MAC Addresses and OUI: Vendor Bits, Hex, and Lab Data
Ethernet NICs expose six-byte hardware addresses—often written in hex with colons or dashes. The OUI prefix hints at manufacturer assignments while host-specific bits finish the identifier used in switching and Wi-Fi association.
Read left to right: OUI then device
Split the 48 bits mentally: three bytes commonly map to IEEE registrations; the rest identify the interface under that allocation. Privacy extensions on mobile OSes may randomize locally administered bits—do not rely on stability across sessions.
Hex, binary, and CIDR side by side
Layer 2 addresses complement IPv4 CIDR planning in lab topologies—ARP ties them together when hosts share a broadcast domain.
Integrity checks and debugging
Treat hardware identifiers carefully in logs—hash or truncate where privacy matters. Cross-train with checksum habits and API debugging when correlating traces across services.
Colon vs hyphen formatting
Windows favors `AA-BB-CC-DD-EE-FF` while Unix tools often print with colons—normalize before string comparison in tests. Lowercase versus uppercase is cosmetic but breaks naive equality checks in CI fixtures.
Multicast and special addresses
STP, LLDP, and discovery protocols use reserved destination MACs—packet captures look alarming until you recognize the multicast patterns. Document expected chatter on lab VLANs so junior engineers do not chase ghosts during bring-up.
Containers and overlapping namespaces
veth pairs inside Kubernetes nodes reuse hardware addresses behind NAT—correlate with pod IP and CNI logs, not MAC alone, when debugging east-west traffic.
Recommended tools
Create sample MACs for labs and mocks.
Translate octets when reading raw frames.
Inspect bit-level multicast and local bits.
Pair L3 samples with L2 fixtures in tests.
Related guides
Frequently Asked Questions
What is an OUI in a MAC address?
The first three octets often identify the vendor assignment space—IEEE manages OUIs; local-admin bits may change semantics.
Are MAC addresses globally unique?
Intended to be, but virtualization, spoofing, and privacy features mean treat them as hints not guarantees.
Why convert MACs to hex or binary?
Low-level drivers and bitwise filters reason in hex—converters help debug NIC programming mistakes.
How does this tie to IPv4 planning?
Different layers—MACs operate at L2 while IP/CIDR is L3—but both show up together in ARP tables and DHCP logs.
What is a locally administered MAC?
The second-least significant bit of the first octet marks local scope—useful for privacy features but confusing if you assume OUI lookup always works.
Why randomize MAC on WiFi?
OS vendors rotate hardware addresses to reduce tracking—do not hardcode neighbor assumptions in analytics.
Wrapping up
MAC addresses bridge hardware and logs—know the OUI story, respect privacy, and keep hex tools handy when frames do not match expectations.
MAC Address Generator →