What Is This Device on My Network? MAC Address Lookup Explained

Every device on your network has a hardware address, the MAC address. It looks like six pairs of letters and numbers and means nothing at first sight. But half of it tells you who made the device. In this video we'll read MAC addresses, look up their vendor, and use that to work out what an unknown device is.

As always, this is DeviceShelf's demo network, a made-up home with forty-four devices.

After a scan, the MAC address is the small line under each device name. The router at the top has three four, three one, C four, and so on.

The first three pairs are the vendor code. Every manufacturer of network chips registers its codes in a public list run by the IEEE. Three four, three one, C four belongs to AVM, the maker of the FRITZ!Box. DeviceShelf looks up every address in that list and shows the result in the Vendor column.

Sort by vendor, and the network falls into groups: the Apple devices, the Ubiquiti network gear, the Synology and QNAP storage, the smart home vendors. Often that alone tells you what an unknown entry is.

Sometimes the vendor is a chip maker rather than the brand on the box. Espressif is the classic case: it makes the Wi-Fi chips inside smart plugs, light bulbs and sensors from dozens of brands. And Intel or Realtek show up for countless laptops and PCs. The vendor tells you what's inside, not whose product it is.

That's when the other details help. The hostname the device gives itself, its open ports and the services it announces. Here, a small web page on port eighty and a name ending in sensor.

And if you've set up the optional AI, AI identification puts all of that together and explains its answer: an Espressif-based smart-home device, typical for firmware like ESPHome or Tasmota.

A quick word on the difference to the IP address, because the two get mixed up. The IP address is the device's address in your network, handed out by the router, and it can change. The MAC address belongs to the network chip and stays. That's why routers use the MAC address for fixed reservations, and why DeviceShelf keeps a device's name, notes and history attached to its MAC address, even when the IP address moves.

One important exception: phones, tablets and many laptops no longer use their real hardware address on Wi-Fi. They make up a private one for each network. You can recognize it by the second character: if it's a two, six, A or E, the address was made up, and a vendor lookup finds nothing. DeviceShelf marks these addresses and recognizes such a device by its name instead.

If you know better than the lookup, open the device and enter the vendor yourself under Your details. Leave it empty, and DeviceShelf keeps using the automatic one.

For many devices at once, use identification rules under Settings, Scanning. A rule can match on the MAC address directly: when the MAC starts with a certain vendor code, file the device as smart home and tag it. Rules only fill in what you left empty.

For an even more precise answer, there's Fingerbank, a database of more than a hundred thousand device models. With a free key, DeviceShelf can identify a device from the way it asks the router for an address. That needs passive DHCP fingerprinting, which on a desktop requires administrator rights, and it's off by default, because it sends the MAC address and that fingerprint to Fingerbank.

And if you just have one MAC address from a router log or a sticker and want to know the vendor, there's a free lookup on our website: deviceshelf dot app slash mac address lookup. It runs entirely in your browser, the address isn't sent anywhere.

So: the first half of a MAC address is the vendor code, and DeviceShelf shows the vendor for every device. When the vendor is a chip maker, look at the name, the ports and the services, or ask the AI. Remember that phones use private addresses. And fix what the lookup gets wrong by hand, or with a rule.

More videos about your home network are on our channel. DeviceShelf runs on Mac, Windows and Linux, at deviceshelf dot app.