MAC Addresses in Hexadecimal Format

A MAC (Media Access Control) address is a 48-bit (6-byte) hardware identifier assigned to network interfaces. It is expressed as six pairs of hexadecimal digits, making it one of the most naturally hex-formatted values in computing. Every Ethernet frame in a network contains source and destination MAC addresses in raw hex form.

MAC address structure:

A MAC address like 00:1A:2B:3C:4D:5E has two parts:

Bytes	Hex	Component
0-2	00 1A 2B	OUI (Organizationally Unique Identifier) — identifies the manufacturer
3-5	3C 4D 5E	NIC-specific — unique identifier assigned by the manufacturer

OUI vendor lookup:

The first three bytes identify the hardware vendor. For example:

• 00:1A:2B → Ayecom Technology
• 00:50:56 → VMware
• AC:DE:48 → Apple
• DC:A6:32 → Raspberry Pi Foundation
• 00:0C:29 → VMware (another range)
• 08:00:27 → Oracle VirtualBox

Network administrators frequently check the OUI to identify what type of device is connecting to the network.

Notation formats:

MAC addresses are written in several common formats:

• Colon-separated: 00:1A:2B:3C:4D:5E — most common on Linux/macOS
• Hyphen-separated: 00-1A-2B-3C-4D-5E — common on Windows
• Dot-separated: 001A.2B3C.4D5E — used by Cisco devices
• Raw hex: 001A2B3C4D5E — used in some databases and APIs
• Space-separated: 00 1A 2B 3C 4D 5E — as seen in hex editors

MAC addresses in Ethernet frames:

In a raw Ethernet frame captured in hex, the first 14 bytes form the Ethernet header:

• Bytes 0-5: Destination MAC address
• Bytes 6-11: Source MAC address
• Bytes 12-13: EtherType (e.g., 08 00 for IPv4, 86 DD for IPv6)

When you open a packet capture in a hex editor, the very first bytes you see are the destination MAC, making MAC address recognition one of the most common hex-reading tasks in network analysis.

Special MAC addresses:

Hex	Purpose
FF FF FF FF FF FF	Broadcast — sent to all devices on the local network
01 00 5E xx xx xx	IPv4 multicast (last 23 bits from multicast group)
33 33 xx xx xx xx	IPv6 multicast
00 00 00 00 00 00	Unspecified/null — used in some protocols

The universal/local and unicast/multicast bits:

The least significant bit of the first byte indicates unicast (0) or multicast (1). The second least significant bit indicates universally administered (0) or locally administered (1). So 02:xx:xx:xx:xx:xx indicates a locally assigned address (common in virtual machines and containers).