What does a MAC address actually tell you?
ยท 10base-t interactive
Every device on a network has one: a MAC address, usually shown as six pairs
of hex digits separated by colons, like a4:83:e7:12:34:56. Most people
never look at it twice. But that string isn't random, and reading it
correctly tells you something real about the device it belongs to, which is
exactly why a network scanner bothers showing it to you at all.
A MAC address (Media Access Control address) is a hardware identifier burned into a device's network interface, distinct from its IP address, which changes depending on the network it joins. The first half of a MAC address identifies the manufacturer; the second half is unique to that specific device.
- The first three byte-pairs are a registered manufacturer code
- The last three are the device's unique serial portion, assigned by the maker
- iPhones, iPads and modern Macs randomize this address per network by default
- A MAC address tells you who made a device, never who owns or uses it
Where the format comes from
A MAC address is 48 bits, written as six hex pairs. The first 24 bits are an
Organizationally Unique Identifier, a block IEEE assigns to a specific
manufacturer when they register. Apple, for instance, holds dozens of these
blocks, so does Samsung, Ubiquiti, Raspberry Pi's foundation, and thousands
of other hardware makers. The remaining 24 bits are up to the manufacturer to
assign, typically incrementing per unit off the production line. IEEE
maintains the public registry of these
blocks, which is exactly the lookup table a network scanner uses to turn
a4:83:e7 into
"Apple" instead of leaving it as an anonymous string.
That's the whole trick behind a scanner showing you a device's manufacturer without you having to do anything. It isn't detecting the device by fingerprinting its behavior or asking it politely what it is. It's reading the first half of an address every device is required to broadcast just to exist on the network, and matching it against a public registry that's been around since Ethernet was standardized.
What it can and can't tell you
A MAC address reliably tells you the manufacturer, and sometimes narrows things further. Some vendors register separate OUI blocks for different product lines, so a lookup might return "Apple" broadly, or occasionally something more specific depending on how granularly that vendor registered its blocks. It does not tell you the model, the owner, the device's location beyond "on this network," or anything about what the device is doing.
It also doesn't tell you whether the device belongs there. A MAC address that resolves to a manufacturer you don't recognize isn't suspicious by itself. Plenty of ordinary things (a smart plug, a doorbell camera, a neighbor's phone briefly in Wi-Fi range) show up as unfamiliar vendors purely because most people don't memorize which hardware makers they own. What's actually worth a second look is a device you can't account for combined with behavior that doesn't fit: it's been connected far longer than you remember, or it's talking to an external address on a schedule nothing you're doing should cause.
The privacy wrinkle: randomized addresses
Since iOS 14 and recent macOS versions, Apple devices generate a different, randomized MAC address for each Wi-Fi network they join by default, instead of broadcasting the same hardware address everywhere. That's a real privacy improvement: it stops retailers, ad networks, and anyone else running Wi-Fi-based tracking from recognizing your phone by its MAC address as you move between locations. The tradeoff shows up on your own network: a randomized address won't resolve to "iPhone" the way the real hardware address would, since the vendor bits are randomized along with the rest.
Most home routers and scanners will still show the device, just with a generic or unrecognized-looking manufacturer entry until you connect once with a private-address-disabled network or otherwise confirm which device it is. This is a tradeoff working as designed, not a bug in the scanner or the device.
Why this matters for auditing your own network
Reading MAC addresses correctly is most of what turns a bare list of IP addresses into something you can actually act on. IP Scanner resolves every device's MAC against the same kind of vendor registry, labels it by manufacturer instead of leaving it as a hex string, and keeps a running record so you can name devices yourself once you've identified them. It also flags new devices the moment they join, which matters more than the manufacturer lookup alone: knowing something new appeared is the actual signal, the vendor name is just the first clue for figuring out what it is.
Frequently asked questions
Can a MAC address be used to identify a specific person?
Not directly. It identifies a piece of hardware and its manufacturer, not an individual. In practice, a MAC address consistently seen alongside other identifying activity could theoretically help correlate a device to a person, which is exactly the tracking concern randomized MAC addresses were introduced to reduce.
Why do two devices from the same manufacturer show different MAC prefixes?
Large manufacturers register multiple OUI blocks, often split by product line, factory, or simply because they've used up a previous block. Seeing different prefixes from the same company is normal and doesn't indicate anything unusual.
Can I change my device's MAC address?
On many devices, yes. This is sometimes called MAC spoofing, and it has legitimate uses (privacy, working around a router that limits connections by device) alongside less legitimate ones. A changed address will still resolve to whatever manufacturer the new value's OUI block belongs to, which may not match the device's real maker.
Does IP Scanner show randomized MAC addresses?
Yes, exactly as broadcast. A randomized address won't resolve to a meaningful manufacturer name since the vendor bits are randomized too, so it will show as an unrecognized or generic entry until you identify the device some other way, like temporarily disabling private address on that network. Download IP Scanner to see this resolved automatically for every device on your network.