Special MAC addresses defined by the standards and the RFCs
Some MAC addresses belong to no device at all: they are reserved by the IEEE 802 standards and by the RFCs to designate a group of machines, a control protocol or a particular situation.
One recipient, or a whole group
The least significant bit of the first byte separates the two families. Set to zero, the address targets a single device (unicast). Set to one, it targets a group: every device subscribed to that group processes the frame. This is why the vast majority of reserved addresses start with an odd byte: 01, 33, 09…
The broadcast address FF:FF:FF:FF:FF:FF is the extreme case of a group: it targets everyone on the local network, with no subscription needed.
Group addresses derived from IP
When an IP stream is addressed to a group, the MAC address is not chosen freely: it is computed from the IP address. In IPv4 (RFC 1112), the last 23 bits of the group address are copied after the prefix 01:00:5E. In IPv6 (RFC 2464), the last 32 bits are copied after 33:33.
That mechanism is what makes multicast efficient: network cards filter out the groups they are not subscribed to themselves, without waking up the operating system.
Table of the most common reserved addresses
| Address | Meaning | Usage |
|---|---|---|
| FF:FF:FF:FF:FF:FF | Broadcast | Every device on the local network. Used by ARP and DHCP. |
| 00:00:00:00:00:00 | All-zero address | Means “no address”: padding, incomplete configuration, unreadable log. |
| 01:00:5E:00:00:00 → 01:00:5E:7F:FF:FF | IPv4 groups (RFC 1112) | Built from an IPv4 multicast address. |
| 01:00:5E:00:00:01 / :02 | All IPv4 hosts / all IPv4 routers | Maps to groups 224.0.0.1 and 224.0.0.2. |
| 01:00:5E:00:00:FB / :FC | mDNS / LLMNR | Service discovery (Bonjour) and Windows local name resolution. |
| 33:33:xx:xx:xx:xx | IPv6 groups (RFC 2464) | The last 32 bits of the IPv6 group address. |
| 33:33:00:00:00:01 / :02 | All IPv6 hosts / all IPv6 routers | Maps to ff02::1 and ff02::2. |
| 33:33:FF:xx:xx:xx | Solicited-node group (RFC 4291) | IPv6 neighbour discovery, the equivalent of ARP. |
| 01:80:C2:00:00:00 | Spanning tree STP / RSTP | Topology exchange between switches, to avoid loops. |
| 01:80:C2:00:00:01 | Flow control (PAUSE frames) | Asks the directly attached neighbour to stop sending for a moment. |
| 01:80:C2:00:00:03 | 802.1X authentication (EAPOL) | The device proves its identity before the port opens. |
| 01:80:C2:00:00:0E | LLDP neighbour discovery | Each device announces its name, port and capabilities. |
| 01:1B:19:00:00:00 | PTP time sync (IEEE 1588) | Clocks synchronised to the microsecond. |
| 01:00:0C:CC:CC:CC | Cisco protocols (CDP, VTP, PVST) | Discovery and VLAN management between Cisco devices. |
| 00:00:5E:00:01:xx | VRRP IPv4 virtual router (RFC 5798) | Shared gateway: a standby router takes over the traffic. |
| 00:00:5E:00:02:xx | VRRP IPv6 virtual router (RFC 5798) | The same mechanism for an IPv6 gateway. |
| 00:00:0C:07:AC:xx | HSRP virtual router (Cisco) | Cisco’s proprietary equivalent of VRRP. |
| 00:00:5E:00:53:00 → :FF | Documentation addresses (RFC 7042) | Reserved for documentation and tests; no real device. |
| 01:00:5E:90:00:00 → 01:00:5E:9F:FF:FF | Documentation groups (RFC 7042) | Multicast reserved for documentation. |
| CF:00:00:00:00:00 | Test / loopback address | Link test frames, legacy PPP configurations. |
| 09:00:2B:01:xx:xx | DECnet groups | A historical protocol, now virtually extinct. |
Why no vendor is shown
These addresses are defined by the standards themselves. Even when their first bytes look like an assigned prefix — 00:00:5E belongs to IANA, 00:00:0C to Cisco — the specific range is reserved for protocol use. Looking for a manufacturer then makes no sense.
MAClens recognises each of these cases and shows a dedicated explanation instead of a misleading vendor name: try FF:FF:FF:FF:FF:FF or 33:33:FF:12:34:56.