Understanding OUI: MAC Address Manufacturers Guide

Ever wondered how your router knows that new device connecting to your Wi-Fi is an iPhone, or how network admins can spot unauthorized hardware at a glance? The answer lies in a six-character prefix embedded in every MAC address—a unique fingerprint that reveals exactly who manufactured your device.

This prefix, called an Organizationally Unique Identifier (OUI), is like a digital birth certificate for network hardware. Whether you're a developer debugging network issues, a sysadmin securing infrastructure, or just curious about the devices on your network, understanding OUI can give you surprisingly powerful insights. In this guide, we'll demystify OUI, show you how to look them up, and explore why they matter in modern networking.

What Is an OUI (Organizationally Unique Identifier)?

An Organizationally Unique Identifier (OUI) is a 24-bit (3-byte) number assigned by the IEEE Registration Authority to hardware manufacturers. It forms the first half of a MAC address and uniquely identifies the organization that manufactured the network interface card (NIC).

Think of it as a manufacturer's stamp. When Apple registers an OUI with the IEEE, every iPhone, MacBook, and iPad they produce gets a MAC address starting with that prefix. The same goes for Samsung smartphones, Intel network adapters, Cisco routers, and virtually every networked device in existence.

The Anatomy of an OUI

In a standard 48-bit MAC address like 00:1A:C2:7B:00:47, the OUI is the first three bytes:

• OUI: 00:1A:C2 (identifies the manufacturer)
• NIC-specific: 7B:00:47 (uniquely identifies this specific device)

The OUI portion is globally unique and controlled by IEEE, while the manufacturer can assign the last three bytes however they want—as long as they ensure no two devices with the same OUI get the same full MAC address.

Why OUI Exists

Before OUI standardization, MAC address assignment was chaotic. The IEEE introduced the OUI system to:

1. Prevent collisions: Ensure globally unique MAC addresses across billions of devices
2. Enable identification: Allow network tools to identify device manufacturers
3. Support accountability: Create a traceable record of who's producing network hardware
4. Facilitate management: Help network admins track and inventory devices

How OUI Assignment Works

Getting an OUI isn't as simple as filling out a form—it's a formal registration process managed by the IEEE Registration Authority (IEEE RA), and it comes with fees and responsibilities.

OUI Assignment Tiers

The IEEE offers three types of assignments, depending on how many devices you plan to manufacture:

MA-L is the traditional OUI—you get a full 24-bit prefix and can create over 16 million unique MAC addresses. This is what most major tech companies purchase.

MA-M and MA-S are newer, more cost-effective options for smaller manufacturers. They share a larger OUI space but give you a smaller pool of addresses.

The Registration Process

1. Application: Submit a registration request to IEEE RA with company information
2. Payment: Pay the one-time fee (no recurring costs)
3. Assignment: IEEE issues your unique OUI prefix
4. Publication: Your OUI is published in the public IEEE OUI database
5. Management: You're responsible for assigning unique MAC addresses within your block

Once assigned, your OUI is yours forever. There's no renewal fee, though updating company information costs $590.

Who Can Get an OUI?

Any organization—corporations, universities, government agencies, even individuals—can register for an OUI. However, you must be manufacturing or planning to manufacture network-capable devices. The IEEE doesn't assign OUIs for hobbyist projects or virtual devices (those typically use locally administered addresses).

OUI Structure Within a MAC Address

Let's break down exactly how an OUI fits into a MAC address and what each bit means.

