Your phone shows a random MAC address because modern operating systems generate a fake hardware address for each Wi-Fi network you join, so networks can't track your device across cafes, airports and offices by its permanent address. iOS 14, Android 10 and current Windows 10/11 all do this by default. It is a privacy feature, not a sign of an intruder.
What is MAC randomization?
Every network adapter ships with a burned-in MAC address, and its first three bytes (the OUI) identify the manufacturer. That address used to be broadcast on every network you touched, which turned it into a tracking cookie for the physical world. Retailers and public hotspots logged it to follow foot traffic.
Apple, Google and Microsoft closed that hole. Since iOS 14 and Android 10 in 2020, and in recent Windows, the OS invents a random MAC per SSID and presents that instead of the real one. Rejoin the same network and you usually get the same random address back. Join a new one and you get a fresh address. Some Android builds rotate it periodically even on a network you already trust.
How can I tell a MAC address is randomized?
Look at the second character. A randomized, "locally administered" address has a specific bit set in its first byte, which in practice means the first octet ends in 2, 6, A or E. So A2:..., 7E:... or 36:... are locally administered; a genuine vendor address like A4:CF:12 (an Espressif prefix) is not. The clearest tell in any device list is a MAC that resolves to no manufacturer at all. That is almost always a phone or laptop with private addressing switched on, not a mystery attacker.
Why does a random MAC break vendor lookup and allow-lists?
Two things stop working. Vendor identification through OUI lookup returns nothing, because the locally administered prefix belongs to no company in the IEEE registry. And MAC-based Wi-Fi allow-lists (the "only these addresses may connect" table in your router) become unreliable, because the same phone reappears under a different MAC after a reinstall, an OS update, or a "forget this network." MAC filtering was always weak security theater, and randomization has quietly finished it off. Bind access to a WPA2/WPA3 passphrase, not to hardware addresses.
How do I identify a device with a random MAC anyway?
The MAC is a dead end, so pivot to the signals randomization doesn't touch:
-
Hostname. DHCP and mDNS still carry a name.
Lisas-iPhoneorPixel-7identifies the device outright.nmap -snor your router's client list will show it. -
Behavior and services. Open ports and mDNS/SSDP announcements reveal the platform: an iPhone answers on
_apple-mobdev, a Chromecast advertises_googlecast. Runnmap -sVagainst the IP to fill in the rest. - A name you assign once. The practical fix is a scanner that remembers a device across scans even when its MAC changes, so you label "Lisa's iPhone" a single time and it stays labeled.
DeviceShelf does all three in one local pass: hostname resolution over DNS/mDNS/NetBIOS, port and service enumeration, an OS and device-type guess, and persistent per-device naming that survives a MAC rotation. It runs on your own machine, with no account and no telemetry.
If you're weighing scanners on exactly this behavior, the feature comparison against Fing, LanScan and Angry IP covers how each one handles randomized addresses, and the Fing alternative writeup goes deeper on the local-first difference.
The short version
A random, vendor-less MAC on your network is the expected, healthy default for any recent phone or laptop. Don't chase it as a threat. Identify devices by hostname, by the services they run, and by a name you set once, then lock your Wi-Fi with a strong passphrase rather than a MAC allow-list. If you want that identification done in a single scan, DeviceShelf has a free 7-day trial, no account needed.
