Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 9 down vote favorite
1

Apple has registered a ton of MAC address ranges for its products. Does anyone know whether it's feasible to reliably identify which Apple product (particularly iPad, iPod, iPhone, and MacBooks) a particular device is in network traffic via specific MAC address prefixes? In other words, is there something about the MAC address of an iPad that is distinguishable from the MAC address of a MacBook, for instance?

share|improve this question
Are you simply needing to identify wether it is a Macintosh product? – E1Suave Apr 29 '12 at 3:07
1  
This will only work if people are not spoofing their MAC addresses. If they are, you may either get false positives or false negatives, depending on who is doing what. – Fake Name Apr 29 '12 at 5:27
Right, I understand that -- but my question wasn't whether MAC addresses are a reliable identifier, I'm asking whether I can distinguish Apple products using them. – Christian Apr 29 '12 at 21:15
@Christian - If they're not a reliable identifier, you can't distinguish Apple products using them, as they can be changed. So no, apparently you don't understand that. It may be possible most of the time, but if the MAC has been changed, it is no longer possible. – Fake Name May 5 '12 at 22:56
I don't strictly know about mac addresses, but tcp fingerprinting (en.wikipedia.org/wiki/TCP/IP_stack_fingerprinting) can sorta get you there. Again, as fake name was so polite in pointing out twice, fingerprinting isn't 100% reliable (I can change my ip stack configuration) but how many people actually do. meh You'd at least be able to segment between iOS and non iOS products. (based on the os fingerprint) – skarface May 6 '12 at 1:42

5 Answers

up vote 3 down vote
+100

No, sorting or determining a pattern in the MAC address isn't a feasible way to map to model of Apple product.

Over years of watching MAC addresses on networks as well as the explosion of devices on the iOS end of things, if there were a nice pattern, it would start showing in deployments with hundreds of devices.

For example, I have one Mac that has data on about 1,000 iOS devices that have been connected over time to that Mac while iPhone configuration utility was running. Looking at the data now, there are no clear patterns to help differentiate between the device types.

This also applies to Macs. Sadly, my data here is in the hundreds and not thousands presently. Yes - a string of MacBooks when ordered together will usually have sequential addresses (more so than sequential serial numbers in fact) - but over time, the iMacs seem mixed in with the Airs and the MacBook Pro.

It could be that there is some encoding present and no-one has stumbled across which bits are coded with model numbers, but a simple sort of the MAC addresses has the devices all jumbled up. Perhaps if you can find someone that runs the mobile device management software for a very large company or school district and see if they are curious enough to see if a larger data set would yield some better results for you.

I haven't seen a case where a Mac and an iOS device share the same smaller block of MAC addresses, but I can't even rule that out for you based on my experience running networks that log MAC address and are in a position to know what hardware is associated with which MAC address over the years.

My guess is the addresses are issued sequentially rather than by final destination. It would make sense to dole out parts of each region to factories that are expected to make 5 or 10 thousand devices in the next month and onle issue more once the existing addresses are consumed. If so, we might have better luck trying to bin the numbers by approximate manufacturing date rather than by where it ends up in a shipping product. Also consider on the Mac end, repairs often give a new MAC address to portables and even desktop Macs when the ethernet controller is replaced.

share|improve this answer
Thanks! This is the closest yet to an answer. We are indeed right now basically monitoring access points that have a lot of people coming through. A quick comment: your first sentence suggests that the pattern would need to be in the last three octets, which needn't be the case given the host of prefixes Apple has, but later you mention that sorting brings out no pattern either, so you may want to clarify. (Also, if you could s/mac/Mac/ where you mention the 1,000 iOS devices, that would help avoid confusion. :) – Christian May 8 '12 at 19:38
You've got free reign to just edit my post to clear this up to your satisfaction. I'll try to find a safe snipped of MAC that I can release showing what I mean and add that later to this post. – bmike♦ May 8 '12 at 19:40
up vote 1 down vote

If you are simply needing to identify whether it is a Macintosh product or not you could try the this MAC address lookup service. It allows you to type in the MAC address, and it will tell you what the vendor name is. It is not likely to be helpful in terms of identifying specific vendors for programatic use, however it has worked for me in regards to finding if the machine is an Apple product.

