Hardware & Wireless Footprinting: MAC Address OUI Forensics, BSSID Triangulation, and Wi-Fi Geolocation
Explore the physical layer of OSINT. Decode IEEE OUI vendors, detect locally administered MAC randomization, and geolocate wireless access point BSSIDs via public trilateration databases.
While IP addresses change frequently, Layer-2 hardware identifiers—MAC addresses and Wireless BSSIDs—anchor devices to physical equipment and real-world geographic coordinates. Understanding IEEE OUI registers and trilateration engines unlocks precise device fingerprinting.
1. 48-Bit MAC Address Bit Breakdown
A standard MAC address consists of 6 hexadecimal octets (48 bits):
| Bits | Field | Function |
|---|---|---|
| Octets 1 - 3 (24 bits) | Organizationally Unique Identifier (OUI) | Identifies hardware manufacturer (Apple, VMware, Raspberry Pi). |
| Octet 1, Bit 0 (I/G Bit) | Individual / Group Bit | 0 = Unicast (single device), 1 = Multicast/Broadcast frame. |
| Octet 1, Bit 1 (U/L Bit) | Universal / Local Bit | 0 = Burned-in IEEE hardware MAC, 1 = Locally Administered / Randomized. |
2. BSSID Wi-Fi Geolocation Triangulation
Wireless access points broadcast their BSSID continuously. Public repositories like WiGLE.net map millions of BSSID sightings, allowing investigators to convert a captured Wi-Fi handshake into exact street-level coordinates.
MAC Address & IEEE OUI Vendor Sleuth
Identify hardware manufacturers, detect virtual machines, and spot locally-administered randomized MACs.
Frequently asked questions
What is an IEEE OUI (Organizationally Unique Identifier)?
An OUI comprises the first 24 bits (3 octets) of a 48-bit MAC address, assigned by the IEEE to identify the hardware manufacturer (e.g. Apple, Cisco, Espressif).
How does BSSID geolocation work?
Access point MAC addresses (BSSIDs) are wardriven and mapped by Google, Apple, and WiGLE. Querying a BSSID against public databases reveals its exact latitude/longitude coordinates.
What is MAC Address Randomization?
Modern mobile operating systems (iOS and Android) dynamically generate random MAC addresses when scanning or connecting to Wi-Fi networks to prevent physical location tracking.
How do you detect if a MAC address is randomized?
By inspecting the second least significant bit of the first octet (the U/L bit). If the bit is set to 1, the address is Locally Administered (randomized).