Reading HSRP and VRRP virtual MAC addresses at a glance

When troubleshooting gateway redundancy or validating HSRP and VRRP deployments, you will encounter virtual MAC addresses assigned to the active gateway. These addresses follow strict, predictable formats defined by their respective RFCs. Learning to read them at a glance saves time during lab work, certification exams, and production troubleshooting.

HSRP virtual MAC address format

HSRP uses a reserved MAC address space allocated by IEEE. The format is 0000.0c07.acXX, where XX represents the HSRP group number in hexadecimal.

HSRP MAC: 0000.0c07.acXX

Where:
  0000.0c07.ac = Cisco reserved OUI for HSRP
  XX = Group ID in hex (00 to ff)

Examples:
  Group 0   -> 0000.0c07.ac00
  Group 1   -> 0000.0c07.ac01
  Group 10  -> 0000.0c07.ac0a
  Group 255 -> 0000.0c07.acff

The group ID occupies only the last octet. This means HSRP supports groups 0 through 255 (256 total groups per interface). The virtual IP address and priority are not encoded in the MAC; only the group identifier is. This design keeps the MAC address simple and deterministic.

VRRP virtual MAC address format

VRRP uses a different reserved MAC space: 0000.5e00.01XX. The last octet again represents the VRRP group ID, but in decimal rather than hexadecimal notation when displayed.

VRRP MAC: 0000.5e00.01XX

Where:
  0000.5e00.01 = IANA reserved OUI for VRRP
  XX = VRRP Group ID in decimal (1 to 255)

Examples:
  Group 1   -> 0000.5e00.0101
  Group 10  -> 0000.5e00.010a
  Group 100 -> 0000.5e00.0164
  Group 255 -> 0000.5e00.01ff

VRRP group IDs range from 1 to 255 (group 0 is reserved). Like HSRP, the virtual MAC encodes only the group identifier. The priority and virtual IP are communicated separately in VRRP advertisements.

Quick identification guide

• →If the MAC starts with 0000.0c07.ac, it is HSRP (Cisco proprietary)
• →If the MAC starts with 0000.5e00.01, it is VRRP (standards-based, RFC 3768 and RFC 9568)
• →The last octet (or last two hex digits) is the group ID
• →Convert hex to decimal if needed: 0x0a = 10, 0x0f = 15, 0x64 = 100
• →HSRP groups: 0-255; VRRP groups: 1-255

Why this matters in practice

Recognizing virtual MAC addresses helps you verify correct protocol operation without relying solely on show commands. In packet captures, syslog output, or ARP tables, you can immediately identify which protocol is active and which group is involved. This is especially useful when multiple redundancy groups run on the same interface or when troubleshooting MAC address conflicts.

During CCNA or NSE certification labs, you may be asked to identify a protocol from a MAC address or predict what MAC address a given group will use. Memorizing the OUI prefixes and understanding the group ID encoding takes seconds and eliminates guesswork.