MAC Vendor Lookup

Find the manufacturer of any network device by its MAC address

Accepts full MAC or first 3 octets  ·  any separator ( : - space ) or none

Dynamic ARP entries are read-only — comments cannot be set on them.
Use DHCP leases instead: they cover every network automatically and support comments. For static-IP devices use the ARP scan script below.

► MikroTik — DHCP leases  all networks
RouterOS 6.45+  ·  Winbox Terminal or /system scripts 
# MAC Vendor Lookup -- DHCP leases
# Covers ALL DHCP servers (= all networks) in one pass.
# Add to /system scheduler (e.g. interval=1h) for automatic annotation.
# Requires RouterOS 6.45+ with outbound HTTPS.
#
# IMPORTANT: paste the whole block including { } into the terminal,
# or add it to System -> Scripts and run from there.

{
:local apiBase "https://mac.techbg.net/api/"
:local count   0


# List DHCP servers / networks (informational)
:foreach srv in=[/ip dhcp-server find] do={
    :local n [/ip dhcp-server get $srv name]
    :local i [/ip dhcp-server get $srv interface]
    :log info ("DHCP server: " . $n . "  iface: " . $i)
}

# Annotate leases that have no comment yet
:foreach lease in=[/ip dhcp-server lease find] do={
    :local mac     [/ip dhcp-server lease get $lease mac-address]
    :local current [/ip dhcp-server lease get $lease comment]

    :if ($current = "") do={
        :do {
            :local url ($apiBase . $mac . "?format=text")
            :local res [/tool fetch url=$url output=user as-value]
            :local vendor ($res->"data")

            :if ($vendor != "") do={
                /ip dhcp-server lease set $lease comment=$vendor
                :set count ($count + 1)
                :log info ("vendor: " . $mac . " = " . $vendor)
            }
        } on-error={
            :log warning ("mac lookup failed: " . $mac)
        }
    }
}
:log info ("Done. Annotated " . $count . " leases.")

}
► MikroTik — IP scan  full network → log IP + MAC + Vendor
Auto-detects /24 subnets  ·  /log print where topics~"script" 
# Network IP Scan -- logs IP | MAC | Vendor for every host
# 1. Auto-detects all /24 networks on local interfaces
# 2. Ping-sweeps each subnet to populate the ARP table
#    (catches static-IP devices that never used DHCP)
# 3. Queries vendor for every ARP entry and writes to /log
#
# View results: /log print where topics~"script"
# Requires RouterOS 6.45+, outbound HTTPS to mac.techbg.net
#
# IMPORTANT: paste the whole block including { } into the terminal,
# or add it to System -> Scripts and run from there.

{
:local apiBase  "https://mac.techbg.net/api/"
:local found    0
:local ouiList  ""
:local cache    ""

:log info "===== Network Scan Start ====="

# Step 1: ping-sweep every /24 found on local interfaces
:foreach a in=[/ip address find] do={
    :local net    [/ip address get $a network]
    :local prefix [/ip address get $a prefix-length]
    :local iface  [/ip address get $a interface]

    :if ($prefix = 24) do={
        :log info ("Scanning " . $net . "/24 on " . $iface)
        :local lastDot 0
        :for i from=0 to=([:len $net]-1) do={
            :if ([:pick $net $i ($i+1)] = ".") do={ :set lastDot $i }
        }
        :local base [:pick $net 0 ($lastDot+1)]
        :for i from=1 to=254 do={
            /ping ($base . $i) count=1 interval=20ms
        }
    }
}
:delay 3s

# Step 2: collect unique OUIs from ARP table
:foreach entry in=[/ip arp find] do={
    :local mac [/ip arp get $entry mac-address]
    :if ([:len $mac] = 17) do={
        :local oui ([:pick $mac 0 2] . [:pick $mac 3 5] . [:pick $mac 6 8])
        :if ([:find $ouiList $oui] < 0) do={
            :if ($ouiList != "") do={ :set ouiList ($ouiList . ",") }
            :set ouiList ($ouiList . $oui)
        }
    }
}

