Locally vs Universally Administered MAC Addresses

Every MAC address quietly answers a question in its very first byte: was I assigned by a hardware manufacturer, or by software? That answer is the difference between a universally administered address (UAA) and a locally administered address (LAA), and it is controlled by a single bit.

Understanding that bit matters more than it sounds. It is the reason MAC randomization on your phone does not collide with real devices, the reason virtual machines can safely invent their own addresses, and the setting you should almost always choose when generating MAC addresses for tests. Let's unpack it.

The Two Special Bits in the First Octet

A MAC address is six bytes. Two flags live in the first byte (the first two hex digits), and both are read from the least-significant end:

• Bit 0 — the I/G bit (Individual/Group): 0 means unicast (one device), 1 means multicast (a group).
• Bit 1 — the U/L bit (Universal/Local): 0 means universally administered, 1 means locally administered.

It is bit 1, the U/L bit, that decides whether an address is universal or local.

Take the first byte 0x00 = 00000000 in binary. Bit 1 is 0, so this is a universally administered address. Now flip bit 1 on: 00000010 = 0x02. That same address is now locally administered.

Universally Administered Addresses (UAA)

A universally administered address is the MAC burned into a network interface at the factory. The manufacturer obtains an OUI (Organizationally Unique Identifier) block from the IEEE, uses it as the first three bytes, and assigns a unique value in the last three bytes for each device it produces. The IEEE coordinates OUI assignments globally, which is what makes these addresses globally unique — no two factory-assigned MACs should ever be the same.

When you look up a MAC and see a real vendor like Apple, Cisco, or Intel, you are looking at a UAA. The MAC address lookup tool resolves these vendor prefixes against a database of 38,000+ registered OUIs.

Key traits of a UAA:

• Assigned by the hardware vendor, not the user
• Globally unique, coordinated by the IEEE
• The OUI maps to a real manufacturer
• U/L bit = 0

Locally Administered Addresses (LAA)

A locally administered address is one that software sets, overriding or replacing the factory address. Nobody coordinates these globally — the only rule is that they should be unique within the local network you are using them on. Because the U/L bit is set to 1, any system reading the address knows it was not handed out by a manufacturer.

This is exactly what happens when:

• Your phone uses MAC randomization for Wi-Fi privacy
• A virtual machine or container gets a generated MAC
• You manually change (spoof) your adapter's MAC
• A tool generates a fake MAC for test data

In every one of those cases, the responsible thing is to set the U/L bit so the address advertises itself as locally administered.

Key traits of an LAA:

• Assigned by software or the user
• Only needs to be unique on the local segment
• The OUI is meaningless (it does not map to a real vendor)
• U/L bit = 1

How to Tell Which One You Have

You only need the second hex digit of the address. Look at whether that digit, in binary, has bit 1 set:

The quick mental shortcut for the common unicast case: if the second hex digit is 2, 6, A, or E, the address is locally administered. So 02:1A:2B:3C:4D:5E is local, while 00:1A:2B:3C:4D:5E is universal.

You can verify any address instantly by pasting it into the MAC address lookup tool, which reports the administration type along with the vendor.

Setting the U/L Bit in Code

To turn any address into a locally administered one, set bit 1 of the first byte:

function makeLocal(firstByte) {
  return firstByte | 0x02; // force U/L bit on
}
makeLocal(0x00).toString(16); // "2"  -> 0x00 becomes 0x02

To force it universal instead, clear that bit:

function makeUniversal(firstByte) {
  return firstByte & ~0x02; // force U/L bit off
}

A complete random LAA generator in Python looks like this:

import random

def random_laa():
    first = (random.randint(0, 255) | 0x02) & ~0x01  # local + unicast
    rest = [random.randint(0, 255) for _ in range(5)]
    return ':'.join(f'{b:02x}' for b in [first] + rest)

print(random_laa())  # e.g. "ba:4f:1c:90:2d:e7"

Notice the two operations on the first byte: | 0x02 sets the U/L bit (local), and & ~0x01 clears the I/G bit (unicast). That combination is the sweet spot for test data.

Which Should You Use for Testing?

For almost all generated or test addresses, choose locally administered, unicast. Here is why:

• No collisions with real hardware. Because the address is flagged as local, it lives in a separate space from IEEE-assigned addresses. You cannot accidentally generate a MAC that belongs to a shipping product.
• It is honest. Anyone inspecting the address sees the local bit and knows it was software-assigned, not a real device.
• It matches what real systems do. OS-level MAC randomization and hypervisors already set this bit, so your test data behaves like the real world.

When would you pick universal instead? Only when you specifically need an address that looks like real vendor hardware — for example, building a realistic fixture that should resolve to Apple or VMware in a vendor-lookup test. In that case you would choose a known OUI prefix and leave the U/L bit clear.

The random MAC generator exposes both options. Its "Local" administration setting flips the U/L bit for you, and selecting a vendor OUI produces a universal-style address with a real manufacturer prefix — so you can model whichever scenario your test needs. To go deeper on the privacy side of local addresses, see the guide on MAC address randomization.

A Note on Locally Administered Ranges

Because anyone can mint a local address, large environments sometimes carve out their own structured LAA ranges to avoid internal clashes. The IEEE even defines optional sub-divisions of the local space (known as SLAP quadrants) for organizations that want coordinated local addressing. For everyday testing you do not need any of that — a random local unicast address is more than sufficient. Just remember the golden rule: if you are inventing the address yourself, set the U/L bit.

FAQ

What is the difference between a locally and universally administered MAC address?

A universally administered address (UAA) is burned in by the hardware manufacturer and is globally unique, coordinated by the IEEE. A locally administered address (LAA) is set by software or the user and only needs to be unique on the local network. The U/L bit — bit 1 of the first byte — distinguishes them: 0 for universal, 1 for local.

How do I know if a MAC address is locally administered?

Check the second hex digit. For a unicast address, if it is 2, 6, A, or E, the U/L bit is set and the address is locally administered. If it is 0, 4, 8, or C, the address is universally administered. You can also paste the MAC into the MAC address lookup tool, which reports the administration type directly.

Should I use a local or universal MAC for test data?

Use locally administered, unicast for almost all test data. It cannot collide with real IEEE-assigned hardware and clearly signals that the address is software-generated. Choose a universal-style address with a real vendor OUI only when you specifically need a fixture that looks like genuine manufacturer hardware.

Does setting the locally administered bit change anything functionally?

Not for normal traffic — a local MAC works exactly like a universal one for sending and receiving frames. The bit is informational: it tells other systems the address was assigned locally rather than by a manufacturer. Some enterprise networks with MAC-based access control may treat local addresses differently, so check the network policy if you are spoofing on managed infrastructure.

Why do phones use locally administered addresses for Wi-Fi?

For privacy. Modern phones generate a random, locally administered MAC for each Wi-Fi network so that stores, airports, and trackers cannot follow a device by its permanent hardware address. Setting the local bit ensures these randomized addresses never collide with real factory-assigned MACs. The MAC randomization guide covers this in detail.

Can two locally administered addresses be identical?

Yes, because no global authority coordinates them — uniqueness is only guaranteed within a single network segment. With 46 usable random bits the odds of an accidental clash are tiny, but it is theoretically possible. For generated test batches, ensure uniqueness within your own dataset rather than assuming global uniqueness.