MAC Address Structure, OUI Lookups & Network Hardware Identity

A Media Access Control (MAC) address is frequently treated as an unchangeable fingerprint tied directly to a physical piece of computer hardware. In network administration, system auditing, and security analysis, practitioners often inspect MAC addresses to identify connected hardware, assign static IP addresses via DHCP, or verify hardware manufacturers. However, modern network engineering realities have fundamentally altered how MAC addresses behave and what they actually signify.

MAC Map provides an authoritative, technical examination of Layer 2 physical addressing. The primary purpose of this site is to clarify the structure of MAC addresses, demystify the IEEE Organizationally Unique Identifier (OUI) registry, and explain why a MAC address can no longer be blindly trusted as a permanent device identifier.

Core Architectural Scope

Every standard Ethernet and Wi-Fi interface relies on a 48-bit address—formally designated by the IEEE as an EUI-48 (Extended Unique Identifier 48). While the address format appears straightforward when rendered in standard hexadecimal notation, the bit-level structure contains critical flags that dictate whether an address is globally unique or locally assigned, individual or multicast.

+-----------------------------------+-----------------------------------+
|   Organizationally Unique ID      |   Network Interface Controller    |
|             (OUI)                 |         (NIC Specific)            |
|            24 Bits                |             24 Bits               |
+-----------------------------------+-----------------------------------+
| Octet 0  |  Octet 1  |  Octet 2   |  Octet 3  |  Octet 4  |  Octet 5  |
+----------+-----------+------------+-----------+-----------+-----------+
  ^     ^
  |     |-- Bit 1: Universal / Local (U/L) Bit [0 = Universal, 1 = Local]
  |-------- Bit 0: Individual / Group (I/G) Bit [0 = Unicast, 1 = Multicast]

Navigating contemporary networks requires understanding both the capabilities and explicit boundaries of Layer 2 address inspection.

Key Analysis Domains Covered

• OUI Registry Realities: What an IEEE manufacturer lookup confirms regarding interface silicon, alongside the common reasons vendor lookups fail or return misleading results due to chip white-labelling and module reselling.
• Privacy & Address Randomisation: How operating systems on modern mobile phones, tablets, and laptops dynamically alter MAC addresses during Wi-Fi probes and active connections, disrupting legacy network tracking.
• Switching & Resolution Tables: The mechanics of Address Resolution Protocol (ARP) caches and switch Content Addressable Memory (CAM) tables in binding Layer 2 MACs to Layer 3 IP addresses and physical switch ports.
• Virtualisation & Software Spoofing: How hypervisors, container engines, and kernel drivers generate synthetic MAC addresses or allow administrative spoofing, severing the link between MACs and fixed physical hardware.

Whether you are investigating an unrecognized host on your corporate LAN, troubleshooting DHCP allocation failures, or designing network access control policies, MAC Map delivers grounded diagnostic clarity without relying on outdated assumptions.