How do I identify the MAC Address of a Docker container interface?

A Docker container interface can use the legacy prefix 02:42, but that prefix alone cannot identify Docker. In the historical IPv4-derived bridge scheme, the first octet is 02, which makes the address unicast and locally administered, the second is 42, and the remaining four octets repeat the container's IPv4 address. Docker Engine 28 changed bridge and macvlan interfaces to randomly generated MAC addresses, so this mapping describes a legacy pattern, not every current container.

A lookup of such an address returns no vendor, and that is expected rather than an error: the address was assigned by the container runtime, not by the IEEE Registration Authority, so no organization is registered for it.

Why the prefix starts with 02:42

• The first byte of any EUI-48 address carries two control bits. The least-significant bit must be 0 so the address is unicast, and the second-least-significant bit is set to 1 to mark the address as locally administered. 02 is the first octet with both bits set that way and nothing else.
• Because the address is locally administered, no IEEE registration applies to it, and the runtime is free to use the remaining bytes as long as it does not collide with another local address.
• 42 is the fixed second octet in the cited generator. The code does not explain why that value was chosen.

Where the historical generator is called

In Moby v27.5.1's bridge CreateEndpoint implementation, GenerateMACFromIP(endpoint.addr.IP) is used only when no MAC has been provided. The accompanying comment explains that a stable IPv4-to-MAC mapping keeps stale ARP entries usable after a quick disconnect and reconnect. With distinct IPv4 addresses, this mapping produces distinct MACs; it does not prevent collisions with manually assigned addresses or other tools.

Limits of this rule

• It describes the historical IPv4 bridge scheme. Other Docker network drivers, and addresses configured explicitly with --mac-address, can use different values.
• The prefix is not reserved by any standard, and it is not unique to Docker: any tool is free to generate a locally administered address, and some do. Treat the range as a likely origin, not as proof.
• Docker Engine 28.0.0 release notes document the switch to random bridge and macvlan MAC addresses. A helper remaining in the source does not establish that the bridge driver still calls it.

hw[0] = 0x02
hw[1] = 0x42
copy(hw[2:], ip.To4())
    

The copy is conditional on a non-nil IP. The same helper fills the trailing bytes randomly when the IP is nil.

Paste a container address into the MAC address lookup to confirm that no vendor is registered for it. Related guides: randomized and locally administered addresses and why devices randomize their address.