VMware's virtual machines are among the most common non-physical devices an analyst encounters, and they announce themselves through four IEEE MA-L blocks all registered to VMware, Inc. at 3401 Hillview Avenue, Palo Alto. The four prefixes are not interchangeable: 00:0C:29 is generated by a standalone ESXi host or by Workstation/Fusion (derived from the VM's UUID), while 00:50:56 is the range vCenter manages and the only one into which an administrator can manually assign a static address. The two older blocks, 00:05:69 and 00:1C:14, date to earlier ESX generations. Within 00:50:56, VMware reserves 00:50:56:00:00:00–00:50:56:3F:FF:FF for manual/static assignment and auto-generates vCenter MACs in 00:50:56:80:xx:xx–00:50:56:BF:xx:xx (the fourth octet encodes 0x80 plus the vCenter Server ID) — which is why trying to hand-set a MAC inside the reserved auto range produces a "not a valid static Ethernet address" error. VMware became a Broadcom subsidiary when that acquisition completed on 22 November 2023, so the registrant name and the current corporate owner now differ. For triage, any of these four prefixes means the device is a VMware guest, not bare metal — 00:50:56 specifically flags a vCenter-managed VM, 00:0C:29 a standalone ESXi/Workstation/Fusion VM. These prefixes identify the hypervisor platform, never the guest workload, and are widely used by sandbox-evading malware (e.g. Nymaim) to detect virtualization before executing.