MAC address anatomy: OUI, U/L and multicast bits
How the six bytes of a MAC address split into a vendor prefix and device suffix, and what the two flag bits in the first byte actually control.
Six bytes, two halves
A MAC address is 48 bits shown as six hexadecimal bytes. Traditionally the first three bytes form the Organizationally Unique Identifier, or OUI, which the IEEE assigns to a hardware maker. The last three bytes are chosen by that maker to number each interface it builds. So AA:BB:CC:DD:EE:FF splits into an AA:BB:CC vendor prefix and a DD:EE:FF device serial, at least for factory-burned addresses.
The two flag bits that change everything
The least significant two bits of the very first byte are special. Bit 0 is the individual/group (I/G) bit: 0 means the frame targets one interface (unicast) and 1 means a group (multicast). Bit 1 is the universal/local (U/L) bit: 0 means the address was assigned by a vendor and 1 means it was set locally by an administrator. A safe random address clears the I/G bit and sets the U/L bit, which is exactly what this generator does when Locally administered is on.
Why locally administered addresses exist
Locally administered addresses give you a private pool that will never overlap with a real manufacturer's OUI, since the IEEE never assigns a prefix with the U/L bit set. Virtualization platforms, containers and MAC randomization features in phones all lean on this space to hand out addresses freely. Because the low nibble of the first byte carries these flags, locally administered unicast addresses always begin with a byte ending in 2, 6, A or E.
Reading and comparing formats
The same 48 bits can be written several ways without changing meaning. Colon and hyphen notations group the bytes in pairs, differing only in the separator, while Cisco dot notation clusters them in threes. Case is cosmetic too, since hex A and hex a represent the same value. Knowing this lets you paste an address from a router log into a spreadsheet or a spoofing command regardless of how each tool prefers to display it.