Normalizing MAC addresses and reading OUI vendor assignments

Published: 2026-09-05

How EUI-48 and EUI-64 MAC addresses are structured, why colon/hyphen/Cisco-dot formats differ, what U/L and I/G bits mean, and how IEEE OUI vendor lookups work offline.

A MAC address (Media Access Control address), also called an EUI (Extended Unique Identifier), is the link-layer hardware identifier you see in ARP tables, switch CAM dumps, Wi-Fi client lists, and DHCP leases. The same 48-bit value shows up as 3c:07:54:12:34:56, 3C-07-54-12-34-56, 3c07.5412.3456, or 3C0754123456 depending on the OS or vendor CLI. Normalizing those strings—and reading the OUI (Organizationally Unique Identifier) for a manufacturer hint—is everyday network triage.

This guide covers address length and byte layout, common separator styles, multicast / locally administered flags, what an OUI vendor name actually proves, and how to inspect addresses locally without uploading inventory to a lookup API. For subnet and prefix math on the IP side of the same tickets, see Subnet math and CIDR explained. For a deeper look at hex as a byte view (the same digits MACs use), see Hex encoding: UTF-8 bytes explained.

EUI-48 vs EUI-64

Kind Hex digits Bytes Typical use
EUI-48 12 6 Classic Ethernet / Wi-Fi MAC
EUI-64 16 8 Some IEEE 802.15.4, FireWire, and IPv6 SLAAC-derived IDs

Most switch and host tooling deals in EUI-48. After stripping separators, a valid paste is either 12 or 16 hex digits—nothing else. Case does not change the value: aa and AA are the same byte.

Conceptually the address splits into:

Field Bits (EUI-48) Role
OUI First 24 bits (3 octets) IEEE-assigned company ID for universally administered addresses
NIC / extension Remaining bits Device-unique portion assigned by the vendor (or by you, for local addresses)

Example: 3C:07:54:12:34:56 → OUI 3C0754, NIC 123456.

Common display formats

Tools and CLIs disagree on separators. The underlying bytes are identical:

Style Example Where you see it
Colon 3c:07:54:12:34:56 Linux, macOS, many APIs
Hyphen 3C-07-54-12-34-56 Windows ipconfig / getmac
Cisco dot 3c07.5412.3456 Cisco IOS (show output, ACLs)
Bare hex 3C0754123456 Logs, CSV inventory, some firmware

A robust normalizer strips non-hex characters, checks length, then re-emits whatever style your ticket or ACL needs. Prefer one canonical form in inventory databases (often lowercase colon or uppercase bare) so joins and diffs do not treat the same NIC as two devices.

Input:   0011.2233.4455
Colon:   00:11:22:33:44:55
Hyphen:  00-11-22-33-44-55
Dot:     0011.2233.4455
Bare:    001122334455

U/L and I/G bits (first octet)

The least significant bit of the first octet is the I/G (Individual/Group) bit. The second-least significant bit is the U/L (Universal/Local) bit:

Flag Bit test (first octet) Meaning
Unicast bit 0 = 0 One station (normal host NIC)
Multicast bit 0 = 1 Group address (including broadcast FF:FF:FF:FF:FF:FF)
Universally administered bit 1 = 0 Factory / IEEE OUI space
Locally administered bit 1 = 1 Set by admin, VM hypervisor, container runtime, or privacy randomization

Examples:

  • 02:00:00:00:00:01 — unicast, locally administered (common for bridges and VMs).
  • 01:00:5E:00:00:01 — multicast (classic IPv4 multicast OUI space).
  • FF:FF:FF:FF:FF:FF — Ethernet broadcast (all bits one).

Vendor OUI tables apply best to universally administered unicast addresses. Locally administered and many private/randomized MACs will correctly show “unknown” or no manufacturer—even when the rest of the address is valid.

What an OUI vendor name proves (and does not)

IEEE publishes OUI assignments so the first three octets of a universal MAC map to an organization name (Cisco, Intel, Apple, and so on). Offline formatters embed a snapshot of that registry and match the first six hex digits.

Useful for:

  • Spotting “which vendor built this NIC?” in a switch dump
  • Sanity-checking that a claimed device type matches the OUI family
  • Separating branded hardware from locally assigned virtual MACs

Not proof of:

  • Current owner — OUIs transfer, OEMs rebadge, and white-box gear may use unexpected prefixes
  • Device model — only the company ID, not SKU or serial
  • Trust — attackers can spoof any MAC; OUI is not authentication

Treat vendor as a triage hint, similar to how User-Agent parsing is a coarse signal rather than identity.

Why normalize and look up locally

MAC lists from production often sit next to hostnames, VLAN IDs, and customer site names. Pasting them into a public “OUI lookup” site uploads that context. A browser-only formatter parses hex and consults a bundled IEEE OUI snapshot in the page—no network query per address—so the string never leaves the device. See Why “local only” matters for developer tools.

Caveats that still apply offline:

  • The embedded registry is a point-in-time snapshot; brand-new OUIs may be missing until the bundle is refreshed.
  • Locally administered, randomized, and unregistered prefixes resolve as unknown by design.

Try it locally

The MAC address formatter accepts colon, hyphen, Cisco dot, or bare hex (EUI-48 or EUI-64), shows OUI / NIC split, multicast and locally administered flags, broadcast detection, IEEE vendor when known, and copyable normalized forms—including JSON for tickets—entirely in your browser.

Related LocalTools for the same networking sessions: Subnet Calculator for single-prefix math, and CIDR Aggregator for summarizing overlapping route lists.

Related reading

← All learn articles