MAC Address Vendor Lookup
Resolve a MAC address to the organisation that registered it, with the registry block it came from and the address range that block covers.
Overview
The first half of a MAC address identifies the organisation that was assigned it. That assignment lives in the IEEE registries, which this service mirrors locally: MA-L, MA-M and MA-S blocks plus the CID and IAB registries.
Blocks come in three sizes, and the lookup works out which one applies. An MA-L covers 16.7 million addresses and is identified by the first 6 hex digits, an MA-M covers 1 million and needs 7, an MA-S covers 4096 and needs 9. That is why a partial address can sometimes resolve and sometimes cannot.
Web interface
Two tabs. Single Lookup takes one address in any common notation:
C4:C1:7D:7F:EA:DC, c4-c1-7d-7f-ea-dc, c4c1.7d7f.eadc or
C4C17D7FEADC. Separators are stripped before matching, so the notation does not matter.
Multi / ARP Table takes a block of text and pulls the MAC addresses out of it. Pasting raw
arp -a or ip neigh output works: it finds the addresses and ignores the rest.
URL parameters
| Pattern | Example |
|---|---|
/lookup/mac/{mac} | /lookup/mac/C4C17D7FEADC |
Colons and hyphens are legal in the path, so /lookup/mac/C4:C1:7D:7F:EA:DC works too.
API
/lookup/mac/json/{mac}
/lookup/mac/{mac}
The first returns JSON, the second plain text containing just the vendor name. Both accept a comma-separated list to look up several addresses in one request.
| Name | Type | Default | Description |
|---|---|---|---|
| mac | string | required | One address, or several separated by commas. Any separator notation is accepted. |
$ curl -s https://api.troubleshooting.tools/v1/lookup/mac/json/C4C17D7FEADC | jq .
# Plain text: vendor name only
$ curl -s https://api.troubleshooting.tools/v1/lookup/mac/C4C17D7FEADC
Apple, Inc.
# Several at once
$ curl -s "https://api.troubleshooting.tools/v1/lookup/mac/json/C4C17D7FEADC,001B63000000"[
{
"mac": "C4C17D7FEADC",
"oui": "C4C17D",
"vendor": "Apple, Inc.",
"organization_address": "1 Infinite Loop Cupertino CA US 95014",
"assignment_type": "MA-L",
"block_size": 16777216,
"start_address": "C4:C1:7D:00:00:00",
"end_address": "C4:C1:7D:FF:FF:FF"
}
]The JSON response is always an array, even for a single address. Index into it rather than treating it as an object.
Response fields
| Field | Type | Description |
|---|---|---|
| mac | string | The address as you supplied it, unnormalised. |
| oui | string | The matched registry prefix, uppercase. 6, 7 or 9 hex digits depending on block size. |
| vendor | string | Registered organisation name. |
| organization_address | string | Address as filed with the IEEE. Formatting varies wildly between entries. |
| assignment_type | enum | MA-L, MA-M, MA-S, CID or IAB. |
| block_size | integer | Number of addresses in the block. |
| start_address | string | First address of the block, colon-separated. |
| end_address | string | Last address of the block. |
| removal_date | string | Only present when the IEEE has scheduled the block for removal. |
| error | string | Present instead of the above when the address could not be resolved. |
How matching works
The address is stripped of separators and uppercased, then matched against the registry longest prefix first: 9 digits, then 7, then 6. The first hit wins. This ordering matters, because an MA-S block sits inside the MA-L block that the IEEE retains, and only the longest match names the real assignee.
That retained parent block is registered to IEEE Registration Authority. Hitting it means the
address belongs to a smaller block that needs more digits to identify, so a lookup that matches it returns
Vendor information incomplete. Please provide a full MAC address. rather than a misleading
vendor name. Supply the full address and it will resolve.
Blocks the IEEE has marked as removed are excluded from matching entirely.
Errors
Per-address failures are reported inside the array element, at HTTP 200. Only infrastructure failures use a status code.
| Message | Meaning |
|---|---|
Invalid MAC address format. | Not a parseable MAC address. |
OUI not found for the provided MAC address. | Parsed fine, but no registry block matches. Common for locally administered and randomised addresses. |
Vendor information incomplete. Please provide a full MAC address. | Matched only the IEEE parent block. Send more digits. |
A database failure returns HTTP 500 with {"error": "Internal server error."}.
In plain-text mode the same failure is the bare line Internal server error.
In a multi-address request, failures are per element: some entries can carry vendor while
others carry error.
Rate limits
50 requests per second per IP address, burst 100, at most 50 concurrent connections, HTTP 429
over the limit.
Batching through the comma-separated form is both faster and cheaper than one request per address. Prefer it when resolving a whole ARP table.
Privacy
A MAC address identifies a hardware interface, so treat one as identifying data even though this lookup only reads a public registry. Queries appear in server logs for operational purposes and are not sold, shared or used to build profiles. Nothing you look up is stored against you, and there is no account to store it against.
Modern phones and laptops randomise their MAC address when scanning for networks. A lookup that returns no vendor is often exactly that, not a broken address.