Command-line tool to obtain OUI vendor info from MAC address?

Question

I have found some tools that seems to update the OUI MAC address vendor database on my system, like get-oui, airodump-ng-oui-update or update-oui :

update-oui(8)                          OUI                         update-oui(8)

NAME
       update-oui - download new version of the OUI and IAB lists

SYNOPSIS
       update-oui

DESCRIPTION
       update-oui  fetches  the  current  version  of the OUI and IAB lists from
       http://standards.ieee.org/regauth/oui/index.shtml and installs it, if the
       installed versions is older than 5 days.

       This utility requires curl, wget or libwww-perl to be installed.

OPTIONS
       -q     Be quiet. Do not output messages.

       -f     Force the update, even if the file is newer than 5 days.

FILES
       /usr/share/misc/
              Directory holding symbolic links to oui.txt and iab.txt

But if I search for IPs on my network:

luis@Zarzamoro:~$ sudo netdiscover -i eth1

 92 Captured ARP Req/Rep packets, from 12 hosts.   Total size: 5520
 _____________________________________________________________________________
   IP            At MAC Address      Count  Len   MAC Vendor
 -----------------------------------------------------------------------------
 192.168.4.31    bc:f1:f2:12:b4:93    60    3600   Unknown vendor
 192.168.4.24    f0:db:e2:de:11:80    02    120   Unknown vendor
 192.168.4.242   00:1d:7e:9c:6e:fc    05    300   Cisco-Linksys, LLC
 192.168.4.243   00:1c:10:64:63:ac    05    300   Cisco-Linksys, LLC
 192.168.4.244   00:1c:10:64:5f:94    05    300   Cisco-Linksys, LLC
 192.168.4.1     d8:61:94:e5:0b:1d    05    300   Unknown vendor
 192.168.4.246   00:1a:70:2f:ab:4b    04    240   Cisco-Linksys, LLC
 192.168.4.10    84:11:9e:2b:1c:d6    01    060   Unknown vendor
 192.168.4.11    ec:1f:72:5d:42:d0    02    120   Unknown vendor
 192.168.4.245   00:1a:70:2f:aa:63    01    060   Cisco-Linksys, LLC
 192.168.4.248   00:1a:70:2f:aa:d1    01    060   Cisco-Linksys, LLC
 192.168.4.251   44:d9:e7:0a:0b:98    01    060   Unknown vendor

As long as there are some MACs reported as Unknown vendor, I would like to search on any OUI database for its info.

What is the proper command-line way to perform this search?
Maybe something like:

oui-info 44:d9:e7

Note: I know that using the web browser I can google for the MAC's first 3 pairs, but I would like some command-line method, so I could script it or use via remote login (SSH).

LilloX · Accepted Answer · 2015-12-11 14:04:59Z

19

I do not think there is an automated tool to do what you ask, but can be done by working directly on files oui.txt.

First of all it identifies the file downloaded, for example:

root@kalilloX:~# locate oui.txt
/var/lib/ieee-data/oui.txt

then search for the string you are interested. You must remove : or instead insert a -:

root@kalilloX:~# grep -i "44d9e7" /var/lib/ieee-data/oui.txt
44D9E7     (base 16)        Ubiquiti Networks, Inc.

answered Dec 11, 2015 at 14:04

LilloX

1,2268 silver badges12 bronze badges

And indirect method, but completely functional, and probably valid on any *nix, even some embedded devices. Thanks you.
– Sopalajo de Arrierez
Commented Dec 11, 2015 at 16:02
1

For ease of use, you can define a function in your .bashrc as follows: oui() { grep -i "$1" /var/lib/ieee-data/oui.txt; } and use it like this oui 44D9E7
– Aralox
Commented Mar 16, 2017 at 1:18

Add a comment |

Juan · Accepted Answer · 2016-10-18 14:20:12Z

A similar answer to the one of LilloX, but using nMap (if installed in the system):

luis@balanceador:~$ locate nmap-mac-prefixes
/usr/share/nmap/nmap-mac-prefixes
luis@balanceador:~$ grep 0024A5 -i /usr/share/nmap/nmap-mac-prefixes
0024A5 Buffalo

Supposedly working with any other program that stores OUI info, like airodump-ng-oui-update (to oui.txt file in this case), or several others:

/usr/share/btscanner/oui.txt
/usr/share/bluelog/oui.txt
/usr/share/ieee-data/oui.txt
/usr/share/golismero/thirdparty_libs/netaddr/eui/oui.txt
/usr/share/metasploit-framework/vendor/bundle/ruby/2.1.0/gems/packetfu-1.1.11/examples/oui.txt
/etc/unicornscan/oui.txt
/var/lib/ieee-data/oui.txt

F1Linux · Accepted Answer · 2020-04-03 12:52:44Z

5

Cross-Distro Fully Automated Solution:

The following script automates the process and works across all Linux distros because it has no dependencies on specialized packages. It simply parses the output of the ip command, isolates the vendor part of mac address into a variable which is finally grep'ed through an online DB of vendor prefixes.

