Can a MAC address geolocate a device?

No. A MAC identifies a network interface inside the local link (the same Ethernet or Wi-Fi segment). It does not travel past the first router: as soon as your packet hits the internet, the source MAC is rewritten to the next hop. No service can infer your city or ISP from a MAC alone.

Why does the vendor lookup sometimes return unknown?

Two common reasons: the address is locally administered (LAA) and therefore has no IEEE-registered OUI — the case of 52:54:00, which QEMU/KVM uses by default. Or it belongs to a vendor with a very recent OUI that the local snapshot does not contain. Other MAC ranges used in virtual environments (VMware, Xen, VirtualBox) are globally assigned, so the lookup returns a known vendor without trouble.

Does the MAC change when I use a VPN or proxy?

Not the MAC itself, but it is invisible past your local link anyway — even without a VPN, remote servers never see it. VPNs and proxies operate at layer 3 or above; the MAC stays the same between your device and the first hop (router/AP). What a VPN hides is your public IP, not your MAC.

Is the OUI a reliable way to identify the exact device model?

No. The OUI identifies the block assignee on the IEEE side; many brands buy MAC ranges from original design manufacturers (ODMs), so the OUI may match the ODM rather than the consumer-visible brand. And assignment is per block: the same OUI can appear across very different products of the same assignee.

Do randomised MAC addresses on iOS and Android break the lookup?

In practice yes. Modern operating systems rotate MAC addresses every time the device joins a new Wi-Fi network as an anti-tracking measure; those MACs have the locally administered bit set and point to no physical vendor. That behaviour is intended for privacy: the tool reflects it by flagging the MAC as LAA instead of inventing a vendor.

What a MAC address, OUI and vendor mean

Anatomy of MAC addresses: OUI structure, MAC vs IP, locally administered, multicast/broadcast, why a MAC does not geolocate, and why the vendor lookup can come back empty.

What a MAC address is

A MAC address (Media Access Control) is a 48-bit identifier that every Ethernet or Wi-Fi interface presents on the local network. It is usually written as six hex octets separated by colons or hyphens — for example 3C:5A:B4:12:34:56. It lives at the data link layer (OSI layer 2): at that level, switches and access points decide which port or which Wi-Fi client should receive each frame by inspecting the destination MAC. It is the addressing that makes the cable or the radio link between your machine and the router actually work.

The MAC is assigned at the factory to the hardware (the BIA, burned-in address), but almost every operating system lets you override it. When it is overridden without coordination, the locally administered bit is usually set to signal that the address is no longer the original — something the field anatomy makes visible at a glance.

Structure: OUI and extension

The 48 bits split into two halves. The first 24 bits — the three leading octets — form the OUI (Organisationally Unique Identifier), a block that IEEE assigns to a specific entity (vendor, ODM or reseller). The remaining 24 bits are the device extension: the assignee numbers products under that block as it sees fit.

That partition explains why an OUI maps to a vendor when the address is global (assigned by IEEE) and loses its meaning when the address is locally administered: in that case the high half does not come from IEEE and does not identify a physical vendor. The two least significant bits of the first octet control that behaviour, and we look at them below.

MAC versus IP

MAC and IP answer different questions. The MAC says “which interface inside my local link” — the Ethernet segment or Wi-Fi cell shared by every device on the same switch or AP. The IP says “which node on the global network” — and it is routed across networks. When a packet enters and leaves the internet its source and destination IPs stay stable; the source MAC, however, is rewritten at every router hop.

That is why a remote server never sees your MAC — only your home router or your corporate AP does. MAC addresses travel only between direct neighbours. To reason about the IP networks the packets actually traverse, the CIDR calculator on ToolsOps helps you think through subnets, masks and ranges.

Locally administered (LAA)

The second least significant bit of the first octet (bit 41 of the full MAC field) decides whether the address is globally unique(assigned by IEEE through an OUI) or locally administered: when that bit is 1, the MAC is considered locally assigned by an administrator or the operating system. In hex, first octets ending in 2, 6, A or E (the x2:, x6:, xA:, xE: family) are LAA.

LAA addresses are common in virtual machines, containers with virtualised networking, and modern devices that rotate their MAC to evade tracking. They have no registered OUI, so the vendor lookup cannot return a physical manufacturer: the right thing is to flag the address as locally administered and explain why there is no match. The nuance matters: LAA does not automatically mean suspicious traffic, just an assignment outside the IEEE registry.

