MAC Vendor Lookup

MAC Vendor Lookup (macvendorlookup.com) is an online tool that identifies the manufacturer of a network device based on the first three octets of its MAC (Media Access Control) address, known as the Organizationally Unique Identifier (OUI). The OUI is assigned by the IEEE to device manufacturers, making it possible to determine who made a device from its hardware address alone.

For OSINT investigators and digital forensic analysts, MAC vendor lookup is valuable in several investigative contexts. When network logs, WiFi monitoring data, ARP tables, or device management records contain MAC addresses without associated device descriptions, MAC vendor lookup identifies the device manufacturer — narrowing the device type and often suggesting the device category.

In network forensics, ARP table data from routers and switches frequently appears during investigations involving network intrusions or insider threat cases. MAC addresses in ARP tables can be queried against MAC vendor databases to determine what categories of devices are on the network — distinguishing between networking equipment, computers, mobile phones, IoT devices, smart TVs, and other categories based on their manufacturer OUI.

WiFi network analysis is another primary application. When WiGLE data, wardriving captures, or WiFi monitoring includes client MAC addresses, vendor lookup identifies the manufacturers of devices connecting to specific networks. This can corroborate or contradict claims about device types in an environment.

For IoT security investigations, manufacturer identification enables targeted vulnerability research — once the manufacturer is known, the investigator can identify the relevant CVE database entries, default credentials, and known security issues for devices from that manufacturer.

MAC address randomization — increasingly used by modern smartphones and laptops — limits the investigative value of vendor lookups for mobile devices, as randomized MACs use vendor-neutral prefixes that return generic or false manufacturer results. However, device types that don't implement randomization (routers, IoT devices, older hardware) remain reliably identifiable.

Document the MAC address queried, OUI identified, manufacturer returned, and query date for forensic records.