Context: Personal hotspot connection from iPhone 12 used on my MacBook Air.

Problem: Under Settings - Mobile Data - Personal Hotspot (iPhone), I see 2 data usage components:

1.5 GB - MacBook, and, 20.2 KB - A very suspicious looking MAC address: 4a:f1:1b:3a:7d:86

Further information: I changed password multiple times, but the issue persists. Sometimes, I also see "Other devices"...

What is going on? Is my security in danger? Could this be related to MAC randomisation?

  • Welcome to Ask Different. On your Mac, can you run the following command in Terminal and post the output: arp -l -a? This command displays the IP-to-MAC address translation table. If the unknown MAC address is shown, the IP address could help identify the device (for example, with sudo nmap -O <IP address>. Note that nmap is not part of macOS, but can be installed with Homebrew).
    – jaume
    Mar 2, 2022 at 10:18
  • Thank you Jaume. I will not have access to the hotspot for around a week, but will try as soon as I have the opportunity and update you. Now, if you look at the other answer below, would you agree that it could also be a possibility? Mar 2, 2022 at 13:00
  • jksoegaard's answer is right that we're most probably dealing with a randomized MAC address: according to maclookup.app, the MAC address you see is a locally administered address as opposed to a "real" MAC address. My guess is that your Mac used a randomized MAC address while scanning for known Wi-Fi networks, and then, after connecting to it, if switched to its own MAC address (see support.apple.com/guide/security/wi-fi-privacy-secb9cb3140c/web), that would explain why only 20.2 KB were transferred.
    – jaume
    Mar 2, 2022 at 13:47
  • 1
    Thank you. Wish you a pleasant day. Mar 2, 2022 at 14:12
  • 1
    Okay, so you are saying that it might have scanned my hotspot, but did not connect to it? And thats why my security is not in danger Mar 3, 2022 at 10:17

1 Answer 1


I do not know why you think that MAC address is "suspicious looking". It is not "suspicious looking" to me.

You can tell from the address itself that it is not a MAC address given to a network interface from factory by a hardware vendor - it is instead a software generated MAC address. This is very typical today - for example used in MAC randomisation, a scheme to protect the user privacy.

There's absolutely nothing here that indicates that your "security is in danger".

  • I appreciate the help! Thank you, but why would my data be used by this MAC address if I know that my MacBook is the only device connected to the personal hotspot being shared from my iPhone? Mar 1, 2022 at 23:39
  • Because that MAC address IS the MacBook.
    – jksoegaard
    Mar 1, 2022 at 23:56
  • Interesting. But the MAC address is different from the Wi-Fi Address on my MacBook (System Report - Network - MAC address). What do you think? Mar 2, 2022 at 0:00
  • Yes, exactly - it is software generated, as I wrote in my answer.
    – jksoegaard
    Mar 2, 2022 at 0:12
  • Thank you very much, so it is randomized (due to MAC address randomization being enabled on my MacBook), in other words? Mar 2, 2022 at 0:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .