VMware, Inc. — 4 prefixes (MA-L)

VMware's virtual machines are among the most common non-physical devices an analyst encounters, and they announce themselves through four IEEE MA-L blocks all registered to VMware, Inc. at 3401 Hillview Avenue, Palo Alto. The four prefixes are not interchangeable: 00:0C:29 is generated by a standalone ESXi host or by Workstation/Fusion (derived from the VM's UUID), while 00:50:56 is the range vCenter manages and the only one into which an administrator can manually assign a static address. The two older blocks, 00:05:69 and 00:1C:14, date to earlier ESX generations. Within 00:50:56, VMware reserves 00:50:56:00:00:00–00:50:56:3F:FF:FF for manual/static assignment and auto-generates vCenter MACs in 00:50:56:80:xx:xx–00:50:56:BF:xx:xx (the fourth octet encodes 0x80 plus the vCenter Server ID) — which is why trying to hand-set a MAC inside the reserved auto range produces a "not a valid static Ethernet address" error. VMware became a Broadcom subsidiary when that acquisition completed on 22 November 2023, so the registrant name and the current corporate owner now differ. For triage, any of these four prefixes means the device is a VMware guest, not bare metal — 00:50:56 specifically flags a vCenter-managed VM, 00:0C:29 a standalone ESXi/Workstation/Fusion VM. These prefixes identify the hypervisor platform, never the guest workload, and are widely used by sandbox-evading malware (e.g. Nymaim) to detect virtualization before executing.

IEEE assignment

00:05:69, 00:0C:29, 00:1C:14, 00:50:56 → VMware, Inc., registered Palo Alto, CA, US [Confirmed] — IEEE MA-L

Registry / block size

MA-L (24-bit OUI); holds 4 IEEE prefixes (~67.1M addresses) [Confirmed]

HQ / country

3401 Hillview Avenue, Palo Alto, CA 94304, US (registry address) [Confirmed] — IEEE MA-L

Company status

active; acquired by Broadcom Inc., deal completed 2023-11-22 (VMware common stock ceased NYSE trading) [Confirmed] — prnewswire.com, clearygottlieb.com

Device types

virtual machine virtual NICs (not physical hardware) [Confirmed] — vmware.com

Notable products

ESXi/vSphere, vCenter, VMware Workstation, VMware Fusion, Horizon

Special note

00:0C:29 = standalone ESXi/Workstation/Fusion (UUID-derived); 00:50:56 = vCenter-managed/manual (reserved manual range 00:50:56:00:00:00–3F:FF:FF; auto range …:80:xx:xx–…:BF:xx:xx). Virtualization prefix — identifies hypervisor, not guest. [Well-established] — why-did-it.fail, communities.vmware.com

Related vendors

subsidiary of Broadcom Inc. (2023–present); previously Dell Technologies via EMC (2016–2021); EMC acquired VMware 2004

Analyst note

A MAC beginning with any of these four prefixes is almost certainly a VMware VM, not physical hardware — useful for separating VMs from bare-metal assets and spotting unauthorized hypervisors/VMs on a segment.