UPDATE:

Aside from utilizing an internal database it is not likely that you will be able to do what you are asking. If you did decide to setup an internal database it may be prudent to utilize the serial number or another unique ID available for each machine.

share|improve this answer
No, that's not what I'm looking for -- I'm looking for a way to distinguish Apple products via their MAC addresses. – Christian Apr 29 '12 at 21:13
My apologies, I read the question as you were wanting to distinguish if the MAC address was a Macintosh product. – E1Suave Apr 29 '12 at 21:17
No worries! I realize it's a somewhat unusual question. – Christian Apr 30 '12 at 2:20
1  
@E1Suave Your read of the question was my understanding also. I edited the question to clarify the OP's intent. – Daniel Lawson♦ May 1 '12 at 12:12
1  
@DanielLawson Indeed. :–) However, I am still holding out hope on an answer. It seems to me Apple likely would have an internal use for such a thing and perhaps something similar exists for consumer use. – E1Suave May 1 '12 at 12:36
show 3 more comments
up vote 1 down vote

I was working for a worldwide known embedded computer developper/producer. As Dennis sayd (and I guess You allready known) the first three octets of six from the MAC address are for vendor's identification. Therefore u can buy adress ranges from IEEE. After them you have to guarantee as developper/vendor from your own hardware that this second part is so that the complete 6 byte MAC is entirely unique in the whole wolrd (without regarding missuse and MACspoofing for security issues later on). For lifetime of your production activity You have to guarantee that inner your 3 bytes vendor code, each code has a really unique range of adresses for second half of MAC.

How to realize that in a continuous production?

We ve done this by assume a new adress (n+1) from our range n in{0..16'777'215} per each MAC Vendor Adress part, where n was the last given address AND the concerning unit has succesful absolved the final function test (eg. was responding in a Ethernet test bank check).

What's MAC Address and what is it identifying?

In fact, the MAC Adress is for network layer protocoll (2nd Layer in ISO/OSI model) and used for IEE802 protocols as Ethernet,WLAN, Bluetooth and others and refers ONLY the Network Card! NOT the machine behind! So the 2nd part of MAC is nothing else then serial production number from network chipset respectively board (e.g. WLAN or bluetooth internal extention is a small smd- printed cirquit upset on the mainboard and also serviceable).

Examples

I have no Apple hardware arround me. But I made a check with Samsung hardware. Here are my results: (I refer only the vendor part of MAC)

  1. for Samsung Galaxy S II running latest Android 4.0.4

    04:46:65 WLAN (802.11) this refers to Murata Manufacturing Co. as chip-producer 56:b2:a4 GSM advanced (IP over Cellphone network), not refered in my MAC-vendor list

  2. Samsung Galaxy GT-P5110 running latest Android 4.0.4

    50:01:BB WLAN (802.11) not refered in my MAC-vendor list

Hope to give some aspect-related answers to your question.

share|improve this answer
up vote 0 down vote

I am not aware of any official list, but you can try to compile one the way AppleSerialNumberInfo.com has done with serial numbers. You might even approach them to do it for you. A quick check of a few devices suggests it might be possible, as the MAC prefixes I looked at did vary by model.

Of course it will never be foolproof, as devices such as routers and switches (as well as virtual machines) routinely allow you to easily set their MAC addresses to anything you want to.

share|improve this answer
Thanks for the tip. For the record, I fully agree that MAC addresses aren't a stable identifier, but in my setting (i) it simply doesn't matter whether a handful of people have changed them and (ii) I mainly care about distinguishing ipods from ipads from iphones, so the likelihood of people having changed them on these devices is lower still. – Christian May 6 '12 at 0:20
@Christian, I agree people probably haven't changed their iPhone MAC addresses. More likely, someone will spoof an iPhone MAC address with a router or VM. Anyway, it sounds like you're in an environment where you can capture a lot of MAC addresses and empirically answer your own question. If you do, please report back. – Old Pro May 6 '12 at 4:58
1  
I wouldn't bet on it. Just had a quick look around the house and found both an APE and a (very old) Mac mini where the MAC address starts with 00:11:24. – patrix♦ May 7 '12 at 13:56
up vote 0 down vote

The first half of a MAC address identifies the vendor, the second half doesn't necessarily correspond to anything.

share|improve this answer
Bingo - this has been my experience with looking over MAC address and Apple product in general. – bmike♦ May 7 '12 at 20:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.