Disclosure: I run the API described below (it is listed on RapidAPI, with a free plan), and this post was drafted with an AI assistant and reviewed before publishing.

Every network device has a MAC address, and the first three bytes (the OUI) say who registered it. Looking that up usually means downloading the IEEE registry files, parsing them, and keeping them fresh. Here is what the lookup involves, and a ready-made call if you would rather not maintain it.

What the registry contains

IEEE assigns address blocks in three sizes:

  • MA-L: 24-bit prefix (the classic 6-hex-digit OUI)
  • MA-M: 28-bit prefix
  • MA-S: 36-bit prefix (formerly IAB)

A correct lookup needs longest-prefix matching: a 36-bit block can sit inside an organization's range, so checking only the first 3 bytes can return the wrong vendor.

The randomized MAC trap

Modern phones use private (randomized) MAC addresses per Wi-Fi network. They are marked by the locally administered bit: the second-least-significant bit of the first octet. If it is set, the address was not assigned by a vendor, so a vendor lookup will not mean anything. Treat those as "unknown, privacy-randomized" rather than "no match".

One call

The endpoint is GET /lookup?mac=... and accepts any common format (colons, dashes, dots, or none):

import requests resp = requests.get( "https://mac-address-lookup-oui-vendor-ieee-prefix.p.rapidapi.com/lookup", params={"mac": "3C:22:FB:12:34:56"}, headers={ "X-RapidAPI-Key": "YOUR_KEY", "X-RapidAPI-Host": "mac-address-lookup-oui-vendor-ieee-prefix.p.rapidapi.com", }, timeout=10, ) print(resp.json())

The JSON includes: found, vendor, prefix, block, prefix_bits (24, 28 or 36), registry, locally_administered, multicast, randomized and the data license note.

Listing and free plan: https://rapidapi.com/south-star-tools-2-south-star-tools-2-default/api/mac-address-lookup-oui-vendor-ieee-prefix

Doing it yourself instead

If you prefer to host it, download the IEEE MA-L, MA-M and MA-S CSV files, normalize the MAC to uppercase hex, and match the longest prefix first (36, then 28, then 24 bits). Check the locally administered bit before reporting a vendor.

If you hit a case that returns something wrong, tell me in the comments and I will fix it.