The 48-Bit MAC Address Format

A standard MAC address consists of 6 bytes (48 bits), typically written in hexadecimal with colons or hyphens:

00:1A:C2:7B:00:47
│  │  │  │  │  │
└──┴──┴──┘  └──┴──┘
   OUI      Device ID
(24 bits)   (24 bits)

Special Bits in the OUI

The first byte of the OUI contains two important flags:

Bit 0 (LSB of first byte) - I/G Bit (Individual/Group):

• 0 = Unicast (normal device address)
• 1 = Multicast/Broadcast

Bit 1 (second LSB) - U/L Bit (Universal/Local):

• 0 = Globally unique (IEEE-assigned OUI)
• 1 = Locally administered (manually configured, not in IEEE database)

Example:

00:1A:C2:XX:XX:XX
└┬┘
 └─ 0x00 in binary: 00000000
                     ││
                     │└─ Bit 0 = 0 (Unicast)
                     └── Bit 1 = 0 (Globally Unique)

This is why you'll notice many OUIs start with even numbers (00, 02, 04, etc.)—the U/L and I/G bits are typically 0 for standard device assignments.

Binary Breakdown

Let's examine the OUI 00:1A:C2 in detail:

   00        1A        C2
00000000  00011010  11000010
││             
│└─ Bit 1 (U/L): 0 = Globally unique
└── Bit 0 (I/G): 0 = Unicast

This tells us it's a standard IEEE-assigned OUI for a specific device (not multicast, not locally administered).

Famous OUI Prefixes: Who Makes Your Devices?

Let's look at some of the most recognizable OUI prefixes you'll encounter on modern networks. These are the manufacturers behind the devices you use every day.

Top 20 Well-Known OUI Prefixes

You can look up any MAC address manufacturer instantly using our MAC Address Lookup Tool—just paste in a MAC address and discover who made the device.

Why Apple Has So Many OUIs

Notice how Apple dominates this list? Major manufacturers like Apple, Samsung, and Cisco purchase multiple OUI blocks because:

1. Volume: They manufacture millions of devices and can exhaust a single OUI block
2. Product lines: Different OUIs for iPhones vs. MacBooks helps internal inventory
3. Acquisitions: Acquired companies often come with their own OUIs
4. Privacy: Rotating OUIs makes MAC randomization more effective

Apple alone owns over 5,000 registered OUI prefixes—more than any other manufacturer.

How to Look Up a MAC Address Manufacturer

Knowing the theory is great, but how do you actually identify a device's manufacturer in practice? There are several methods, from web tools to command-line queries.

Method 1: Use randommac.com's MAC Lookup Tool (Easiest)

The fastest way to identify any device is our MAC Address Lookup Tool:

1. Copy the MAC address from your device or network scan
2. Paste it into the lookup field at randommac.com/mac-address-lookup
3. Instantly see the manufacturer, address type, administration flags, and binary details

Our tool searches the complete IEEE OUI database with zero setup required. Perfect for quick checks during network audits.

Method 2: Query the IEEE Public Database

The IEEE maintains the authoritative OUI registry at standards-oui.ieee.org. You can:

• Search by OUI prefix (e.g., "00-1A-C2")
• Search by company name (e.g., "Apple")
• Download the complete database (updated daily)

The IEEE database is the source of truth, but the interface isn't as user-friendly as purpose-built tools like randommac.com.

Method 3: Command-Line Tools

For sysadmins and developers, several CLI tools can perform OUI lookups:

Using nmap (with MAC manufacturer detection):

nmap -sn 192.168.1.0/24 | grep "MAC Address"

Using arp-scan (Linux):

sudo arp-scan --localnet

Using macchanger (Linux):

macchanger -l | grep "00:1A:C2"

Using Python with manuf library:

import manuf

parser = manuf.MacParser()
print(parser.get_all("00:1A:C2:7B:00:47"))
# Output: ('Apple', 'Apple, Inc.', 'Large')

For integration into scripts and automation, our tool also offers an API endpoint for programmatic lookups.

Method 4: Router/Switch Admin Interfaces

Most modern routers display connected device manufacturers in their admin panels. This uses built-in OUI databases to automatically label devices like "Apple iPhone" or "Samsung Galaxy" even before you've assigned friendly names.

OUI in Network Security

OUI isn't just for identification—it's a powerful tool in the network security arsenal. Here's how security professionals leverage OUI data.

