Reading a MAC address: OUI, unicast and the local bit

The 48 bits of a MAC address carry more than an identifier. Read them and you can tell the vendor, whether the frame is unicast or multicast, and whether the address was burned in or assigned by software.

Two halves

The first 24 bits are the OUI (Organizationally Unique Identifier) - the block assigned to a vendor. The last 24 bits are the NIC portion the vendor assigns to each device. That is why the first half of a MAC often maps to a recognizable manufacturer.

The two bits that matter

• →Least-significant bit of the first byte - the I/G bit: 0 is unicast, 1 is multicast (all ones, ff:ff:ff:ff:ff:ff, is broadcast).
• →Next bit - the U/L bit: 0 is universally administered (burned in), 1 is locally administered (randomized, virtual, or hand-set).

A randomized phone MAC or a VRRP virtual MAC has the local bit set - a quick tell when an address does not map to any real vendor.