pwnsy

MAC Identifier

Name the devices on your network from their MAC addresses. runs in your browser

Nothing you paste leaves this tab. The registry file is downloaded once and every lookup after that runs in your browser's memory. Open the network tab in developer tools and press Identify: you will see no request. A MAC address names a specific piece of hardware, so this one stays with you.

Registry: waiting to load.

Paste addresses above and press Identify.
A vendor match names who made the network chip. It does not say what the device is doing. A camera vendor on the list means the hardware comes from a camera brand; it says nothing about whether that camera is recording, reachable or misconfigured. A prefix with no match is a prefix the IEEE registry does not carry or an address the device made up. Read a blank row as unidentified, never as safe. An address marked locally administered is MAC randomisation, which every current phone does by default: that is the device choosing its own address, and it means there was no manufacturer to look up rather than a lookup that failed.
Why half a phone list comes back as randomised

The second-lowest bit of the first octet is the local bit. When it is set, the address was chosen by the device rather than assigned by the IEEE, so there is no manufacturer to look up. In hex, that is a first octet whose second digit is 2, 6, A or E.

Since iOS 14 and Android 10 phones use a different randomised address on every network, on by default. Windows and recent Linux desktops do the same. A randomised address is the normal state of a modern phone and means the opposite of suspicious.

If the low bit of the first octet is set instead (an odd first octet) the address is a multicast or broadcast destination, not a device on your network.

What the registry covers, and what it misses

The data is the Wireshark manuf file, which tracks the IEEE public listing. This page ships the 24-bit assignments: the first three octets, about 39,800 prefixes.

The IEEE also sells 28-bit and 36-bit blocks, where several companies share one 24-bit prefix. On those the vendor shown is the block holder, which is often a contract manufacturer rather than the brand on the case.

Vendors relabel. A camera sold under one brand routinely carries the chipset maker's prefix, so a match on a familiar name is weaker evidence than an unfamiliar one.

The categories are ours, applied to a short list of well-known vendors. A vendor with no category is not thereby a vendor of nothing interesting; it is a vendor we have not tagged.

Getting the list out of your router

Most routers list connected clients under DHCP, Attached Devices or Client List. Select the table and paste it here whole; anything shaped like a MAC address is picked out and the rest of the line is kept beside it as a label.

On a computer already on the network, arp -a prints every address the machine has spoken to. That misses anything quiet, and it misses devices on a guest network or a separate band.

Neither method sees a device that is powered off, on a cellular modem of its own, or wired into a neighbour's network. A short list is not a clean room.

Related screens

Camera probe Camera CVE watch Room sweep

Read the guide

Securing your wifi Bluetooth security