How to extract MAC addresses from text
Start with a pasted log, plain text, or an accepted text file. The results table lists each match under Address, Format, OUI Prefix, Type, Line, and Context. Output text keeps one displayed address per line. Colon/hyphen format and Cisco dot format start enabled; Bare (no separator) format starts unchecked.
- Paste source text into Input text or select Upload to choose a text file.
- Leave Colon/hyphen format and Cisco dot format selected, or enable Bare (no separator) format for unseparated values.
- Choose Unique only, Normalize to colon format, and Uppercase for the display you need.
- Read Output text and the results table, including each match's Line and Context.
- Select Copy or Download for the address-only list.
MAC address formats and output options
Colon/hyphen format matches six two-digit hexadecimal groups joined by colons or hyphens. Cisco dot format matches three four-digit groups. Bare (no separator) format matches 12 hexadecimal digits without separators, so a hash or ID can also match when you turn it on.
Normalize to colon format changes the displayed separators. Uppercase changes the letter casing. For example:
Input: 00-1A-2B-99-88-77
Output with Normalize to colon format: 00:1a:2b:99:88:77Unique only starts checked. It compares hexadecimal values after removing separators, keeps the first occurrence in the text, and treats different spellings of one address as duplicates. Clear it to keep repeated appearances.
What the MAC address results show
Each row shows Address, Format, OUI Prefix, Type, Line, and Context. OUI Prefix contains the first three address bytes in uppercase. The tool does not look up a manufacturer. Type reads Unicast when the first byte's lowest bit is clear and Multicast when it is set.
Context includes up to 30 characters before and after the match, with whitespace collapsed, and Line gives its source line number. Output text contains only the displayed addresses, one per line, so Copy and Download leave out the table fields.
What the extractor leaves unchanged
The extractor checks text shape. A match does not establish device ownership. One address cannot mix colons and hyphens, and clearing all three format checkboxes produces no matches.
The extraction script reads entered text in the browser and makes no request with it. When non-empty input has no match, the results table displays No matching MAC addresses found.
Where MAC address extraction comes up
Paste a DHCP or switch log and leave Unique only checked when repeated sightings should collapse. Line and Context keep the nearby text needed to locate each occurrence.
To compare spellings, review an address such as 00:1A:2B:3C:4D:5E beside 001a.2b3c.4d5e. Normalize to colon format gives both displayed values the same separators.
Enable Bare (no separator) format for unseparated hardware identifiers, then inspect Context before copying. Other 12-digit hexadecimal strings can match it.
When another text extractor fits better
For other text-parsing jobs, the Text Parsing & Data Extraction category groups related extractors. Choose Extract IP Addresses when the input contains IPv4 or IPv6 values and you need IP-specific validation. Choose Custom Regex Extractor when the pattern is not a MAC address notation. Choose Extract Lines Containing a String when you need whole lines selected by words or a regular expression.
Frequently asked questions
How do I extract MAC addresses from a log?
Paste the log into Input text or select Upload to choose a text file. Review the results table, keep the format options that fit the log, and select Copy or Download for the address-only list.
Can it extract Cisco dot-notation MAC addresses?
Cisco dot format is enabled by default and matches values such as 001a.2b3c.4d5e. The detected notation appears in the Format column.
How does Unique only handle repeated MAC addresses?
Unique only removes repeated hexadecimal values after separators are ignored and keeps the first occurrence. Colon, hyphen, Cisco dot, and bare spellings of the same address then count as duplicates.
Does the OUI Prefix identify the hardware vendor?
OUI Prefix shows the first three address bytes, but this tool does not query a vendor database. The table also shows Type, Line, and Context.