How to recognise an Oracle Virtual machine by its MAC address | FAQ | MAC Address Vendor Lookup
Frequently asked questions
? ? ?

How to recognise an Oracle Virtual machine by its MAC address

Summary

# Range or Prefix Vendor Virtual Machine
1 08:00:27 Pcs Systemtechnik GmbH Oracle VirtualBox 5.2
2 52:54:00 (Exact MAC: 52:54:00:C9:C7:04) N/A Oracle VirtualBox 5.2 + Vagrant
3 00:21:F6 Oracle Corp Oracle VirtualBox 3.3
4 00:14:4F Oracle Corp Oracle VM Server for SPARC
5 00:0F:4B Oracle Corp Oracle Virtual Iron 4

OUIs registered by Oracle corp

There are 15 OUI registered by Oracle corp:

OUI Assignment Type
00:10:E0MA-L
00:00:7DMA-L
00:21:28MA-L
00:01:5DMA-L
00:21:F6MA-L
00:A0:A4MA-L
00:07:82MA-L
00:03:BAMA-L
08:00:20MA-L
2C:C2:60MA-L
00:10:4FMA-L
00:0F:4BMA-L
00:13:97MA-L
00:20:F2MA-L
00:14:4FMA-L

Only some of them are used for the Virtual Machines.

Detection Rule 1

Affects products: Oracle VirtualBox

Signature: OUI is 08:00:27

Details

Once new VM has been created with the VirtualBox GUI, it has a MAC address with OUI prefix set automatically. When the administrator presses "refresh" button, the last 3 octets are changed, but the prefix remains.

Once new VM has been created with the VirtualBox GUI, it has a MAC address with OUI prefix set automatically.

However, it's possible to set a custom MAC with any prefix.

However, it's possible to set a custom MAC with any prefix.

Example MACs generated

  • 08:00:27:3F:FE:0F
  • 08:00:27:78:8D:0D
  • 08:00:27:BB:05:3F
  • 08:00:27:FD:B6:EF

References

Tested on

  • VirtualBox 5.1.26

Detection Rule 2

Affects products: Oracle VirtualBox / Vagrant

Signature: Prefix is 52:54:00, or Prefix is 52:54:00:C9:C7:04

Details

Once a new VM has been created with the Vagrant, it sometimes has a MAC address with prefix 52:54:00. Some virtual machines have the same MAC: 52:54:00:C9:C7:04.

Once a new VM has been created with the Vagrant, it sometimes has a MAC address with prefix 52:54:00.

Example MACs generated

  • 52:54:00:CA:E4:8B
  • 52:54:00:C9:C7:04

Tested on

  • VirtualBox 5.1.26

Detection Rule 3

Affects products: Oracle VirtualBox 3.3

Signature: OUI is 00:21:F6

Details

Oracle wrote in their blog that they used OUI 00:21:F6 for virtual machines. This VirtualBox version isn't supported anymore.

References

Detection Rule 4

Affects products: Oracle VM Server for SPARC

Signature: OUI is 00:14:4F

Details

Domains have been assigned the following block of 512K MAC addresses:

  • 00:14:4F:F8:00:00 ~ 00:14:4F:FF:FF:FF

The lower 256K addresses are used by the Logical Domains Manager for automatic MAC address allocation, and you cannot manually request an address in this range:

  • 00:14:4F:F8:00:00 - 00:14:4F:FB:FF:FF

You can use the upper half of this range for manual MAC address allocation:

  • 00:14:4F:FC:00:00 - 00:14:4F:FF:FF:FF

References

Detection Rule 5

Affects products: Oracle Virtual Iron 4

Signature: OUI is 00:0F:4B

References

Virtual Machine’s MAC ranges

Have questions?

We work hard to improve our services for you. As part of that process we welcome your feedback, questions and suggestions. Please let us know your thoughts and feelings, and any way in which you think we can improve our product.

Shoot us an email to support@macaddress.io or just fill in the contact form.

The data was just refreshed