How to find a device by its MAC address

A MAC address is usually all your router gives you about a device: twelve hex digits like a4:cf:12:9b:00:01, maybe with a half-usable name next to it. The good news: those digits carry more information than they look like. The bad news is that they stop well short of "this is Lisa's tablet". Here is how far a MAC gets you, and how to cover the rest of the distance.

What the address contains

The first half of a MAC address names the manufacturer of the network chip. Those prefixes are assigned by the IEEE and public, so A4:CF:12 resolves to Espressif (smart-home gadgets and DIY boards), D8:3A:DD to Raspberry Pi. The second half is a serial number from the manufacturer's own pool; it identifies nothing publicly.

You can resolve the prefix with our free MAC address vendor lookup. It uses the official IEEE registries (all three of them, including the smaller MA-M and MA-S blocks), runs entirely in your browser, and flags randomised addresses for you.

This video reads a MAC address step by step, from the vendor code to the cases where it is not enough:

4:47

The second digit says whether a lookup can work at all

Before you paste anything into a lookup, read the second hex digit of the address. If it is 2, 6, A or E, the address is "locally administered": the device made it up, and no registry on earth has it. Two addresses people searched for recently, 5e:40:cc:48:69:1d and d2:6d:a3:d2:a6:42, are both of that kind. 5e and d2 end in e and 2, so they come from a phone or laptop in the house, and no registry will ever list them. A third one, 00:15:99:80:c9:07, starts with 00:15:99, which the IEEE registry lists as Samsung Electronics. That lookup works.

How big the registry is, and why some lookups say "IEEE Registration Authority"

The data behind our lookup is the three IEEE registries, downloaded as is. On the day of writing they held 53,046 assignments: 39,482 of the classic 24-bit prefixes, 6,479 of the 28-bit MA-M blocks and 7,085 of the 36-bit MA-S blocks. The big names own hundreds each: Apple has 1,513, Cisco 1,231, Samsung 882, Intel 662, Espressif 315, TP-Link 261 and Amazon 209. Huawei is split across two company names and comes to about 2,000.

Small manufacturers do not buy a whole 24-bit block. They buy a 28-bit or 36-bit slice of a block that the IEEE keeps under its own name, and 424 of the 24-bit prefixes are such parent blocks. A lookup tool that only knows the 24-bit list answers "IEEE Registration Authority" for every device from those makers. That tells you nothing. Ours tries the 36-bit and 28-bit registries first and only then falls back to the 24-bit one, so a smart plug from a small brand resolves to that brand.

Two more quirks are worth knowing. A brand name on the box is not always a name in the registry: Shelly has no block of its own, because its relays and plugs are built on Espressif chips, so they answer as Espressif. And a manufacturer that bought its blocks under different names over the years (Raspberry Pi Foundation and Raspberry Pi Trading, for example) shows up under whichever name was current when the block was bought.

When the vendor comes back empty

Modern phones, tablets and laptops invent a random MAC per Wi-Fi network by default. Those addresses are marked "locally administered" and deliberately match no registry entry. So an address with no vendor is rarely an intruder; it is usually a phone protecting its privacy. The same phone can even show up as several different devices over time.

If the lookup flags your address as locally administered, stop chasing the vendor. Identify the device by the other signals below instead.

From vendor name to actual device

A vendor name narrows things down, and sometimes that is enough: an Espressif device is almost certainly a smart plug, sensor or similar; a printer vendor is a printer. But "Hui Zhou Gaoshengda Technology" sits inside half the cheap smart-home hardware on the market, and Apple covers everything from a watch to a desktop. To get further you need the device to talk:

1. Hostname. DHCP and mDNS names like HS110 or MacBook-Pro-von-Lisa settle it immediately. Your router list often shows them.
2. Services. A printer answers on port 631, a camera streams on 554, a NAS offers file sharing on 445, a smart speaker announces itself via mDNS. Which doors are open tells you what lives behind them.
3. Behaviour over time. A device that appears every evening at seven and vanishes at midnight is somebody's phone, not a server.

