I suspect a rogue device is present and I need to see whether its MAC address maps to an unexpected vendor.

This feature helps you check whether a device’s MAC address maps to an expected vendor by looking up the MAC’s manufacturer information. It supports quick validation when you suspect an unauthorized or unexpected device on your network.

When you suspect a rogue device on your network, identifying the vendor associated with its MAC address can be an important first step. This feature lets you input a MAC address and view the vendor (manufacturer) information associated with that address. You can use it to compare the detected vendor against what you expect for approved hardware in your environment. It is especially useful during incident response or routine audits when a device appears unfamiliar in monitoring tools. By mapping a MAC address to a vendor, you can more quickly prioritize investigation of devices that do not match your known inventory. The feature supports workflows where you gather a MAC from logs, switch tables, DHCP leases, wireless controllers, or endpoint discovery tools and then verify the vendor. It can also help spot inconsistencies, such as a device claiming to be one type of hardware while its MAC vendor suggests a different manufacturer. The output is intended to be easy to interpret so you can decide whether to escalate, block, or further investigate the device. This capability is a lightweight check that complements deeper identification methods like device fingerprinting or certificate-based authentication.