16

I'm not new to home networking and I've been running DD-WRT routers for years. I'm a software developer, so "technologically" curious by nature but admittedly have never really researched in-depth low level technical details of networking.

I'm probably being paranoid and plan on doing further research and learning on my own, but I've been seeing strange things on my home network lately. The one I wanted to ask about here was regarding private MAC Addresses. By that I mean when I look up the MAC Address through the DD-WRT OUI Lookup, it's designated as private.

Google knows all, but I can't really find anything in plain English about typical use or scenarios where they would be used. I have a private MAC address showing up on my LAN with a DHCP assigned IP address that I haven't been able to identify.

I've used NMap pointed at the IP associated with the "private" MAC address but it can't identify anything about it either. It cannot identify the vendor/manufacturer, the O/S, or anything else. I'm looking for any information that may be useful in helping me understand where and what this device may be.

Other info: I've recently updated the WPA2 password from pretty secure to 13+ character length after seeing a "ghost" (aka evil twin) access point/SSID that I also can't identify. Additionally, for now (even though I know it's not a secure solution) I've filtered the offending "private" MAC address from accessing my home networks.

5
  • Have you tried and OUI Lookup to at least find the manufacturer?
    – heavyd
    Apr 29, 2015 at 23:01
  • 1
    How did you nmap a MAC address? Did you find it in your ARP table, so you have a mapping to an IP address? Describe your network, possibly connected devices, and provide the first 6 digits (OUI) of the address please.
    – armani
    Apr 29, 2015 at 23:17
  • Do you have Apple mobile devices on the network? They now dynamically assign MAC addresses. Apr 29, 2015 at 23:20
  • I'll answer all 3 at once... The MAC Address lookup of the router uses OUI Lookup - it's what designated/defined it as a "Private" mac address. Next it has an assigned IP address on my network and NMAP cannot determine vendor/manufacturer, O/S, etc. and last YES alas we do have apple mobile devices on the network... I just can't isolate what device this is.
    – Jeff
    Apr 29, 2015 at 23:37
  • Could you post the first three bytes of the MAC address? That would help people determine whether it was an official "private OUI", or the colloquial term "private MAC", meaning officially "locally administered MAC addresses" Mar 9, 2020 at 14:13

5 Answers 5

10

Private registrations are either MA-L, MA-M, or MA-S assignments from the IEEE to an entity that has paid an additional initial fee and/or an annual recurring fees to the IEEE to prevent their name and address from showing up in the public listing. More details of MA-L listings as an example can be found at the IEEE site.

There is no way to determine the manufacturer of this device from the OUI unless you have access to the private list. You will need to locate and/or identify this device by other means.

Just to be clear, this is in no way related to locally administered MAC addresses which is indicated by the second bit transmitted, specifically the second least significant bit for Ethernet.

2
  • 1
    I just revisited this and got to wondering would a locally administered MAC address also appear as "private" on the OUI search? Or, does it appear as private due to the specific MAC address range?
    – Jeff
    May 4, 2015 at 18:29
  • I would guess this would depend on how the OUI lookup is programmed, starting with what it is using as it's source followed by any built in logic. Local addresses do not show up on the public list of registered OUIs from the IEEE (they are not registered) and private listings show up as private. For instance, testing a number of tools with a MA-M listing (such as 0C-EF-AF) commonly results in IEEE (MA-L listing), some will return PRIVATE (MA-M listing) and a few gave no result. When testing local addresses, most resulted in no result and only one actually reported it as a local.
    – YLearn
    May 4, 2015 at 19:36
16

Private MAC addresses are often found in embedded systems that do not have an official address. Many cheap "credit card computers" such as the Raspberry Pi must generate their own address to operate without an official, manufacturer-assigned address.

For you interest: Private MAC addresses can be identified by having the second-least-significant bit of the most significant byte set. (And as unicast addresses, they must not have the least significant bit set.) That means any addres matching any pattern below is private.

x2:xx:xx:xx:xx:xx
x6:xx:xx:xx:xx:xx
xA:xx:xx:xx:xx:xx
xE:xx:xx:xx:xx:xx

To find what and where your ghost device actually is, I suggest looking for small computers and embedded electronics. A less likely possibility is an intruder in your network with a spoofed MAC address.

And lastly, what actually is your question? ;)

5
  • Well I guess since I couldn't find any real relevant info on Google, or, forums regarding this type of MAC address as it relates to my situation my question was as I generally described, "I'm looking for any information that may be useful in helping me understand where and what this device may be". It's generic and general but so is the scope at this point!
    – Jeff
    Apr 29, 2015 at 23:41
  • btw, thanks for that info... may wind up being useful however the private mac address as designated by OUI lookup doesn't fall into any of those address patterns... it's frustrating because other than technical specifications I don't find much of anything regarding these.
    – Jeff
    Apr 30, 2015 at 0:18
  • 1
    @Peter I took the liberty of removing multicast/broadcast addresses from your list. I hope that's okay. If not, feel free to revert my edit.
    – Spiff
    Apr 30, 2015 at 0:21
  • 7
    This answer refers to "locally administered" MAC addresses, not private MAC addresses. The two concepts are separate and are often mixed up by the use of the term private in association with the similar concept for IP addressing.
    – YLearn
    Apr 30, 2015 at 2:22
  • FWIW, my Raspberry Pi has a MAC address beginning with B8-27-EB, which is registered to "Raspberry Pi Foundation"
    – David C.
    Apr 10, 2019 at 14:58
7

I had the same issue, a "private" MAC suddenly showed up in my router table. I discovered that this appeared whenever my Kindle device was turned on and signed onto my network talking to Amazon. It's apparently something Amazon is doing related to the Kindle.since this appears to be normal behavior when using the Kindle, I am no longer concerned by its' appearance. My secret spy concern is gone.

1
  • 1
    I had a similar problem...but tracked it down to an Amazon Fire TV Stick my wife had started using a while ago. Oddly enough, it showed up in my router's Device Table as a Kindle device, which led me down a rabbit hole, sadly. I want those two hours of my life back!
    – Digger
    Mar 15, 2017 at 21:00
-1

Your DVR, DirecTV/Dish/Comcast/=Insert name= television set might also show up on networks as private. Mine happens to.

-1

FYI MAC address can be local or universal. Local MAC addresses are called as private addresses. Most significant bit of MAC address is used to identify universal or local address.

2
  • Incorrect. Private MAC addresses are addresses assigned to an organization that has paid additional fees to maintain their listing as "Private". Please see my answer above for more detail.
    – YLearn
    Feb 26, 2019 at 21:58
  • Not necessarily incorrect. The toggle on iOS to use transient local MAC addresses instead of the persistent hardware MAC address to make identifying a device across different networks more difficult is named "Private Wi-Fi Address".
    – ssokolow
    Dec 10, 2023 at 22:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .