Local MAC addresses, randomised addresses and privacy

The second least significant bit of the first byte is the U/L bit (universal / local). Set to zero, the address comes from a block assigned by the IEEE, so its vendor can be looked up. Set to one, the address was chosen locally and is listed nowhere.

In practice you read it in the second hexadecimal digit of the first byte: the values 2, 6, A and E mark a local address. The prefixes 02, 06, 0A and 0E are the most common examples.

A fixed MAC address makes it possible to track a device from access point to access point, without it even connecting: it is enough to listen to the network probe requests it constantly sends. Shops, railway stations and airports made wide use of that possibility.

Since then, iOS, Android, Windows and recent Linux distributions draw a random local address: one per Wi-Fi network, sometimes rotated regularly. The factory address stays inside the device but is no longer broadcast. That is why the same phone shows up under different addresses on different networks.

A hypervisor creates network cards that do not physically exist, so it has to invent addresses for them. Some vendors use their own registered prefix, which makes the platform recognisable; others draw a random local address, usually starting with 02.

Containers, virtual interfaces and network bridges follow the same logic. Seeing a local address on a server is therefore perfectly normal and signals no anomaly.

A MAC address can be changed with a single command. Filtering by MAC address on a Wi-Fi network therefore protects against nothing if someone is motivated: they only need to listen to the traffic, pick up an allowed address and reuse it. It is an organisational convenience, not a security measure.

To genuinely control access, use 802.1X authentication, where each device presents a verifiable identity before the port opens. Conversely, an address found in a log stays a useful clue during incident analysis, as long as it is not treated as proof.

When a system builds its IPv6 address from its MAC address, it copies the U/L bit into the interface identifier. A factory address therefore produces an identifier marked as globally unique — and traceable. Current systems prefer random identifiers, rotated periodically, for exactly that reason.

MAClens tells you for every address whether it is factory-assigned or local: try 02:1A:2B:3C:4D:5E to see a local address.