Ethernet MAC address format
6 bytes, formatted in lots of ways. “12-23-34-45-56-67”, “1223:4556:6778”, “1234.5678.9abc” - they’re all the same.
The first 3 bytes are often referred to as the “MAC Vendor field” or “IEEE OUI”, though note that OUI:s are also used for non-Ethernet things.
First byte odd = multicast
x1-xx-xx-xx-xx-xx, x3-xx-xx-xx-xx-xx, x5…, x7…, x9…, xb…, xd…, xf…
These are typically never used as source address, only destination address. Rounding down to a multiple of 4 ( = subtracting 1 or 3 ) from the first byte MAY get you the vendor, depending on application.
First byte not divisible by 4 = locally-configured
x2-xx-xx-xx-xx-xx, x6-xx-xx-xx-xx-xx, xa-xx-xx-xx-xx-xx, xe-xx-xx-xx-xx-xx
These are not registered with IEEE - you are supposed to assign them “locally”, with varying interpretations of “local”. Subtracting 2 from the first byte MAY get you the vendor, depending on what practice the local admins follow.
First byte is x0, x4, x8, xc = you can look it up!
This ought to be an actual IEEE OUI - https://en.wikipedia.org/wiki/Organizationally_unique_identifier
01-00-5e-xx-xx-xx = IPv4 multicast
The final bytes are taken directly from the lowest 23 bits (aka 3 bytes minus highest 1 bit) of the IPv4 multicast address.
This means that several valid IPv4 multicast addresses map to the same Ethernet addresses. So: you can’t know for sure what 01-00-5e-00-00-16 … but it’s a good bet that it’s IGMP (18.104.22.168).
33-33-xx-xx-xx-xx = ipv6 multicast
The 4 lowest bytes are taken from the IPv6 address.
x0 x4 x8 xc = registered MAC vendor
x1 x5 x9 xd = multicast, should belong to above
x2 x6 xa xe = locally-assigned
x3 x7 xa xf = multicast belonging to locally-assigned
Good lookup tools
There’s many that are poorly updated or pull from bad sources.
In our experience, https://www.wireshark.org/tools/oui-lookup.html is one of the best.
If you want the Official Source, it’s http://standards-oui.ieee.org/oui.txt - but the wireshark tables also contain unassigned-but-commonly-found addresses.
Clavister HA shared (virtual) MACs
If you’re a Clavister customer, that’s likely a HA cluster shared MAC address that you are seeing.
The last (sixth) byte is the cluster ID in hexadecimal.
Multicasts to 11-00-00?
If you’re a Clavister customer, that’s likely HA Cluster Heartbeats you’re seeing - it should be a handful every second.
It’s the 10-00-00 address, +1 in the first byte, following standard multicast assignment rules.
With this setting off, the shared address will be 10-00-00-c1-4a-xx.
With this setting ON, “c1-4a” is replaced by a unique number for that Ethernet interface. VLANs still copy that base address - as normal - and are not unique among VLANs on the same trunk.
30 Mar, 2022 core ethernet netwall coscore
25 Jan, 2022 core ethernet settings
28 Oct, 2020 core howto ethernet packetloss cpu
7 May, 2021 core ethernet vlan arp garp