MAC Address Lookup

Six bytes, split down the middle

A MAC address is 48 bits written as six bytes. The first three bytes are the Organisationally Unique Identifier, a block the IEEE sells to a manufacturer. The last three are chosen by that manufacturer to make each interface it builds unique. That split is the whole basis of vendor lookup: you are not identifying the device, you are identifying who bought the number range it came from.

This has a consequence people often miss. The vendor is whoever made the network chipset, not necessarily whoever put their logo on the box. A laptop frequently reports the wireless chip manufacturer rather than the laptop brand, and a virtual machine reports the hypervisor because the address was generated by the virtualisation layer.

Notation is purely cosmetic. Colon-separated pairs, hyphen-separated pairs, Cisco's three groups of four and bare hex all describe the same 48 bits. Vendors and operating systems simply disagree about presentation, which is why converting between them is such a common chore.

Two bits that change the meaning

The second-lowest bit of the very first byte is the universal/local flag. When it is clear, the address came from an IEEE-assigned block and vendor lookup is meaningful. When it is set, the address was chosen locally and no registry will ever contain it, so a lookup miss is the expected result rather than a gap in the data.

That bit is why modern phones and laptops appear to have no vendor. Randomised MAC addresses, now the default for Wi-Fi scanning and often for connecting too, deliberately set the local bit precisely so they cannot be traced back to a manufacturer or matched across networks. If you see a locally administered address, privacy randomisation is by far the most likely explanation.

The lowest bit of the first byte is the unicast/multicast flag. Clear means the frame is for one interface; set means it addresses a group. The broadcast address, all forty-eight bits set, is simply the extreme case. A multicast bit on what you expected to be a device address is usually a sign you are looking at a protocol address rather than hardware.

From MAC to IPv6, and why it stopped

The modified EUI-64 shown here is how IPv6 addresses used to be built from hardware. The recipe inserts the bytes FF and FE into the middle of the MAC and flips the universal/local bit, producing a 64-bit interface identifier that gets appended to a network prefix.

It works, and it is completely deterministic, which turned out to be the problem. An address derived this way carries your hardware identity into every network you join, letting anyone correlate your traffic across locations. RFC 8981 privacy extensions and RFC 7217 stable-but-opaque identifiers replaced the practice, and modern systems no longer derive addresses from the MAC by default.

The conversion is still worth understanding, because it is exactly what makes an fe80:: link-local address readable. Seeing the FF FE pattern in the middle of an interface identifier tells you at a glance that it was derived from a MAC, and lets you recover the original hardware address from it.