Why does a MAC address lookup return no vendor?

A lookup returns no vendor when the address does not fall inside any block in the registration data. There are three reasons that happens: the address was assigned locally rather than by the IEEE, so no organization registered it; the prefix is in a valid format but appears in no listed block; or the input is too short or malformed to be matched. No vendor is a normal answer, not a fault.

1. The address is locally administered or randomized

A randomized address is generated by the device, not assigned by a registry, so it belongs to no block and has no registrant. A6:1B:2C:3D:4E:5F is such an address: the second hexadecimal digit is 6, which sets the locally administered bit, and the lookup reports no vendor for it. Since Android 10 and later randomize the Wi-Fi address per network by default, and iOS and iPadOS have done the same since iOS 14, this is the most common cause of an empty result on a modern phone or laptop.

2. The prefix appears in no listed block

An address can be well formed and universally administered and still have no record: the block may never have been assigned, or the data a lookup holds may not cover it yet. Results depend on the available IEEE and Wireshark manufacturer data and on how recently those sources were published, so a very new registration can be missing for a while. MACLookup reports this as found=false with the local bit clear — 04:00:00 behaves this way, while 00:00:00 resolves to XEROX CORPORATION.

3. The input is too short or malformed

The lookup needs at least six hexadecimal digits before it can match a block, and it rejects characters outside the hexadecimal range as a bad format. A three-digit prefix, or a copy-paste that keeps a stray character, returns an input error rather than an empty result. The accepted notations are listed in the API documentation.

How to tell the cases apart

• Check the local bit. If the second hexadecimal digit of the first octet is 2, 6, A or E, the address is locally administered and case 1 applies. That is a property of the address itself, so it holds whatever database you query.
• Read the API fields. found=false with isRand=true means a known randomization range, such as the Docker 02:42 prefix on a container interface; found=false with isRand=false means the prefix is simply absent from the data. See the Docker interface guide for that case.
• Do not read it as tampering. A locally administered address is a documented, standard behaviour, not evidence of a spoofed or hostile device.

Which result did you get?

If the address is locally administered, start with what a randomized MAC address is. If the registrant exists but its details are withheld, that is a Private registration and the lookup does return a match. Otherwise, look up the first six digits in the MAC address lookup to see whether a shorter prefix matches.