MAC Address Lookup / Formatter

Parses and reformats a MAC address — colon, dash, or Cisco dot notation — and identifies the OUI vendor prefix, plus flags special addresses like broadcast and multicast. The tool you actually reach for while staring at an ARP table or a switch CAM table trying to work out what device that unfamiliar MAC belongs to.

What it is, underneath

A MAC address is a 48-bit hardware identifier burned into every network interface at manufacture, used at Layer 2 to identify devices on a local segment. Unlike an IP address, it's not supposed to change — though modern OSes now support MAC randomisation on Wi-Fi specifically for privacy, which is worth knowing before you assume a device's MAC is a stable, permanent identifier for tracking purposes.

The structure

• First 3 bytes (OUI) — assigned by IEEE to the manufacturer. 00:1A:2B, for instance, is Cisco.
• Last 3 bytes — assigned by the manufacturer to the specific device
• FF:FF:FF:FF:FF:FF — the broadcast address, reaching every device on the segment
• Multicast — first byte's least significant bit set to 1 (an odd first octet), e.g. 01:00:5E:xx:xx:xx for IPv4 multicast traffic
• Locally administered — a specific bit pattern flags a MAC that was manually assigned rather than burned in by the manufacturer

Where you'll actually be looking at one of these

• arp -a — the ARP table, mapping IPs to MACs on your local subnet
• Switch CAM tables — which MAC is reachable on which port, the first thing to check when tracing a rogue device
• DHCP leases — plenty of static assignment setups key off the MAC address specifically
• Port security on Cisco switches — restricting a port to a known set of allowed MACs, and the OUI lookup is often the fastest way to spot that an "unknown" device is actually a personal phone or laptop that shouldn't be plugged in there at all