What Is an OUI, and How MAC Addresses Are Assigned

How a MAC address is structured, what the OUI (the manufacturer prefix) is and who hands it out, the difference between universally and locally administered addresses, and why a randomized Wi-Fi MAC has no vendor at all.

Every frame carries two hardware addresses, and half of each one is a name that was bought. The other half is a serial number its owner stamped on a device, or, more and more often, a number a phone made up a moment ago so that nobody could follow it. Reading which kind of address is in front of you takes two bits and one lookup.

The shape of a MAC address

A MAC (media access control) address is 48 bits, six octets, usually written as hex separated by colons or hyphens (00:1b:54:11:22:33), or in Cisco's convention as three dot-separated groups (001b.5411.2233). The 's own name for it is -48, and its registration guidelines retire the older one: "the term EUI-48 is now used for both uses, and the term MAC-48 identifier is now obsolete" (IEEE RA guidelines). In the commonest case the address splits cleanly in half: the first three octets are the (organizationally unique identifier), and the last three are assigned by the manufacturer to individual devices.

Who hands out the prefixes

The IEEE Registration Authority sells the prefixes, in three sizes. Its guidelines define the OUI as "a 24-bit (three octet) sequence" and give each product's yield in EUI-48 identifiers (IEEE RA guidelines):

Product	Prefix	EUI-48 identifiers
(large)	an OUI, 24 bits	2^24, about 16.8 million
MA-M (medium)	28 bits, no OUI of its own	2^20, about 1 million
MA-S (small)	an OUI-36, 36 bits	2^12, 4,096

The fourth product is not an address block at all: a CID (company ID) is "a unique 24-bit identifier that cannot be used to generate EUI-48 or EUI-64 values" (IEEE Registration Authority); it marks addresses in the local space, below. The assignments are public and searchable at the Registration Authority, which is why a lookup can turn 00:1b:54 into the company that registered it. It also explains a trap: an MA-M or MA-S block shares its first 24 bits with other buyers, so a lookup that reads only those 24 bits cannot name its owner.

Two bits hiding in the first octet

Before you read the OUI as a , two bits in the very first octet tell you whether that reading makes sense. The I/G bit, the least significant bit of the first octet, "indicates either an individual address (I/G=0) or group address (I/G=1)"; the U/L bit, the next one up, "indicates universal (U/L=0) or local (U/L=1) administration of the address" (IEEE RA guidelines). Ethernet sends each octet lowest-order bit first, "the reverse of the 's ordering" (RFC 9542), so the I/G bit is the first bit of a destination address that reaches the wire.

The hex gives both bits away in the second digit. A 2, 6, A or E there means a locally administered unicast address; 3, 7, B or F, a local group address; an odd digit, any group address.

Group addresses are mostly computed, not assigned. All ones, ff:ff:ff:ff:ff:ff, is broadcast. IPv4 multicast maps onto the block: "An IP host group address is mapped to an Ethernet multicast address by placing the low-order 23-bits of the IP address into the low-order 23 bits of the Ethernet multicast address 01-00-5E-00-00-00" (RFC 1112), so 224.0.0.251 travels to 01:00:5e:00:00:fb. IPv6 multicast goes to an address "whose first two octets are the value 3333 hexadecimal and whose last four octets are the last four octets" of the IPv6 destination (RFC 2464), so ff02::1 becomes 33:33:00:00:00:01. IANA holds an OUI of its own, 00-00-5E, and the virtual router address of VRRP, 00-00-5E-00-01-xx, comes from it ( 9542): the one MAC in a first-hop redundancy pair that belongs to no manufacturer and still is universal.

The local half of the address space

A locally administered address came from software or from an administrator, not from a block: "local network administrators can assign any addresses with the X bit a one", the X bit being the U/L bit (RFC 9542). Since IEEE 802c-2017 that space has a plan, the SLAP (Structured Local Address Plan), which splits it in four by the next two bits, Y and Z: administratively assigned (Y=0, Z=0), extended local (Y=0, Z=1), reserved (Y=1, Z=0) and standard assigned (Y=1, Z=1) (RFC 9542). The extended local quadrant is where a CID lives: in a CID, "the M, X, Y, and Z bits have the values 0, 1, 0, and 1, respectively" (IEEE RA guidelines). Anything that needs addresses without buying a block can take them from local space, provided they stay unique on the network that sees them.

Why so many MACs now have no vendor

Privacy moved the default. A universal address follows its device everywhere: "Since universally administered MAC addresses are by definition globally unique, when a device uses this MAC address over a shared medium to transmit data", especially over the air, "it is relatively easy to track this device by simple medium observation" (RFC 9724, March 2025). The answer was the local bit: random addresses "decouple the globally unique identifier from the device" (RFC 9724).

The operating systems took it up one by one. Apple devices use "a different address for each network" from iOS 14, iPadOS 14 and watchOS 7; from iOS 18, iPadOS 18, macOS Sequoia 15, watchOS 11 and visionOS 2 the setting can be off, fixed, or rotating, which changes the address every two weeks (Apple). On Android, "For devices running Android 10 or higher, the framework uses a randomized MAC address by default", derived per network and kept until a factory reset, and from Android 12 it can be re-randomized at new connections under conditions Android documents (Android Open Source Project).

Look one of those addresses up and the honest answer is that there is no vendor: the bits where an OUI would be are random, not an assignment. A tool that returned a manufacturer for a randomized MAC would be inventing one, which is why the OUI lookup reports the two bits with every answer and calls a locally administered address what it is: no vendor.

Where this is useful

Reading a MAC's vendor is everyday network work: identifying what is plugged into a switch port from its address, spotting an unexpected device, recognising virtualisation by its hypervisor's prefix, or checking that the thing you are talking to is the brand you . Reading the two bits first keeps you from chasing a vendor for an address that, by design, has none; the Ethernet frame shows where both addresses sit, and ARP shows how a host learns the one it needs.

Sources