Hardware & Wireless Footprinting: MAC Address OUI Forensics, BSSID Triangulation, and Wi-Fi Geolocation
Explore the physical layer of OSINT. Decode IEEE OUI vendors, detect locally administered MAC randomization, and geolocate wireless access point BSSIDs via public trilateration databases.
While IP addresses change frequently, Layer-2 hardware identifiers—MAC addresses and Wireless BSSIDs—anchor devices to physical equipment and real-world geographic coordinates. Understanding IEEE OUI registers and trilateration engines unlocks precise device fingerprinting.
1. 48-Bit MAC Address Bit Breakdown
A standard MAC address consists of 6 hexadecimal octets (48 bits):
| Bits | Field | Function |
|---|---|---|
| Octets 1 - 3 (24 bits) | Organizationally Unique Identifier (OUI) | Identifies hardware manufacturer (Apple, VMware, Raspberry Pi). |
| Octet 1, Bit 0 (I/G Bit) | Individual / Group Bit | 0 = Unicast (single device), 1 = Multicast/Broadcast frame. |
| Octet 1, Bit 1 (U/L Bit) | Universal / Local Bit | 0 = Burned-in IEEE hardware MAC, 1 = Locally Administered / Randomized. |
2. BSSID Wi-Fi Geolocation Triangulation
Wireless access points broadcast their BSSID continuously. Public repositories like WiGLE.net map millions of BSSID sightings, allowing investigators to convert a captured Wi-Fi handshake into exact street-level coordinates.
MAC Address & IEEE OUI Vendor Sleuth
Identify hardware manufacturers, detect virtual machines, and spot locally-administered randomized MACs.
Frequently asked questions
What is an IEEE OUI (Organizationally Unique Identifier)?
An OUI comprises the first 24 bits (3 octets) of a 48-bit MAC address, assigned by the IEEE to identify the hardware manufacturer (e.g. Apple, Cisco, Espressif).
How does BSSID geolocation work?
Access point MAC addresses (BSSIDs) are wardriven and mapped by Google, Apple, and WiGLE. Querying a BSSID against public databases reveals its exact latitude/longitude coordinates.
What is MAC Address Randomization?
Modern mobile operating systems (iOS and Android) dynamically generate random MAC addresses when scanning or connecting to Wi-Fi networks to prevent physical location tracking.
How do you detect if a MAC address is randomized?
By inspecting the second least significant bit of the first octet (the U/L bit). If the bit is set to 1, the address is Locally Administered (randomized).
Explore our services
- Agent-Readiness Optimization — Make your site easier for AI agents, browser assistants, and answer engines to understand and use.
- AI Mode & AI Overviews Readiness — Prepare your pages to be understood, cited, and chosen in Google AI Mode and AI Overviews.
- AI Search Monitoring & Citation Recovery — Track where your brand appears in AI answers and build the pages needed to win lost citations.
- AI Max & Conversational Ads — Modernize paid search for AI Max, Performance Max, and ads appearing in conversational search.
- Creator & Social-First AI Growth — AI funnels, analytics, and content systems for creators who may not even have a website yet.
- AI Analytics & Attribution — Connect GA4, Search Console, social source data, UTMs, and AI reports into plain-English decisions.
- Custom AI Agents & Knowledge Systems — Build private agents trained on your offers, documents, SOPs, data, and customer workflows.
- AI Governance & Human Review Systems — Set policies, approvals, logs, and quality checks so AI work stays useful, safe, and on brand.
Popular reading
- The "Double Blackout": How October 2026’s SERP Poisoning and PHP2Shell Firewall Panic Just Made Thousands of Brands Invisible to AI Search — While third-party SEO dashboards are flying blind from poisoned search results, emergency WAF rules deployed for CISA’s October 29 deadline are quietly locking
- The Zero-Day Threat Matrix: From PHP2Shell to Mobile Exploits & Infostealers — From the NSA's PHP2Shell emergency to the live Hexacon iPhone jailbreak demo and CISA CoreGraphics zero-day, here is what modern business owners must know about
- The Executive Cyber Defense Checkup: 5-Phase Interactive Security & Dark Web Audit for Business Owners — Audit your business domain, infostealer breach exposure, local workstation persistence, Google Workspace OAuth backdoors, and server vulnerability post-PHP2Shel
- Your Website After PHP2Shell: A 5-Point Security and AI-Readiness Checklist — The NSA told PHP sites to patch or go offline. Here's what business owners should check now — security first, then AI search readiness.
- The Executive Livestream Playbook: How B2B Brands Turn Google's LIVE Badge and Persistent /live Hubs into Inbound Pipeline — Why modern service firms, agencies, and B2B operators use scheduled livestreams, persistent /live command centers, and Google's red LIVE badge to capture high-i
- What Is the WebMCP Protocol? How Websites Give AI Agents Real Tools — WebMCP is a proposed web standard enabling sites to expose structured tools to AI agents instead of guessing UI elements. Learn how declarative HTML and imperat
- How to Optimize Your Site’s Accessibility Tree for AI Agents — AI browser agents don't see your design—they navigate the accessibility tree. Learn how Microsoft Playwright MCP and ChatGPT Atlas parse ARIA roles, names, and
- Engineering Entity Authority: How to Index Synthetic LLM Discussions for Search Visibility — The technical playbook for indexing synthetic Q&As from Perplexity, ChatGPT, Claude, and Grok. How growth engineers and technical SEOs use domain authority arbi