A MAC address is usually all your router gives you about a device: twelve hex digits like a4:cf:12:9b:00:01, maybe with a half-usable name next to it. The good news: those digits carry more information than they look like. The bad news is that they stop well short of "this is Lisa's tablet". Here is how far a MAC gets you, and how to cover the rest of the distance.
What the address contains
The first half of a MAC address names the manufacturer of the network chip. Those prefixes are assigned by the IEEE and public, so A4:CF:12 resolves to Espressif (smart-home gadgets and DIY boards), D8:3A:DD to Raspberry Pi. The second half is a serial number from the manufacturer's own pool; it identifies nothing publicly.
You can resolve the prefix with our free MAC address vendor lookup. It uses the official IEEE registries (all three of them, including the smaller MA-M and MA-S blocks), runs entirely in your browser, and flags randomised addresses for you.
When the vendor comes back empty
Modern phones, tablets and laptops invent a random MAC per Wi-Fi network by default. Those addresses are marked "locally administered" and deliberately match no registry entry. So an address with no vendor is rarely an intruder; it is usually a phone protecting its privacy. The same phone can even show up as several different devices over time.
If the lookup flags your address as locally administered, stop chasing the vendor. Identify the device by the other signals below instead.
From vendor name to actual device
A vendor name narrows things down, and sometimes that is enough: an Espressif device is almost certainly a smart plug, sensor or similar; a printer vendor is a printer. But "Hui Zhou Gaoshengda Technology" sits inside half the cheap smart-home hardware on the market, and Apple covers everything from a watch to a desktop. To get further you need the device to talk:
-
Hostname. DHCP and mDNS names like
HS110orMacBook-Pro-von-Lisasettle it immediately. Your router list often shows them. - Services. A printer answers on port 631, a camera streams on 554, a NAS offers file sharing on 445, a smart speaker announces itself via mDNS. Which doors are open tells you what lives behind them.
- Behaviour over time. A device that appears every evening at seven and vanishes at midnight is somebody's phone, not a server.
You can collect all of that by hand, or let a scanner do it in one pass. DeviceShelf resolves vendor, hostname, services and open ports for every device on the network and turns them into an actual identification; the same IEEE data behind our lookup page ships inside the app. For the full detective story, see the guide on identifying an unknown device.
Finding the MAC in the first place
- Router: the client list shows a MAC per device — the usual starting point.
-
Windows:
ipconfig /all(Physical Address). -
macOS/Linux:
ifconfigorip link; macOS also shows it under System Settings → Network → Details. - iPhone/iPad: Settings → Wi-Fi → ⓘ on the network (this is the per-network, usually randomised, address).
- Android: Settings → About phone → Status, or in the Wi-Fi details.
What a MAC address will never tell you
No owner, no location, no serial number. The registry knows which company bought the prefix, and that is all. The claim that "this MAC belongs to this person" has no technical basis, which is also why sharing a MAC address is not the privacy catastrophe it is sometimes made out to be. On your own network, though, it remains the most stable handle a device offers, randomisation aside.
