:01:20All FDDI Concentrator MACs
01:80:C2:00:01:21 - 01:80:C2:00:01:2FAssigned to ISO/IEC JTC1/SC25 for future use
01:80:C2:00:01:30Synchronous Bandwidth Allocation address
01:80:C2:00:01:31 - 01:80:C2:00:01:FFAssigned to ISO/IEC JTC1/SC25 for future use
01:80:C2:00:02:00 - 01:80:C2:00:02:FFAssigned to ETSI for future use
01:80:C2:00:03:00 - 01:80:C2:FF-FF-FFUnassigned standard group MAC address
09:00:4C:00:00:00BICC 802.1 managementEtherType is 0x0802
09:00:4C:00:00:0CBICC Remote bridge STA 802.1(D) Rev8EtherType is 0x0802
09:00:4C:00:00:02BICC 802.1 managementEtherType is 0x0802
09:00:4C:00:00:06BICC Local bridge STA 802.1(D) Rev6EtherType is 0x0802
33:33:00:00:00:00 - 33:33:FF:FF:FF:FFIPv6 multicastEtherType is 0x86DD

How to recognise an ISO 9542 ES-IS protocol's MAC address application?

ISO-9542 ES-IS (End System to Intermediate System) is a protocol which provides interaction between end-systems (hosts) and intermediate systems (routers). This protocol is a link layer protocol equivalent of Internet layer's ARP (Address Resolution Protocol).

Summary

Range or PrefixApplication
09:00:2B:00:00:04All End System Network Entities address
09:00:2B:00:00:05All Intermediate System Network Entities address

References


How to recognise an IANA MAC address application?

Summary

Range or PrefixApplication
00:00:5E:00-52:14 - 00:00:5E:00:52:FFUnassigned (small allocations)
00:00:5E:00:00:00 - 00:00:5E:00:00:FFReserved and require IESG Ratification for assignment
00:00:5E:00:03:00 - 00:00:5E:00:51:FFUnassigned
00:00:5E:00:52:00 - 00:00:5E:00:52:FFIs used for very small assignments. Currently, 3 out of these 256 values have been assigned.
00:00:5E:00:52:00 - 00:00:5E:00:52:00PacketPWEthA
00:00:5E:00:52:01 - 00:00:5E:00:52:01PacketPWEthB
00:00:5E:00:52:02 - 00:00:5E:00:52:12Unassigned (small allocations)
00:00:5E:00:53:00 - 00:00:5E:00:53:FFAssigned for use in documentation
00:00:5E:00:54:00 - 00:00:5E:90:00:FFUnassigned
00:00:5E:90:01:01 - 00:00:5E:90:01:FFUnassigned (small allocations requiring both unicast and multicast)
00:00:5E:EF:10:00:00:00 - 00:00:5E:EF:10:00:00:FFGeneral documentation
00:00:5E:FF:FE:00:53:00 - 00:00:5E:FF:FE:00:53:FFEUI-48 derived documentation
01:00:5E:00:00:00 - 01:00:5E:7F:FF:FFDoD Internet Multicast (EtherType is 0x0800)
01:00:5E:80:00:00 - 01:00:5E:FF:FF:FFDoD Internet
01:00:5E:90:00:02AllL1MI-ISs
01:00:5E:90:00:03AllL2MI-ISs
01:00:5E:90:00:04 - 01:00:5E:90:00:FFUnassigned (small allocations)
01:00:5E:90:01:01 - 01:00:5E:90:01:FFUnassigned (small allocations requiring both unicast and multicast)
01:00:5E:90:02:00 - 01:00:5E:90:0F:FFUnassigned
01:00:5E:90:02:00 - 00:00:5E:FF:FF:FFUnassigned
01:00:5E:90:10:00 - 01:00:5E:90:10:FFDocumentation
01:00:5E:90:11:00 - 01:00:5E:FF:FF:FFUnassigned
01:00:5E:EF:10:00:00:00 - 01:00:5E:EF:10:00:00:FFGeneral documentation
02:00:5E:00:00:00:00:00 - 02:00:5E:0F:FF:FF:FF:FFReserved
02:00:5E:10:00:00:00:00 - 02:00:5E:10:00:00:00:FFDocumentation
02:00:5E:10:00:00:01:00 - 02:00:5E:EF:FF:FF:FF:FFUnassigned
02:00:5E:F0:00:00:00:00 - 02:00:5E:FD:FF:FF:FF:FFReserved
02:00:5E:FE:00:00:00:00 - 02:00:5E:FE:FF:FF:FF:FFIPv4 Addr Holders
02:00:5E:FF:00:00:00:00 - 02:00:5E:FF:FD:FF:FF:FFReserved
02:00:5E:FF:FE:00:00:00 - 02:00:5E:FF:FE:FF:FF:FFIANA EUI-48 Holders
02:00:5E:FF:FF:00:00:00 - 02:00:5E:FF:FF:FF:FF:FFReserved
03:00:5E:00:00:00:00:00 - 03:00:5E:0F:FF:FF:FF:FFReserved
03:00:5E:10:00:00:00:00 - 03:00:5E:10:00:00:00:FFDocumentation
03:00:5E:10:00:00:01:00 - 03:00:5E:EF:FF:FF:FF:FFUnassigned
03:00:5E:F0:00:00:00:00 - 03:00:5E:FD:FF:FF:FF:FFReserved
03:00:5E:FF:00:00:00:00 - 03:00:5E:FF:FD:FF:FF:FFReserved
03:00:5E:FF:FE:00:00:00 - 03:00:5E:FF:FE:FF:FF:FFIANA EUI-48 Holders
03:00:5E:FF:FF:00:00:00 - 03:00:5E:FF:FF:FF:FF:FFReserved

References


How to recognise a Cisco's MAC address application?

