How to recognise an Oracle Virtual machine by its MAC address? | FAQ | MAC Address Vendor Lookup
Frequently asked questions

How to recognise an Oracle Virtual machine by its MAC address?

Summary

# Range or Prefix Vendor Virtual Machine
1 08:00:27 Pcs Systemtechnik GmbH Oracle VirtualBox 5.2
2 52:54:00 (Exact MAC: 52:54:00:C9:C7:04) N/A Oracle VirtualBox 5.2 + Vagrant
3 00:21:F6 Oracle Corp Oracle VirtualBox 3.3
4 00:14:4F Oracle Corp Oracle VM Server for SPARC
5 00:0F:4B Oracle Corp Oracle Virtual Iron 4

OUIs registered by Oracle corp

There are 15 OUI registered by Oracle corp:

OUI Assignment Type
00:10:E0MA-L
00:00:7DMA-L
00:21:28MA-L
00:01:5DMA-L
00:21:F6MA-L
00:A0:A4MA-L
00:07:82MA-L
00:03:BAMA-L
08:00:20MA-L
2C:C2:60MA-L
00:10:4FMA-L
00:0F:4BMA-L
00:13:97MA-L
00:20:F2MA-L
00:14:4FMA-L

Only some of them are used for the Virtual Machines.

Detection Rule 1

Affects products: Oracle VirtualBox

Signature: OUI is 08:00:27

Details

Once new VM has been created with the VirtualBox GUI, it has a MAC address with OUI prefix set automatically. When the administrator presses "refresh" button, the last 3 octets are changed, but the prefix remains.

Once new VM has been created with the VirtualBox GUI, it has a MAC address with OUI prefix set automatically.

However, it's possible to set a custom MAC with any prefix.

However, it's possible to set a custom MAC with any prefix.

Example MACs generated

  • 08:00:27:3F:FE:0F
  • 08:00:27:78:8D:0D
  • 08:00:27:BB:05:3F
  • 08:00:27:FD:B6:EF

References

Tested on

  • VirtualBox 5.1.26

Detection Rule 2

Affects products: Oracle VirtualBox / Vagrant

Signature: Prefix is 52:54:00, or Prefix is 52:54:00:C9:C7:04

Details

Once a new VM has been created with the Vagrant, it sometimes has a MAC address with prefix 52:54:00. Some virtual machines have the same MAC: 52:54:00:C9:C7:04.

Once a new VM has been created with the Vagrant, it sometimes has a MAC address with prefix 52:54:00.

Example MACs generated

  • 52:54:00:CA:E4:8B
  • 52:54:00:C9:C7:04

Tested on

  • VirtualBox 5.1.26

Detection Rule 3

Affects products: Oracle VirtualBox 3.3

Signature: OUI is 00:21:F6

Details

Oracle wrote in their blog that they used OUI 00:21:F6 for virtual machines. This VirtualBox version isn't supported anymore.

References

Detection Rule 4

Affects products: Oracle VM Server for SPARC

Signature: OUI is 00:14:4F

Details

Domains have been assigned the following block of 512K MAC addresses:

  • 00:14:4F:F8:00:00 ~ 00:14:4F:FF:FF:FF

The lower 256K addresses are used by the Logical Domains Manager for automatic MAC address allocation, and you cannot manually request an address in this range:

  • 00:14:4F:F8:00:00 - 00:14:4F:FB:FF:FF

You can use the upper half of this range for manual MAC address allocation:

  • 00:14:4F:FC:00:00 - 00:14:4F:FF:FF:FF

References

Detection Rule 5

Affects products: Oracle Virtual Iron 4

Signature: OUI is 00:0F:4B

References

Virtual Machine’s MAC ranges

Trusted by the following companies

Flex.com webafrica.co.za wework.com guarddog.ai cybercns.com

and many more...

Download an exhaustive MAC Address Vendor Database for your educational, business or enterprise needs.

Our database comes in the following forms: JSON, CSV, XML, Cisco vendorMacs.xml for maximum compatibility and fast integration into existing systems.

Order database
The data was just refreshed