MAC Address Format Guide: Colon, Hyphen, and Cisco Dot Notation

Same 48 bits, three separator conventions

A MAC (Media Access Control) address is a 48-bit hardware identifier, universally split into 6 bytes — the notation differences are purely about which separator and grouping a given vendor's tooling prefers:

Colon:      00:1A:2B:3C:4D:5E   (IEEE standard, Unix/Linux tools)
Hyphen:     00-1A-2B-3C-4D-5E   (common on Windows)
Cisco dot:  001A.2B3C.4D5E      (Cisco IOS convention, grouped in 2-byte chunks)

All three represent the identical 48-bit value — converting between them is purely a matter of re-inserting different separators at different grouping intervals, never a change to the underlying address.

The two bits that actually carry meaning

Buried in the first byte of a MAC address are two individually meaningful bits, easy to miss but important for understanding what an address actually represents:

• Unicast/multicast bit (least significant bit of the first octet): 0 means the address identifies a single device (unicast); 1 means it's a multicast/broadcast address, intended for multiple recipients.
• Universally/locally administered bit (second-least-significant bit of the first octet): 0 means the address was burned in by the hardware manufacturer using their assigned OUI (Organizationally Unique Identifier) block; 1 means it was assigned locally — by software, a hypervisor, or manually — rather than being the vendor's original hardware address.

Why "locally administered" matters in practice

Virtual machines, containers, and randomized MAC address features (many phones now randomize their MAC for Wi-Fi privacy) all use locally administered addresses, since there's no physical network interface with a vendor-assigned OUI to draw from. Seeing the locally-administered bit set is a useful, quick signal that an address is virtual or software-assigned rather than tied to a specific piece of physical hardware from a specific manufacturer.

Why the first three bytes (OUI) can identify a manufacturer

For addresses that are not locally administered, the first 3 bytes are an OUI registered to a specific hardware manufacturer by the IEEE — looking up that OUI against the public IEEE registry reveals which company made the network interface, which is a genuinely useful diagnostic step when auditing unknown devices on a network.

Common mistakes

• Assuming a MAC address in a different notation is a different address. Colon, hyphen, and Cisco-dot forms are purely cosmetic separator differences over the identical 48-bit value.
• Treating a locally-administered address as if it maps to a real manufacturer's OUI. It doesn't — by definition, it wasn't assigned by a vendor's registered block, so an OUI lookup on it won't return a meaningful manufacturer.
• Forgetting the unicast/multicast bit when generating test addresses. A randomly generated test MAC should typically clear this bit (making it unicast) unless multicast behavior is specifically what's being tested.

FAQ

Do colon, hyphen, and dot-separated MAC addresses represent different hardware?
No — they're the same 48-bit address written with different separator conventions; converting between them changes nothing about the underlying value.

What does it mean if a MAC address's "locally administered" bit is set?
The address was assigned by software (a VM, container, or a privacy-randomization feature) rather than burned into hardware by a manufacturer using their registered OUI block.

Can I identify a device's manufacturer from its MAC address?
Yes, if it's not locally administered — the first three bytes (the OUI) are registered to a specific manufacturer and can be looked up in the public IEEE registry.

Reformat MAC addresses between notations and generate test addresses with the MAC Address Formatter — entirely client-side.