This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 37%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDK%3C/text%3E%3C/svg%3E)
How are Virtual Adapter MAC Addresses assigned in Windows?
A MAC address is comprised of 6 Octets. The first 3 Octets specify the NIC's (Network Interface Controller) vendor.
We have observed that when a physical NIC exists, a corresponding Virtual Adapter is created. We have also observed that when the corresponding Virtual Adapter is created, the entire Virtual MAC address is the same as the Physical MAC, except that the first Octet is "12" instead of whatever the Physical NIC's first Octet is.
Is this reliable behavior? Will a Virtual MAC that corresponds to a physical NIC always be the Physical MAC's with the first Octet as "12"?
Can we always assume that Virtual MACs start with "12"? Could a Virtual MAC's first 3 Octets ever collide with a real vendor's assigned 3 Octets? (We reviewed the full list of Vendor Prefixes, and the list jumps from 111111: Private to 1402EC: Hewlett Packard Enterprise ~ there are ZERO vendors beginning with "12"). To rephrase, if an observer is looking at the MAC address only, could they infer whether or not a MAC is a virtual NIC or not?
Thank you,
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hello @David Kennedy
By virtual Adapter MAC Addresses, are you referring to VM's mac address?
Hi @Anonymous , thank you for your reply. No, I am not referring to the VM's MAC Address -- this is a physical machine, not a VM. I've provided more info in my conversation with DSPatrick below. Thank you.
Read on here.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/virtualization/default-limit-256-dynamic-mac-addresses#cause
--please don't forget to upvote and Accept as answer if the reply is helpful--
Just checking if there's any progress or updates?
--please don't forget to upvote and Accept as answer if the reply is helpful--
Hi @Anonymous , thank you for your reply. Unfortunately, it does not answer my question - I should have been a little more clear in my question.
The Virtual Adapter that I am seeing is not on a Virtual Machine or on any sort of Hyper-V managed machine. This is a physical machine with a physical Wi-Fi interface, but I am still seeing a "Microsoft Wi-Fi Direct Virtual Adapter" being automatically created. As I understand it, this Microsoft Wi-Fi Direct Virtual Adapter is setup to "help a user connect to multiple IEEE 802.11 networks with one WiFi card. It works by exposing multiple virtual adapters, one for each wireless network to which connectivity is desired.". Additionally, it's what allows us to set up our laptops/workstations as Wi-Fi Hotspots as well.
I'm specifically interested in learning more about how these Microsoft Wi-Fi Direct Virtual Adapter MAC Addresses are assigned. Thank you.
Sounds good, you could probably start digging here.
https://learn.microsoft.com/en-us/windows/win32/nativewifi/about-the-wi-fi-direct-api
--please don't forget to upvote and Accept as answer if the reply is helpful--