Summary

Range or PrefixApplicationNotes
01:00:0C:00:00:00Inter Switch Link (ISL)
01:00:0C:CC:CC:CCCDP (Cisco Discovery Protocol), VTP (VLAN Trunking Protocol)EtherType is 0x0802
01:00:0C:CC:CC:CCPort Aggregation Protocol (PAgP)SNAP HDLC Protocol Type is 0x0104
01:00:0C:CC:CC:CCUnidirectional Link Detection (UDLD)SNAP HDLC Protocol Type is 0x0111
01:00:0C:CC:CC:CCDynamic Trunking (DTP)SNAP HDLC Protocol Type is 0x2004
01:00:0C:CC:CC:CCVLAN Trunking (VTP)SNAP HDLC Protocol Type is 0x2003
01:00:0C:CC:CC:CDCisco Shared Spanning Tree Protocol addressEtherType is 0x0802
01:00:0C:CC:CC:CDSpanning Tree PVSTP+SNAP HDLC Protocol Type is 0x010B
01:00:0C:CD:CD:CDSTP Uplink FastSNAP HDLC Protocol Type is 0x200A
01:00:0C:CD:CD:CEVLAN BridgeSNAP HDLC Protocol Type is 0x010C
01:00:0C:DD:DD:DDCGMP (Cisco Group Management Protocol)

References


How to recognise an ITU-T's MAC address application?

Summary

Range or PrefixApplication
01:19:A7:00:00:00 - 01:19:A7:00:00:FFR-APS per G.8032
01:19:A7:52:76:90 - 01:19:A7:52:76:9FMulticast per G.9961

References


How to recognise Digital Equipment Corporation's MAC address application?

Summary

Range or PrefixApplicationNotes
09:00:2B:00:00:00DEC MUMPSEtherType is 0x6009
09:00:2B:00:00:0FDEC Local Area Transport (LAT)EtherType is 0x6004
09:00:2B:00:00:01DEC DSM/DDPEtherType is 0x8039
09:00:2B:00:00:10 - 09:00:2B:00:00:1FDEC Experimental
09:00:2B:00:00:02DEC VAXELNEtherType is 0x803B
09:00:2B:00:00:03DEC Lanbridge Traffic Monitor (LTM)EtherType is 0x8038
09:00:2B:00:00:04DEC MAP End System
09:00:2B:00:00:05DEC MAP Intermediate System
09:00:2B:00:00:06DEC CSMA/CD EncryptionEtherType is 0x803D
09:00:2B:00:00:07DEC NetBios EmulatorEtherType is 0x8040
09:00:2B:01:00:00DEC LanBridgeEtherType is 0x8038
09:00:2B:01:00:01DEC LanBridgeEtherType is 0x8038
09:00:2B:02:00:00DEC DNA Level 2 Routing
09:00:2B:02:01:00DEC DNA Naming Service AdvertisementEtherType is 0x803C
09:00:2B:02:01:01DEC DNA Naming Service SolicitationEtherType is 0x803C
09:00:2B:02:01:02DEC Distributed Time ServiceEtherType is 0x803E
09:00:2B:02:01:09DEC Availability Manager for Distributed Systems DECamdsEtherType is 0x8048
09:00:2B:03:00:00 - 09:00:2B:03:FF:FFDEC default filtering by bridges
09:00:2B:04:00:00DEC Local Area System Transport (LAST)EtherType is 0x8041
09:00:2B:23:00:00DEC Argonaut ConsoleEtherType is 0x803A
AB:00:00:01:00:00DEC Maintenance Operation Protocol (MOP) Dump/Load AssistanceEtherType is 0x6001
AB:00:00:02:00:00DEC Maintenance Operation Protocol (MOP)EtherType is 0x6002
AB:00:00:03:00:00DECNET Phase IV end nodeEtherType is 0x6003
AB:00:00:04:00:00DECNET Phase IV RouterEtherType is 0x6003
AB:00:00:05:00:00 - AB:00:03:FF:FF:FFReserved DEC
AB:00:03:00:00:00DEC Local Area Transport (LAT) - oldEtherType is 0x6004
AB:00:04:00:00:00 - AB:00:04:00:FF:FFReserved DEC customer private use
AB:00:04:01:00:00 - AB:00:04:01:FF:FFDEC Local Area VAX Cluster groups System Communication Architecture (SCA)

EtherType is 0x6007

Wireshark notes

Our MAC Address API outputs a field called macAddressDetails.wiresharkNotes. For some specific OUIs or exact MAC addresses, Wireshark provides extra details which may help to recognize the MAC address application or indicate an actual vendor rather than the original assignment.

If Wireshark doesn't provide any new information, this field outputs "No details".

MAC address details enrichment with Wireshark DB

Pricing plans for all team sizes

MAC Address Data Feed provides daily data in CSV, JSON and XML formats. Please note that our service is for registered companies only. Requests from private individuals or emails that don't match the company domain name are ignored.

Billed MonthlyBilled Annually🎁 2 months FREE
MAC AddressStartup

$99 / month

< 100 employees

Daily updates

Four data formats

MAC AddressBusiness

$499 / month

101 - 500 employees

Daily updates

Four data formats

Dedicated support

MAC AddressEnterprise

Ask for a quote

> 500 employees

Daily updates

Four data formats

Dedicated support

You’ll be in good company

FlexWebAfricaWeWorkGuardDogCyberCNS

Contact Us

Got a technical issue? Want to send feedback about data feeds? Need details about our plans? Let us know. Please note that our service is for registered companies only. Requests from private individuals or emails that don't match the company domain name are ignored.