What is an OUI? How MAC vendor lookup works

Short answer: an OUI (Organizationally Unique Identifier) is the first three bytes of a MAC address, and the IEEE assigns each block to exactly one manufacturer. Run those three bytes through a MAC vendor lookup and you get the maker — not the model, not the owner, just who built the hardware.

Where the OUI sits in a MAC address

A MAC address is six bytes, written as twelve hex digits:

A4:83:E7:2C:1B:90

• A4:83:E7 is the OUI — assigned to a manufacturer, fixed across every device that maker builds.
• 2C:1B:90 is the network interface controller (NIC) portion — a serial-style value the manufacturer hands out from its own block.

So the address has one part chosen by the IEEE’s registry and one part chosen by the vendor. Neither part is chosen by whoever installed the device on your network.

The IEEE registry, and why it works

The IEEE Registration Authority runs the master list. A hardware maker applies for a block, pays for it, and receives a 24-bit OUI it can stamp into firmware. That block is public — anyone can query it. This is why a vendor directory can list “44:38:39 → Cumulus Networks” or “3C:5A:B4 → Google” and be right every time the address is genuine.

The registry has grown past the original 24-bit scheme. Some manufacturers now hold smaller MA-M (28-bit) or MA-S (36-bit) blocks instead of a full OUI, because 24-bit space has gotten scarce. A lookup tool has to check all three registries. Checking only the classic one misses newer vendors.

From OUI to an actual device

An OUI alone tells you the manufacturer, not the model. Getting further takes context:

• The vendor itself narrows things. Espressif or Realtek usually means an IoT board. Sonos or Roku means a speaker or streaming box.
• Hostname and connection pattern add the rest — a device that appears every night at 11pm and disappears by 7am reads differently from one that’s always online.
• Cross-referencing against a router’s connected-device list helps when you’re staring at several unfamiliar entries at once, as covered in identifying an unknown device on your network.

The randomized-MAC caveat

Modern phones and laptops often don’t broadcast their real, vendor-assigned MAC at all. iOS, Android, and Windows now generate a random address per network by default, specifically so a vendor lookup can’t be used to track the device across locations. You can tell one apart by checking a single bit: if the second hex digit of the first byte is 2, 6, A, or E, the locally-administered bit is set, and there’s no manufacturer to find. The full mechanics are in randomized MAC addresses, explained; the short version of why this exists at all is in why devices hide their MAC.

This is the single most common reason an OUI lookup comes back empty. The address isn’t wrong or unregistered — it was never a real OUI to begin with.

Using OUI lookups at scale

Checking one MAC by hand is a quick job for the vendor lookup tool. Checking hundreds is a different problem: a device inventory, a captive portal, a fleet of IoT sensors. The lookup API takes a MAC and returns the vendor, whether the address is randomized, and a confidence score, so you can batch the work instead of pasting addresses one at a time.

Either way, the answer an OUI gives you is narrower than it looks at first: it names a manufacturer, not a device, not a person, and not always even that if the address was never real to begin with.