MAC vendor to device type: what each manufacturer means
Short answer: the first three bytes of a MAC address are the manufacturer’s OUI. Look those up in a vendor database and you have the maker; the model follows from context.
The structure of a MAC address
A MAC address is six bytes, e.g. A4:83:E7:2C:1B:90:
A4:83:E7— the OUI. Registered to one manufacturer (here, Apple).2C:1B:90— the device-specific part, assigned by that manufacturer.
So the maker is deterministic; you just need a current OUI-to-vendor map. Run the address through a MAC vendor lookup to get it, or browse the OUI vendor directory to see how a prefix maps to an organization.
A worked example
Take 44:38:39:FF:EF:57. The OUI is 44:38:39, which the IEEE registered to Cumulus Networks — so this is networking hardware, not a phone. Now take DA:A1:19:5F:2C:88. The second hex digit is A, which means the locally-administered bit is set: this address was invented by the device for privacy, and no vendor lookup will resolve it. Two addresses, two completely different answers, and the difference is one bit.
From vendor to device type
The vendor narrows things fast. Each prefix below was resolved against the IEEE registry through the lookup before publishing, so these are the names the registry actually returns:
| Vendor the lookup returns | Example prefix | What it almost certainly is |
|---|---|---|
| Espressif Inc. | D4:8A:FC | a smart plug, bulb or sensor built on an ESP32 |
| REALTEK SEMICONDUCTOR CORP. | 00:E0:4C | the network chip inside something else |
| MediaTek Inc | 00:0C:E7 | the chip inside a TV, tablet or router |
| Hon Hai Precision Ind. Co.,Ltd. | 00:22:68 | Foxconn — the WiFi card in a laptop |
| Rivet Networks | 9C:B6:D0 | a Killer WiFi card, so again a laptop |
| Raspberry Pi Foundation | B8:27:EB | a Pi, models 1 to 3 |
| Raspberry Pi Trading Ltd | DC:A6:32, D8:3A:DD | a Pi, model 4 and later |
| Sonos, Inc. | 00:0E:58, B8:E9:37 | a speaker |
| Roku, Inc. | CC:6D:A0, B0:A7:37 | a streaming box or a TV running Roku |
| Amazon Technologies Inc. | 68:54:FD, 44:65:0D | an Echo, Fire TV or Kindle — not distinguishable |
| Google, Inc. | 3C:5A:B4, F4:F5:D8 | a Nest, Chromecast or Home |
| Nest Labs Inc. | 18:B4:30 | a thermostat or camera, registered pre-acquisition |
| Philips Lighting BV | 00:17:88 | a Hue bridge |
| Ubiquiti Inc | F0:9F:C2 | an access point or router |
Three rows show why the vendor is a clue and not an answer. A Raspberry Pi answers to two different company names depending on when its prefix was registered. A Nest thermostat still answers to Nest Labs Inc., a company Google bought in 2014. And a laptop reports Hon Hai or Rivet Networks — whoever made the card — never the brand on the lid.
The model itself isn’t in the MAC — that’s an inference from the vendor plus context (what it is, when it connects, its hostname). If you’re resolving many addresses, for example across a whole router device list, the lookup API returns the vendor, the randomized flag, and a confidence score in one call.
When the OUI is “locally administered”
If the second-least-significant bit of the first byte is set, the address is locally administered — not a real vendor OUI. That’s a randomized MAC, and the vendor lookup can’t help. The full mechanics are in randomized MAC addresses, explained; the short version is in why devices hide their MAC. When you hit one, identify the device by hostname and elimination instead — see identifying an unknown device.
Frequently asked questions
Can a MAC address tell me the exact device model?
No. The OUI gives you the organization that registered the block, and nothing in the rest of the address encodes a model. The model is an inference from the vendor plus context: what kind of device that vendor makes, when it connects, and what hostname it reports.
What device is an Espressif MAC address?
Almost always something small and purpose-built. Espressif makes the ESP32 and ESP8266 WiFi chips that sit inside smart plugs, bulbs, sensors and hobby boards, so an Espressif prefix such as D4:8A:FC is a gadget rather than a phone or computer.
Why does my laptop's MAC say Hon Hai, Liteon or Realtek?
Because the registered owner is whoever made the network card, not whoever assembled the laptop. Hon Hai is Foxconn, and Realtek, MediaTek and Rivet Networks all make the WiFi silicon that ships inside other companies' machines. The lookup is correct; it is answering about the part.
Why do two prefixes from the same product show different company names?
Because the company registered them at different times, or under a different entity. A Raspberry Pi can be B8:27:EB (Raspberry Pi Foundation) or DC:A6:32 and D8:3A:DD (Raspberry Pi Trading Ltd), and a Nest thermostat can be 18:B4:30 (Nest Labs Inc.) from before the Google acquisition.