Hardware ID & OUI Fingerprinting Explained

When you scan a network, discovering raw IP addresses is only half the battle. A list containing values like 192.168.1.15 and 192.168.1.34 doesn't help you identify which device is your personal laptop, which is your smart thermostat, and which is an unauthorized intruder. To build a useful network map, we must associate IPs with concrete physical entities.

The primary mechanism for this classification is **Hardware ID Fingerprinting**, which relies on decoding the standardized structured formats built into the low-level network interface hardware. This guide explains how MAC addresses are structured, what OUI registries represent, and how modern network tools identify manufacturers.

The Anatomy of a MAC Address

A **MAC (Media Access Control) Address** is a 48-bit (6-byte) physical identifier burned into the read-only memory of a Network Interface Controller (NIC) during manufacturing. While IP addresses change dynamically via DHCP, MAC addresses are designed to be globally unique permanent hardware identifiers.

A MAC address is represented as six blocks of two hexadecimal characters separated by colons or hyphens (e.g. 3C:5A:37:12:34:56). It is split into two distinct, equal sections:

1. The OUI (Organizationally Unique Identifier)

The first 24 bits (first three octets, e.g. 3C:5A:37) form the **OUI**. These blocks are purchased and registered by hardware manufacturers from the **IEEE Standards Association**. The IEEE keeps a master database linking OUIs to companies (e.g., Apple, Cisco, Gigabyte, Intel).

2. The NIC (Network Interface Controller Specific Identifier)

The final 24 bits (last three octets, e.g. 12:34:56) are allocated directly by the manufacturer. They act as a serial number for each individual chip, guaranteeing that no two network cards in the world share the exact same MAC Address.

IEEE Registration Blocks (MA-L, MA-M, MA-S)

Not all OUI blocks purchase the same range of hardware serials. The IEEE offers three categories of MAC Address allocations based on the size of the manufacturing run:

• MAC Address Block Large (MA-L): Gives the manufacturer the full 24-bit NIC block, allowing them to issue up to **16,777,216** unique MAC addresses under a single OUI prefix.
• MAC Address Block Medium (MA-M): Gives the manufacturer a 20-bit NIC block, allowing up to **1,048,576** unique MAC addresses. The IEEE shares the OUI prefix between multiple companies by hardcoding the next 4 bits.
• MAC Address Block Small (MA-S): Gives the manufacturer a 12-bit NIC block, allowing up to **4,096** unique MAC addresses. Ideal for small-run developers and specialized industrial equipment.

How LAN Lens Performs Client-Side Fingerprinting

Because privacy is a core pillar of LAN Lens, our OUI lookup operations occur **100% locally in browser memory or mobile device sandboxes**. We do not stream your scanned MAC addresses to remote servers or commercial APIs.

To identify your devices instantly while protecting your privacy, LAN Lens uses a three-tier fingerprinting pipeline:

1. Local OUI Matching: The app clean-sanitizes MAC addresses and matches the OUI against a highly optimized, local JSON representation of the IEEE registration tables. This immediately establishes the manufacturer.
2. Hostname Correlation: We query Bonjour (mDNS) and NetBIOS local names. If the OUI establishes that a device is manufactured by Hewlett Packard and the local hostname is HP-OfficeJet-8600.local, we refine the device type to "Office Printer".
3. Port Fingerprinting: By probing ports (e.g., checking if port 62078 is active on an Apple-manufactured interface, which indicates the Apple mobile lock-screen sync service), we can instantly classify the device as an iPhone or iPad.