Randomised MAC addresses

What changed

A MAC address is the hardware identifier a device presents on a network. Historically it was fixed and globally unique, which made it a perfect tracking token: any shop, airport or venue with Wi-Fi could recognise a returning phone without it ever joining the network.

So the platforms stopped handing it out. iOS, iPadOS, Android and recent Windows all generate a private address per network by default, and rotate it periodically. Your phone presents one identity to your home network and a completely different one to the café downstairs.

How to recognise a randomised address

There is a reliable tell. The second-least-significant bit of the first byte is the “locally administered” flag, so randomised addresses start with a byte whose second hex digit is 2, 6, A or E — for example 7a:9d:d9:01:32:83. A real manufacturer-assigned address does not, and its first three bytes resolve to a vendor.

That is why an unknown device sometimes shows a vendor and sometimes does not. No vendor is not a sign of something sinister; usually it means the device is protecting itself.

Why this makes network inventories awkward

Anything identifying devices by MAC address has a problem: the identifier is no longer stable. A phone that rotates its address looks like a departure and a brand new arrival. Naïvely, every rotation is a new unknown device — and if the tool sends alerts, every rotation is an alarm.

Sensible handling is to recognise randomised addresses for what they are, correlate on other signals like hostname and behaviour where possible, and weight severity accordingly. A new randomised address on a network is ordinary. A new manufacturer-assigned address is more interesting.

What it means for you

• Do not panic at a long device list. Modern homes run 40–70 network devices routinely once you count lightbulbs, speakers and TVs.
• Label what you recognise. The value is not in the first list; it is in shrinking the unknown pile so that what remains means something.
• Turn private addresses off only for networks you control, and only when you need stable identification. Leaving it on for public networks is the entire point.

Airward flags randomised addresses rather than reporting them as strangers, and treats the first scan of a network as a baseline so you are not handed dozens of alerts on day one. What you label as trusted stays trusted; what appears afterwards is what you hear about.