NETSCOUT SYSTEMS INC — 4 prefixes (MA-L)

A MAC address beginning with one of four NetScout Systems OUI prefixes — 04:9F:81, 00:80:8C, D8:E7:2B, or 00:A0:0E — belongs to NetScout Systems, Inc., a NASDAQ-listed (NTCT) network and application performance and security analytics vendor. On a live network this OUI most likely identifies a monitoring probe or appliance on a SPAN/TAP port, or a DDoS-mitigation device at the network edge, rather than a consumer device.

NetScout, founded in 1984 and headquartered at 310 Littleton Road, Westford, MA, holds all four MA-L blocks under the identical registrant name and address in the IEEE OUI registry — consistent with an active corporate entity rather than a defunct or shell registration. Its flagship platforms are nGeniusONE, an analytics platform, and InfiniStreamNG (ISNG), physical and virtual appliances that use Adaptive Service Intelligence (ASI) to capture and analyze network flow and packet data across enterprise, carrier, and data-center/cloud environments.

NetScout's 2015 acquisition of Danaher's communications businesses — Arbor Networks, Fluke Networks, Tektronix Communications, and VSS Monitoring — folded Arbor's DDoS Protection line into the portfolio. A NetScout-prefixed device may therefore also be edge DDoS-mitigation hardware rather than a passive monitoring probe, depending on where it sits in the network.

A confirmed CVE, CVE-2025-32981, affects nGeniusONE builds before 6.4.0 b2350: insecure file permissions on the nGeniusCLI file allow local privilege escalation (CVSSv3.1 7.1, published 2025-04-25). Secondary reporting describes this as part of a broader six-CVE nGeniusONE disclosure cluster (CVE-2025-32980 through 32986) fixed in the same build, but only CVE-2025-32981 was independently verified against NVD in this pass — the wider cluster claim is tagged Likely.

IEEE assignment

4 prefixes → NETSCOUT SYSTEMS INC, registered Westford, MA, US [Confirmed] — IEEE MA-L

Registry / block size

MA-L (24-bit OUI); 4 confirmed blocks (04:9F:81, 00:80:8C, D8:E7:2B, 00:A0:0E) [Confirmed] — IEEE the IEEE MA-L registry

HQ / country

310 Littleton Road, Westford, MA 01886, US [Confirmed] — IEEE the IEEE MA-L registry; netscout.com

Company status

active, publicly traded (NASDAQ: NTCT) [Confirmed] — stockanalysis.com

Device types

network/application performance monitoring appliances, DDoS-mitigation devices [Confirmed] — netscout.com

Notable products

nGeniusONE, InfiniStreamNG (ISNG), Arbor DDoS Protection [Confirmed] — netscout.com

Verified sample prefixes (all MA-L, NETSCOUT SYSTEMS INC)

04:9F:81, 00:80:8C, D8:E7:2B, 00:A0:0E [Confirmed] — IEEE the IEEE MA-L registry

Registration date

Unknown — IEEE the IEEE MA-L registry publishes no assignment/registration date field for OUI entries; not attributable to IEEE [Confirmed abstention] — standards-oui.ieee.org/oui/oui.csv

Special note

nGeniusONE builds before 6.4.0 b2350 carry a confirmed local-privesc CVE (CVE-2025-32981); secondary reporting describes a wider six-CVE April 2025 disclosure cluster (CVE-2025-32980 through 32986), only partially independently verified here [Confirmed for -32981; Likely for the wider cluster] — nvd.nist.gov

Related vendors

Arbor Networks, Fluke Networks, Tektronix Communications, VSS Monitoring (all acquired via Danaher's communications businesses, 2015) [Confirmed] — en.wikipedia.org/wiki/NetScout_Systems

Analyst note

A NetScout OUI most likely identifies a monitoring probe/appliance on a SPAN/TAP port or a DDoS-mitigation device at a network edge, not consumer or general-office equipment.