Device Fingerprinting

OUI enables passive device fingerprinting—identifying device types without active scanning. By monitoring MAC addresses, security systems can:

• Distinguish between laptops, smartphones, IoT devices, and printers
• Detect operating systems (iPhone vs. Android vs. Windows)
• Identify specific models (iPhone 13 vs. iPhone 11 based on OUI + timing)

This helps build network baselines and spot anomalies.

Rogue Device Detection

Network Access Control (NAC) systems use OUI to detect unauthorized devices:

• Whitelist known manufacturers: Only allow Apple, Dell, and HP devices on the corporate network
• Block consumer devices: Automatically deny smart TVs, gaming consoles, or unknown hardware
• Alert on suspicious OUIs: Flag devices from manufacturers not typically present

Example: If a Raspberry Pi (OUI B8:27:EB) suddenly appears on your corporate network, and you don't have any approved Pi devices, it could indicate an unauthorized access point or rogue server.

MAC Spoofing Detection

Attackers often spoof MAC addresses to bypass access controls. OUI analysis can help detect this:

• Inconsistent OUI-vendor pairing: A device claiming to be an iPhone but sending traffic patterns consistent with Linux
• Locally administered bit set: Spoofed MACs often use locally administered addresses (bit 1 = 1), which don't appear in the IEEE database
• OUI-to-DHCP vendor mismatch: MAC says Apple, but DHCP vendor class says "Android"

Advanced security tools correlate OUI data with DHCP fingerprints, traffic analysis, and behavior patterns to identify spoofing.

Network Segmentation

Many organizations use OUI-based policies for network segmentation:

• IoT VLAN: Automatically route devices with known IoT manufacturer OUIs to an isolated network
• Guest network: Redirect personal devices (identified by common smartphone OUIs) to a limited-access guest SSID
• Printer VLAN: Segregate all HP, Canon, and Xerox devices to a dedicated print services network

This reduces attack surface and contains potential compromises.

Zero-Trust Networking

In zero-trust architectures, OUI is one data point among many used to establish device identity and trust levels. While not sufficient alone (OUIs can be spoofed), it contributes to a composite device confidence score.

OUI in IoT and Smart Devices

The explosion of IoT devices has made OUI lookup more important—and more challenging—than ever.

The IoT OUI Explosion

Every smart light bulb, thermostat, security camera, and voice assistant needs a MAC address. This has led to:

• Massive OUI registration growth: Thousands of new manufacturers entering the space
• Obscure OUI prefixes: Many IoT devices come from manufacturers you've never heard of, often contract manufacturers in Shenzhen
• Generic OUI usage: Some budget IoT devices share OUIs across multiple "brands" (white-label products)

Using our MAC lookup tool can reveal the actual manufacturer of that no-name smart plug you bought on Amazon—often a large Chinese ODM like Espressif or Tuya.

IoT Security Implications

OUI identification is critical for IoT security:

1. Inventory unknown devices: "What is E8:DB:84:XX:XX:XX on my network?" (Answer: TP-Link smart bulb)
2. Identify vulnerable devices: Cross-reference OUIs with CVE databases to spot known-vulnerable hardware
3. Enforce IoT policies: Block or quarantine devices from manufacturers with poor security track records
4. Monitor IoT sprawl: Track how many IoT devices are actually deployed in your environment

Many security breaches start with a compromised IoT device. Knowing what's on your network is the first line of defense.

ESP32 and ESP8266 Dominance

If you see an OUI starting with A4:CF:12, 24:0A:C4, or 30:AE:A4, you're probably looking at an Espressif module (ESP32 or ESP8266). These chips power millions of DIY and commercial IoT projects.

