Symantec Corporation — 3 prefixes (MA-L)

A MAC address starting with 00:0D:D4, 00:A0:65, or B4:A9:84 belongs to Symantec Corporation, and on a live network most plausibly identifies one of the company's own security appliances — a ProxySG web proxy, an Advanced Secure Gateway, or a Symantec Management Center box — rather than an ordinary computer that merely runs Norton or Symantec software.

These three blocks are the only IEEE MA-L (24-bit) assignments registered directly to "Symantec Corporation"; a registry cross-check turned up no MA-M or MA-S block under that exact name. Each carries a different registered address — Waltham, MA; Cupertino, CA; and Mountain View, CA — reflecting different eras of the company rather than one fixed headquarters.

Symantec Corporation was founded in 1982 and traded on NASDAQ as SYMC. In November 2019 it sold its enterprise security business — including the appliance lines these OUIs most plausibly tag — to Broadcom Inc. for $10.7 billion. The same day, the remaining consumer entity renamed itself NortonLifeLock, which later merged with Avast and became Gen Digital Inc. in 2022.

A fourth, similarly-named prefix, 00:22:A1, belongs to a different registrant — "Huawei Symantec Technologies Co.,Ltd." — a 2008-2012 joint venture that Huawei fully bought out in 2012. It is not part of this vendor's prefix set and should not be attributed to Symantec Corporation.

Named, dated CVEs exist against the ProxySG and Advanced Secure Gateway product lines these OUIs likely tag, including an unrestricted file-upload flaw (CVE-2016-10258) and a management-console reflected XSS patched before version 6.5.10.6/6.7.2.1. Most date to 2016-2018 and have since been patched; none indicate the appliances or brand are associated with malware distribution.

Vendor

Symantec Corporation — enterprise network/web security appliances

Confirmed prefixes

00:0D:D4, 00:A0:65, B4:A9:84 — all MA-L, all registered "Symantec Corporation"

Not this vendor

00:22:A1 — registered to the separate "Huawei Symantec Technologies Co.,Ltd." joint venture

Current ownership

enterprise appliance lines under Broadcom Inc. since Nov 2019; consumer Norton brand under Gen Digital Inc.

Registration date

Unknown — IEEE publishes no per-prefix assignment date

IEEE assignment

3 MA-L prefixes → Symantec Corporation [Confirmed] — the IEEE MA-L registry (000DD4, 00A065, B4A984)

Registry / block size

MA-L (24-bit OUI) x3; no MA-M or MA-S block found under "Symantec" [Confirmed] — the IEEE MA-L registry, the IEEE MA-M registry, the IEEE MA-S registry

Registered addresses

00:0D:D4 → 275 2nd Ave, Waltham, MA, US 02541; 00:A0:65 → 20330 Stevens Creek Blvd., Cupertino, CA, US 95014; B4:A9:84 → 350 Ellis Street, Mountain View, CA, US 94043 [Confirmed] — the IEEE MA-L registry

Company status

reorganized — enterprise security business sold to Broadcom Inc. (closed Nov 4, 2019, $10.7B); original registrant renamed NortonLifeLock the same day, then merged with Avast and renamed Gen Digital Inc. (2022) [Confirmed] — sec.gov 8-K exhibit, siliconangle.com, en.wikipedia.org/wiki/NortonLifeLock

Device types

security appliances — ProxySG, Advanced Secure Gateway / S-Series, SSL Visibility, Security Analytics, Messaging Gateway, Management Center [Likely] — techdocs.broadcom.com

Notable products

Symantec Endpoint Protection, ProxySG / Advanced Secure Gateway, Symantec Data Loss Prevention, Symantec Messaging Gateway, Symantec Security Analytics; Norton Antivirus/360 is the separate consumer brand, now under Gen Digital, and is not tied to these OUIs

[Likely] — techdocs.broadcom.com, siliconangle.com

Verified sample prefixes (all MA-L, "Symantec Corporation")

00:0D:D4, 00:A0:65, B4:A9:84 [Confirmed] — the IEEE MA-L registry, netify.ai/resources/macs/brands/symantec

Related-but-distinct block

00:22:A1 → "Huawei Symantec Technologies Co.,Ltd." (2008-2012 joint venture; Huawei bought out Symantec's stake in 2012 for $530M); not part of this entry's prefix set [Confirmed] — the IEEE MA-L registry (0022A1), en.wikipedia.org/wiki/Huawei_Symantec

Security context

named CVEs against ProxySG/Advanced Secure Gateway (e.g. CVE-2016-10258 unrestricted file upload; a management-console reflected XSS patched before 6.5.10.6/6.7.2.1), dated 2016-2018, most since patched; no indication of malware association with the brand or these appliances

[Likely] — cvedetails.com/product/41013, exploit-db.com/exploits/47392

Special note

IEEE's MA-L registry schema carries no date field for any of the 4 prefixes discussed (the 3 Symantec blocks plus the separate Huawei Symantec block); maclookup.app shows vendor-level "First Seen"/"Last Mod" scrape timestamps, which are third-party database artifacts, not IEEE facts, and must not be read as a registration date

[Confirmed] — the IEEE MA-L registry, maclookup.app/vendors/symantec

Related vendors

Huawei Symantec Technologies Co.,Ltd. (separate joint-venture registrant, not owned by Symantec), Broadcom Inc. (acquired the enterprise appliance business, 2019), Gen Digital Inc. (formerly NortonLifeLock, continues the consumer Norton brand)

[Confirmed] — siliconangle.com, en.wikipedia.org/wiki/NortonLifeLock, en.wikipedia.org/wiki/Huawei_Symantec

Analyst note

a MAC on 00:0D:D4, 00:A0:65, or B4:A9:84 identifies genuine Symantec-registered hardware — most plausibly one of the ProxySG / Advanced Secure Gateway appliance lines now owned by Broadcom, not the Norton consumer software brand, which is now under Gen Digital and unrelated to these OUIs. The similarly-named 00:22:A1 is a separate registrant and must not be treated as Symantec's.

[Likely] — synthesis of the sources above