OUI Registry Lookup: What IEEE Vendor Assignments Prove and Where They Mislead

When an unfamiliar MAC address appears in a network switch table or DHCP log, the immediate reaction of most network administrators is to perform an Organizationally Unique Identifier (OUI) lookup. By checking the first three octets of the address against the public registry maintained by the IEEE Standards Association, administrators hope to identify the mysterious host connected to their network.

While OUI lookup tools are valuable diagnostic assets, relying on vendor lookups as definitive evidence of device type or brand leads to frequent misinterpretations. An OUI lookup reveals who registered the Layer 2 hardware interface silicon—it does not necessarily tell you who built the final device, what operating system it runs, or who is operating it.

The IEEE Registry Tiers: MA-L, MA-M, and MA-S

The IEEE Registration Authority maintains the central registry of all assigned MAC address blocks. Historically, all assignments were 24-bit prefixes known simply as OUIs. However, as demand for MAC address space grew and smaller hardware manufacturers emerged, the IEEE restructured its assignment tiers into three distinct MAC Address Block categories:

+------------------+------------------+-------------------+--------------------+
| Assignment Tier  | Prefix Length    | Addresses Granted | Best Suited For    |
+------------------+------------------+-------------------+--------------------+
| MA-L (Large)     | 24 Bits (3 bytes)| 16,777,216        | Major Chipmakers   |
| MA-M (Medium)    | 28 Bits          | 1,048,576         | Mid-size OEMs      |
| MA-S (Small)     | 36 Bits          | 4,096             | Specialized IoT    |
+------------------+------------------+-------------------+--------------------+

1. MAC Address Block Large (MA-L)

The traditional 24-bit OUI grant. Organizations purchasing an MA-L block receive a 3-octet prefix that allows them to assign the remaining 24 bits to up to 16.7 million individual interface endpoints. Major hardware companies often hold hundreds of separate MA-L blocks. For instance, Cisco Systems, Apple, and Intel maintain large portfolios of MA-L assignments to accommodate massive global manufacturing volumes.

2. MAC Address Block Medium (MA-M)

Introduced to conserve address space, an MA-M grant assigns a 28-bit prefix. The IEEE fixes the first 28 bits, leaving the purchasing company with 20 bits to allocate up to 1,048,576 unique addresses.

3. MAC Address Block Small (MA-S)

Formerly designated as OUI-36, an MA-S grant assigns a 36-bit prefix. The purchasing entity controls only the final 12 bits, providing 4,096 unique MAC addresses. This tier caters to small-scale industrial equipment vendors and specialized Internet of Things (IoT) developers who do not require millions of addresses.

Because lookup tools must check across MA-L, MA-M, and MA-S databases, older simple lookup scripts that check only the first 24 bits may fail to resolve 28-bit or 36-bit assignments accurately.

Why Vendor Lookups Mislead Network Engineers

Even when an OUI lookup successfully returns an IEEE registrant name, interpreting that result requires caution. Several structural factors in hardware manufacturing and distribution obscure the connection between an OUI registrant and the host device visible on your network.

1. The Semiconductor Component Manufacturer vs OEM Gap

Major consumer electronics and enterprise equipment manufacturers routinely purchase third-party Wi-Fi and Ethernet microcontrollers rather than manufacturing network silicon in-house.

For example, a high-end Smart TV, an industrial printer, or a custom desktop PC may contain a network interface chip manufactured by Realtek Semiconductor Corp., MediaTek Inc., or Espressif Systems. When the device connects to a network, its burned-in MAC address reflects the OUI of the chipmaker (e.g., Realtek), not the brand name stamped on the chassis (e.g., LG, Sony, or HP).

An administrator querying a host with a MAC starting with a Realtek or Qualcomm OUI might assume the device is a PCI network card or a Wi-Fi dongle, when it is actually an embedded component inside an industrial thermostat or smart appliance.

Physical Device (Brand X Smart Appliance)
  └── Embedded Wi-Fi Module (Realtek Silicon)
        └── Burned-In MAC: 00:e0:4c:xx:xx:xx
              └── IEEE Lookup Result: "Realtek Semiconductor Corp."

2. White-Label Manufacturing and Rebranding

In enterprise networking and server hardware, white-label original design manufacturers (ODMs) produce server motherboards, storage arrays, and network switches that are subsequently rebranded and resold by major technology vendors.

If an ODM flashes its own registered OUI block into the network controller firmware during factory assembly, the MAC address will report the Taiwanese or Chinese design firm as the vendor rather than the final enterprise brand name on the server rack.

3. Corporate Acquisitions, Mergers, and Legacy Blocks

The IEEE OUI database is a historical ledger extending back decades. Over time, corporate mergers, acquisitions, and restructuring lead to OUI ownership transfers that are not always updated in public databases promptly.

Furthermore, legacy tech giants frequently utilize OUI blocks acquired through past acquisitions. A modern enterprise access point might transmit an OUI originally registered twenty years ago by a long-defunct wireless pioneer acquired by the current parent company.

4. Modular Expansion Cards and Virtual Controllers

In modular chassis switches, virtualised blade servers, and PCIe expansion slots, network cards can be swapped between chassis or reconfigured dynamically. A server chassis manufactured by Vendor A may contain dual-port 10GbE PCIe cards manufactured by Vendor B, creating mixed OUI pools within the same physical enclosure.

Synthetic and Private OUIs

As detailed in our overview of The Anatomy of a MAC Address, any MAC address with its Universal/Local (U/L) bit set to 1 is locally administered. Locally assigned addresses do not draw from the IEEE public registry.

When querying an LAA address (such as 02:50:41:xx:xx:xx), standard IEEE lookup tools will either return “No match found” or produce a misleading match if they ignore the U/L bit. Hypervisors and container engines frequently register specific private prefixes for internal use:

• VMware ESXi: Frequently uses 00:50:56 (UAA) for managed virtual cards, but may use 00:05:69 or locally administered ranges for private host networks.
• Microsoft Hyper-V: Allocates dynamic synthetic MAC ranges starting with 00:15:5D.
• Docker Runtimes: Default bridge interfaces assign random MACs starting with 02:42:xx (with the U/L bit set to 1).

Best Practices for Diagnostic Device Identification

To avoid misidentifying devices on an enterprise network, network administrators should use OUI lookups as a baseline indicator rather than absolute proof. Combine OUI results with higher-layer diagnostic techniques:

1. Check the U/L Bit First: Verify whether the second hex character is 2, 6, A, or E. If set, recognize that IEEE vendor registries are irrelevant.
2. Inspect DHCP Option Fields: Examine DHCP Request messages in packet captures or server logs for Option 60 (Vendor Class Identifier) and Option 55 (Parameter Request List), which expose operating system signatures.
3. Cross-Reference Layer 3 Protocol Announcements: Use mDNS (Bonjour), LLMNR, or SSDP broadcast packets to capture advertised hostnames and service definitions.
4. Evaluate Active Port Signatures: Perform selective Nmap service probes to identify open operating system ports and banner strings.

By understanding the structural limitations of the IEEE registry, network engineers can interpret OUI query results accurately while employing multi-layered diagnostic workflows to classify unknown devices.