Espressif OUIs are worth recognizing because:

• They indicate custom/DIY devices that may not have vendor support
• They're common in hacked or modified smart devices
• They're frequently used in both legitimate IoT products and potentially malicious hardware (rogue APs, packet sniffers)

Special OUI Ranges: When Lookups Fail

Not every MAC address has a publicly registered OUI. Here are the exceptions that trip up network admins.

Locally Administered Addresses

When the U/L bit (bit 1 of the first byte) is set to 1, the MAC address is locally administered:

02:XX:XX:XX:XX:XX  ← Locally administered (0x02 sets bit 1)
06:XX:XX:XX:XX:XX  ← Locally administered
0A:XX:XX:XX:XX:XX  ← Locally administered

These addresses are:

• Not in the IEEE database (OUI lookup will fail)
• Manually configured by users or software
• Valid only on the local network segment
• Commonly used by virtual machines (e.g., Docker containers, VirtualBox VMs)

If you try to look up 02:42:AC:11:00:02 (a typical Docker container MAC), our tool will correctly identify it as locally administered rather than searching for a manufacturer.

Multicast Addresses

When the I/G bit (bit 0) is 1, the address is multicast or broadcast:

01:00:5E:XX:XX:XX  ← IPv4 multicast range
33:33:XX:XX:XX:XX  ← IPv6 multicast range
FF:FF:FF:FF:FF:FF  ← Broadcast address

These are group addresses, not individual device identifiers, and don't have manufacturer OUIs.

MAC Address Randomization

Modern smartphones (iOS 14+, Android 10+) use MAC randomization for privacy:

• Random OUI per network: Your iPhone uses a different fake MAC for your home vs. coffee shop WiFi
• Locally administered bit set: Randomized MACs are locally administered, so OUI lookup returns "Unknown" or "Locally Administered"
• Rotation schedule: Some devices rotate MACs every 24 hours or on every network connection

This breaks traditional OUI-based device tracking. Network admins must rely on other identifiers (DHCP client ID, 802.1X credentials) instead.

Example randomized MAC: DA:A1:19:0C:45:F3 (locally administered, not a real Apple OUI)

To see if MAC randomization is affecting your lookups, check if the second hexadecimal digit is 2, 6, A, or E (indicating bit 1 is set).

Virtual Machine MACs

Virtualization platforms generate MACs differently:

If you see these OUIs, you're looking at virtual network interfaces, not physical hardware.

The Future of OUI: Running Out of Space?

With billions of connected devices, a valid question arises: Are we running out of OUIs?

The Math

24-bit OUI space = 2²⁴ = 16,777,216 possible OUIs

As of 2024, the IEEE has assigned approximately 36,000+ OUIs (about 0.2% of available space). At current registration rates (~3,000 new OUIs per year), we have roughly 5,500+ years before exhaustion.

So no, we're not running out anytime soon.

But There's a Catch

While the total OUI space is vast, individual OUI blocks (MA-L) only provide 16 million addresses each. Manufacturers like Apple, Samsung, and Xiaomi ship billions of devices and must register dozens or hundreds of OUI blocks.

This has led to:

• OUI hoarding: Some companies register more OUIs than they currently need for future growth
• MA-M and MA-S adoption: Smaller manufacturers use the newer, shared-prefix assignment types to reduce IEEE's OUI issuance rate

EUI-64: The Next Generation

For larger address spaces, the IEEE introduced EUI-64 (64-bit Extended Unique Identifier):

• Used in IPv6 SLAAC (Stateless Address Autoconfiguration)
• Provides 2⁶⁴ unique addresses (18 quintillion)
• Uses a 24-bit OUI + 40-bit device identifier

EUI-64 isn't replacing MAC addresses—it's a complementary system for contexts where 48 bits isn't enough (e.g., IPv6 link-local addresses, FireWire, ZigBee).

CID: Company ID Assignments

For non-networking applications, IEEE offers Company ID (CID) assignments:

• 24-bit identifier for non-MAC protocols (e.g., Bluetooth)
• Lower cost than OUI
• Same public database and lookup process

If you're looking up a Bluetooth device identifier, you're actually searching the CID registry, not OUI—but the process is identical.