You can collect all of that by hand, or let a scanner do it in one pass. DeviceShelf resolves vendor, hostname, services and open ports for every device on the network and turns them into an actual identification; the same IEEE data behind our lookup page ships inside the app. For the full detective story, see the guide on identifying an unknown device.

Same vendor, different device: how the services settle it

Most people get stuck at the vendor name. One vendor covers a whole product line. Apple's 1,513 prefixes do not separate a watch from a desktop. What separates them is what the device says on the network:

Together with the vendor this usually settles it. A Samsung address with a registry hit is more likely a television or a printer than a phone, because Samsung phones use private addresses by default; if the device also answers on port 554, it is a camera. An Espressif address that announces _hap is a HomeKit-compatible plug or sensor. DeviceShelf collects exactly these signals for every device in one scan and names the type from them; the port list above is the same one the app uses.

What this looks like on a real network

Our own home network, scanned on the day of writing: 61 devices, 28 different vendors in the registry, and 18 addresses with a second digit of 2, 6, A or E. Those 18 are every phone, tablet, watch and laptop in the house, plus two Docker containers, which also make up their addresses. Not one of them is a stranger. A few rows show how far each clue carries:

• 20:28:bc resolves to LG. No open port, no announced service, but the hostname is lgwebostv: the television, settled by the name alone.
• 3c:6a:9d resolves to Dexatek Technology, a name nobody has at home. The device announces _hap and nothing else; the name in our list, Eve Light Strip, is one we typed in after looking at the thing. Eve builds on Dexatek hardware, the same way Shelly builds on Espressif. The soundbar in the same room resolves to Silicon Laboratories for the same reason, and a printer to WNC Corporation.
• ce:76:87 has no vendor at all, the second digit is e. It announces _airplay, _raop, _smb and _ssh and answers on ports 22 and 445: a Mac with file sharing on. The services identify it; the address never could.
• 78:2b:64 resolves to Bose and announces _airplay, _raop and _spotify-connect: a speaker. 50:bc:96 resolves to Apple and announces the same two AirPlay services plus _companion-link and _sleep-proxy, which is what a HomePod advertises and a MacBook does not.
• 34:9f:7b resolves to Canon, and the hostname is Canon TS9500 series. Nothing was open when the scan ran, because the printer was asleep. Vendor and name still identify it.
• d8:3a:dd resolves to Raspberry Pi Trading and answers on port 22 with _workstation: a Pi running Linux.

Three of the 61 rows stayed "Unknown": Apple private addresses with no hostname and no service. They belong to phones that were in the house, and the next scan will name them when the phones talk.

Finding the MAC in the first place

• Router: the client list shows a MAC per device — the usual starting point.
• Windows: ipconfig /all (Physical Address).
• macOS/Linux: ifconfig or ip link; macOS also shows it under System Settings → Network → Details.
• iPhone/iPad: Settings → Wi-Fi → ⓘ on the network (this is the per-network, usually randomised, address).
• Android: Settings → About phone → Status, or in the Wi-Fi details.

What a MAC address will never tell you

No owner, no location, no serial number. The registry knows which company bought the prefix, and that is all. The claim that "this MAC belongs to this person" has no technical basis, which is also why sharing a MAC address is not the privacy catastrophe it is sometimes made out to be. On your own network, though, it remains the most stable handle a device offers, randomisation aside.

Common questions

Can I find out who owns a MAC address? No. The registry maps a prefix to a company, nothing more. There is no public list of which address went into which product, let alone to which person.

Why does my iPad show up three times? Because it uses a different private address per Wi-Fi network, and since iOS 18 it can rotate that address over time on networks you have marked as such. Each rotation looks like a new device. Naming the device once in your scanner and switching the rotation off for your home network keeps the list stable.

The lookup says "IEEE Registration Authority". Is that the vendor? No, it is the owner of the parent block. The actual maker sits in a 28-bit or 36-bit sub-block. Our lookup checks those first; if it still answers with the Registration Authority, the sub-block has not been published.

Is the MAC address the same as the IP address? No. The IP address is handed out by your router and can change tomorrow; the MAC address is burned into the device (or, for phones, made up per network) and is what the router uses to recognise the device again. Finding every device with its IP address is a separate job, covered in how to see every device on your network.