Multicast and broadcast at the MAC layer

The least significant bit of the first octet (bit 40) tells unicast from group-addressed traffic: when it is 0 the frame goes to a single recipient; when it is 1, the frame targets a set. The address FF:FF:FF:FF:FF:FF is the link-wide broadcast and every device on the segment receives it. The block 01:00:5E:00:00:00/24 onwards encodes IPv4 multicast; 33:33:... encodes IPv6 multicast.

Recognising these prefixes in the lookup matters so we do not confuse signalling traffic with traffic from a specific device. A multicast MAC has no associated vendor: it represents a logical group, not a physical interface, and must be presented as such rather than fitted to an invented OUI.

Why a MAC does not geolocate

Geolocation requires the address to travel over the public internet and a service capable of mapping it to a physical location. Public IPs are geolocated through databases that correlate ranges with countries and cities. MACs never reach those services: your home router, the AP in a café or the switch in your office is the boundary. Beyond it your MAC is invisible; below it, it is visible but only from within your local link.

That technical property is why no remote service can infer your location from a MAC. When someone claims otherwise they are confusing MAC with a different signal (a Wi-Fi BSSID associated with coordinates in mapping databases, for example) which can be geolocated but through entirely different mechanisms.

Why the vendor lookup can return unknown

Several scenarios are common. The first, already described, is the locally administered MAC: if the LAA bit is set there is no registered vendor to associate. The second is an OUI outside the local snapshot: the tool uses a known published OUI set, not the live IEEE registry, so very recent OUIs may not yet be indexed. The third is MAC ranges used in virtual environments, with a nuance: some are globally assigned and may have a known vendor — for example 00:50:56 (VMware), 00:16:3E (Xen) or 08:00:27 (VirtualBox). Others, such as 52:54:00 which QEMU/KVM uses by default, are locally administered. In that second case the tool should show LAA/unknown, not invent a vendor.

The tool prefers an honest “unknown” over inventing a vendor: a fake assignment would break network diagnostics and forensic investigations. When you see “unknown” or “locally administered” in the result, that information is actionable — it tells you precisely why no attribution is available.

How to use the ToolsOps lookup

The MAC vendor lookup tool accepts any common format — colons, hyphens, dots, no separators — and normalises the input before querying the local OUI snapshot. If the address is global, it returns the registered assignee; if it is LAA, multicast or broadcast, it flags that explicitly. All processing happens in your browser: the MAC you paste never leaves your machine.

To place the calculator inside its networking context, the networking tools hub groups the MAC lookup with the CIDR calculator and summarises when to reach for each one.

Frequently asked questions

Can a MAC address geolocate a device?: No. A MAC identifies a network interface inside the local link (the same Ethernet or Wi-Fi segment). It does not travel past the first router: as soon as your packet hits the internet, the source MAC is rewritten to the next hop. No service can infer your city or ISP from a MAC alone.
Why does the vendor lookup sometimes return unknown?: Two common reasons: the address is locally administered (LAA) and therefore has no IEEE-registered OUI — the case of 52:54:00, which QEMU/KVM uses by default. Or it belongs to a vendor with a very recent OUI that the local snapshot does not contain. Other MAC ranges used in virtual environments (VMware, Xen, VirtualBox) are globally assigned, so the lookup returns a known vendor without trouble.
Does the MAC change when I use a VPN or proxy?: Not the MAC itself, but it is invisible past your local link anyway — even without a VPN, remote servers never see it. VPNs and proxies operate at layer 3 or above; the MAC stays the same between your device and the first hop (router/AP). What a VPN hides is your public IP, not your MAC.
Is the OUI a reliable way to identify the exact device model?: No. The OUI identifies the block assignee on the IEEE side; many brands buy MAC ranges from original design manufacturers (ODMs), so the OUI may match the ODM rather than the consumer-visible brand. And assignment is per block: the same OUI can appear across very different products of the same assignee.
Do randomised MAC addresses on iOS and Android break the lookup?: In practice yes. Modern operating systems rotate MAC addresses every time the device joins a new Wi-Fi network as an anti-tracking measure; those MACs have the locally administered bit set and point to no physical vendor. That behaviour is intended for privacy: the tool reflects it by flagging the MAC as LAA instead of inventing a vendor.