IPv6 and the Declining Importance of MAC

As IPv6 adoption grows, MAC addresses become less central to networking:

• No more ARP: IPv6 uses NDP (Neighbor Discovery Protocol)
• Privacy extensions: Temporary IPv6 addresses decouple from MAC addresses
• Cryptographically Generated Addresses (CGA): IPv6 addresses that don't use MAC at all

However, MAC addresses and OUI will remain relevant for:

• Layer 2 switching (VLANs, bridges)
• Device identification and inventory
• Network security and access control
• Physical layer diagnostics

FAQ: Common OUI Questions

What does OUI stand for?

OUI stands for Organizationally Unique Identifier. It's the first 24 bits (3 bytes) of a MAC address that identifies the manufacturer or vendor of a network interface card.

How do I find the manufacturer of a MAC address?

The easiest method is to use an OUI lookup tool like randommac.com/mac-address-lookup. Enter the full MAC address, and the tool reads the first 6 characters automatically to show the manufacturer name. You can also check the IEEE's official OUI database at standards-oui.ieee.org.

Can two devices have the same OUI?

Yes—and that's by design. All devices from the same manufacturer will share the same OUI prefix. For example, every modern Apple device will have an OUI starting with one of Apple's registered prefixes (like A4:83:E7). However, the full 48-bit MAC address must be unique globally, which is why manufacturers control the last 24 bits to ensure no duplicates.

Why does my OUI lookup return "Unknown" or "Locally Administered"?

There are several reasons:

1. MAC randomization: Modern smartphones use randomly generated MAC addresses for privacy, which aren't in the IEEE database
2. Locally administered address: The device is using a manually configured MAC (common for virtual machines, Docker containers)
3. Recent assignment: Very new OUIs may not be in your lookup tool's database yet (IEEE updates daily)
4. Private/internal use: Some organizations use locally administered MACs for internal testing

Try using our MAC lookup tool which maintains an up-to-date IEEE OUI database and can distinguish between legitimate "unknown" devices and locally administered addresses.

How much does it cost to register an OUI?

The cost depends on how many addresses you need:

• MA-L (Large): $3,230 for 16.7 million addresses
• MA-M (Medium): $1,785 for 1 million addresses
• MA-S (Small): $595 for 4,096 addresses

These are one-time fees—there are no annual renewals. However, updating your organization's information later costs $590.

Can I register an OUI as an individual?

Yes, but you must be manufacturing or planning to manufacture network-capable devices. The IEEE requires that OUI registrants be legitimate organizations or individuals actually producing hardware, not just hobbyists wanting a custom MAC prefix. For personal projects, virtual networks, or testing, you should use locally administered addresses instead (set bit 1 of the first byte to 1, e.g., 02:XX:XX:XX:XX:XX).

Are OUI and MAC address lookup free?

Yes! Looking up OUI and MAC addresses is completely free. The IEEE publishes the OUI registry publicly, and tools like randommac.com provide free lookups with no registration or API limits. The only cost is if you want to register your own OUI as a manufacturer ($595-$3,230 depending on the block size).

Conclusion: The Power of Six Characters

Those first six characters of a MAC address—the OUI—pack a surprising amount of information. From instantly identifying that mystery device on your network to detecting security threats and managing IoT sprawl, OUI lookup is an indispensable tool for anyone working with networked devices.

Whether you're a developer troubleshooting connectivity, a sysadmin conducting a network audit, or a security professional hunting for rogue devices, understanding OUI gives you a superpower: the ability to know who made any device on your network at a glance.

Ready to try it yourself? Head over to our MAC Address Lookup Tool and discover the manufacturers behind your network devices. And if you're building network tools or need to generate realistic test data, check out randommac.com for powerful MAC address generation with OUI support.

Happy hunting!