# Step 3: ONE batch HTTP call for all unique OUIs
:if ($ouiList != "") do={
    :do {
        :local res [/tool fetch url=("https://mac.techbg.net/api.php?sort=vendor&macs=" . $ouiList) output=user as-value]
        :set cache ($res->"data")
    } on-error={ :log warning "Batch vendor lookup failed" }
}

# Step 4: log results from cache (no more HTTP calls)
:log info "IP                 MAC                Vendor"
:log info "-----------------------------------------------------"

:foreach entry in=[/ip arp find] do={
    :local mac [/ip arp get $entry mac-address]
    :local ip  [/ip arp get $entry address]
    :if ([:len $mac] = 17) do={
        :local oui    ([:pick $mac 0 2] . [:pick $mac 3 5] . [:pick $mac 6 8])
        :local vendor "Unknown"
        :local cPos   [:find $cache ($oui . "~")]
        :if ($cPos >= 0) do={
            :local sfx    [:pick $cache ($cPos + 7) [:len $cache]]
            :local vEnd   [:find $sfx ";"]
            :if ($vEnd < 0) do={ :set vEnd [:len $sfx] }
            :set vendor [:pick $sfx 0 $vEnd]
        }
        :log info ($ip . "  |  " . $mac . "  |  " . $vendor)
        :set found ($found + 1)
    }
}

:log info ("===== Scan done -- " . $found . " hosts =====")
}
► MikroTik — ARP table  current snapshot → log IP + MAC + Vendor
Edit $scanIface  ·  /log print where topics~"script" 
# ARP table snapshot -- logs IP | MAC | Vendor for a single interface.
# No ping sweep -- reads whatever is currently in the ARP table.
# Change "bridge" to your actual interface name before running.
# View results: /log print where topics~"script"
#
# IMPORTANT: paste the whole block including { } into the terminal,
# or add it to System -> Scripts and run from there.

{
:local apiBase   "https://mac.techbg.net/api/"
:local scanIface "bridge"
:local found     0
:local ouiList   ""
:local cache     ""

# Pass 1: collect unique OUIs
:foreach entry in=[/ip arp find interface=$scanIface] do={
    :local mac [/ip arp get $entry mac-address]
    :if ([:len $mac] = 17) do={
        :local oui ([:pick $mac 0 2] . [:pick $mac 3 5] . [:pick $mac 6 8])
        :if ([:find $ouiList $oui] < 0) do={
            :if ($ouiList != "") do={ :set ouiList ($ouiList . ",") }
            :set ouiList ($ouiList . $oui)
        }
    }
}

# ONE batch HTTP call for all unique OUIs
:if ($ouiList != "") do={
    :do {
        :local res [/tool fetch url=("https://mac.techbg.net/api.php?sort=vendor&macs=" . $ouiList) output=user as-value]
        :set cache ($res->"data")
    } on-error={ :log warning "Batch vendor lookup failed" }
}

# Pass 2: log from cache (no HTTP calls)
:log info ("===== ARP Snapshot: " . $scanIface . " =====")
:log info "IP                 MAC                Vendor"
:log info "-----------------------------------------------------"

:foreach entry in=[/ip arp find interface=$scanIface] do={
    :local mac [/ip arp get $entry mac-address]
    :local ip  [/ip arp get $entry address]
    :if ([:len $mac] = 17) do={
        :local oui    ([:pick $mac 0 2] . [:pick $mac 3 5] . [:pick $mac 6 8])
        :local vendor "Unknown"
        :local cPos   [:find $cache ($oui . "~")]
        :if ($cPos >= 0) do={
            :local sfx    [:pick $cache ($cPos + 7) [:len $cache]]
            :local vEnd   [:find $sfx ";"]
            :if ($vEnd < 0) do={ :set vEnd [:len $sfx] }
            :set vendor [:pick $sfx 0 $vEnd]
        }
        :log info ($ip . "  |  " . $mac . "  |  " . $vendor)
        :set found ($found + 1)
    }
}

:log info ("===== Done -- " . $found . " entries =====")
}