Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose we know that MAC address A belongs to a certain device (say an iPhone 5), and MAC address B also belongs to an iPhone 5. If we have a MAC address C which is in between A and B, does this guarantee that C is an iPhone 5 or could it be any Apple product?

EDIT: Suppose they all have the same 3 byte prefix, e.g.:

share|improve this question
up vote 5 down vote accepted

It could be any product, not just any Apple product.

The first 3 bytes (24 bits) of the MAC address identify the vendor of the NIC (Network Interface Card). If Apple owns the blocks 00:00:01 and 00:00:03, then MAC-address 00:00:02:00:00:01 could belong to Cisco as well as any other vendor.

And besides, almost every NIC allows changing (spoofing) the MAC-address. They are not really that reliable, especially when people know you are trying to identify devices based on their MAC-address.

Edit: In reply to your edit, yes those would all be from the same NIC vendor, given that the user has not changed his MAC-address manually.

share|improve this answer
Vendor in this case should be NIC vendor, as Apple will buy their NICs. – Manuel Faux Nov 19 '12 at 10:29
@ManuelFaux You're right! Edited post accordingly. – Luc Nov 19 '12 at 11:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.