#!/bin/bash

OUI=$(ip addr list|grep -w 'link'|awk '{print $2}'|grep -P '^(?!00:00:00)'| grep -P '^(?!fe80)' | tr -d ':' | head -c 6)

curl -sS "http://standards-oui.ieee.org/oui.txt" | grep -i "$OUI" | cut -d')' -f2 | tr -d '\t'

With a bit of creativity you could adapt this to execute remotely via ssh. I've seen other suggestions to identify vendor details using dmidecode for OS fingerprinting, but experienced inconsistent results with that tool when testing. On Raspberry Pi dmidecode fails totally. HTH-

edited Apr 3, 2020 at 12:52

answered Apr 12, 2019 at 0:47

F1Linux

2,6141 gold badge20 silver badges33 bronze badges

1

This is the best answer in my humble opinion, because it gives an answer without the need of (nearly) installed tools, and, as long as IEEE.Org keeps updated (it should), it must be the best database to access. The only downside is the need for internet; not a big issue nowadays.
– Sopalajo de Arrierez
Commented Apr 12, 2019 at 18:40
There were a lot of OUI online databases run by private individuals/orgs. But I chose the ieee.org one because there was less risk of it disappearing or the link changing. Glad I could help you out-
– F1Linux
Commented Apr 13, 2019 at 8:19
Even more, the database at IEEE.Org contains the manufacturer for “D45D64” (= ASUSTek COMPUTER INC.) whereas the file /usr/share/arp-scan/ieee-oui.txt on my Arch Linux is outdated by more than 18 month.
– hermannk
Commented May 24, 2021 at 9:33

Add a comment |

Dmitrii S · Accepted Answer · 2018-10-18 11:46:45Z

You can retrieve the actual vendor by making a request using something like CURL to this API:

curl -XGET "https://api.macaddress.io/v1?apiKey=at_2d31hlNQAO1PXZVTecL6yoVAxI8IW&output=vendor&search=bc:f1:f2:12:b4:93"

OR

wget -qO- "https://api.macaddress.io/v1?apiKey=at_2d31hlNQAO1PXZVTecL6yoVAxI8IW&output=vendor&search=bc:f1:f2:12:b4:93"

For the unknown MAC addresses listed, it returned the following results:

bc:f1:f2:12:b4:93 -> Cisco Systems, Inc
f0:db:e2:de:11:80 -> Apple, Inc
d8:61:94:e5:0b:1d -> Objetivos y Sevicios de Valor Añadido
84:11:9e:2b:1c:d6 -> Samsung Electronics Co, Ltd
ec:1f:72:5d:42:d0 -> Samsung Electro-Mechanics(Thailand)
44:d9:e7:0a:0b:98 -> Ubiquiti Networks Inc

To use the service, you need to obtain an apiKey which is free if you're under 1000 requests a day.

A practical method, indeed. This seems to be a site that offers MAC identification services (see the pricing for high number of requests at macaddress.io/pricing ), and, as for today (October 2018), API requests like the described in this answer appears to be free. Thanks you, Dmitri S. — Sopalajo de Arrierez, Commented Oct 18, 2018 at 22:43

sjas · Accepted Answer · 2017-10-27 07:45:50Z

0

cat `locate nmap-mac-prefixes` | grep -i ^YOUR_OID_START

answered Oct 27, 2017 at 7:45

sjas

5848 silver badges8 bronze badges

Add a comment |

burningfog · Accepted Answer · 2017-11-06 12:30:47Z

I have written a script for updating oui and iab-files. Main-problem is, that the form of nmap-files is not the same as for btscan or arpwatch etc., they often have different forms (MAC-Address with double-points, with hyphens, without delimiters, upper cases, lower cases etc.

You could try this script, it is stored at https://github.com/burningfog/refresh_oui.

Please read the readme-file and if there are any questions give me a hint per mail please. If there are other tools than named in github, please give me the path for the oui-file and some lines from this file so I can take a look on that form.

Greetings Burning Fog

oogway · Accepted Answer · 2020-11-09 09:28:44Z

This script builds a list of all non-loopback interfaces then displays the interface:manufacturer key-value. It consults the OUI file distributed by Wireshark.

source: https://github.com/epacua/mac-address-lookup/blob/master/mac-address.sh

#!/usr/bin/env bash
OLDIFS="$IFS"
IFS=' '
FILE="/tmp/oui.txt"
SOURCE="https://gitlab.com/wireshark/wireshark/-/raw/master/manuf"

if [[ ! -f "${FILE}" ]]; then
  echo "$FILE not found. Downloading it from ${SOURCE}"
  wget -qO "$FILE" https://gitlab.com/wireshark/wireshark/-/raw/master/manuf
else
  echo -e "\nFile $FILE found\n"
fi

declare -A INTF_HASH
OUI=$(ip link | sed -n '1,2d;N;s/\n//;s/^[2-9]: \(\w\+\):.\+\([[:xdigit:]:]\{17\}\).\+/\1 \2/p')

while read; do
    INTERFACE=$(cut -d' ' -f1 <(echo $REPLY)) && MAC=$(cut -d' ' -f2 <(echo $REPLY) | tr 'a-f' 'A-F')
    MANUFACTURER=$(grep "${MAC:0:8}" $FILE | cut -d'    ' -f3)
    echo "INTERFACE: ${INTERFACE} -- ${MAC} -- $MANUFACTURER"
    INTF_HASH+=( [$(echo "$INTERFACE")]=$(echo "$MAC") )
done < <(echo $OUI)

IFS="$OLDIFS"

Michael Mrozek · Accepted Answer · 2018-08-10 20:00:52Z

-2

#!/bin/bash

arp -an | egrep -v incomplete | while read line ; do mac=$( echo $line | awk -F' ' '{print $4}' | sed 's/:/-/g' | tr "[:lower:]" "[:upper:]" | cut -c 1-8 ) ; vendor=$( egrep "$mac" /usr/share/hwdata/oui.txt ) ; echo "$line : $vendor" ; done

Output:

? (192.168.88.36) at 60:03:08:a8:4e:86 [ether]  on eth0 : 60-03-08   (hex)              Apple, Inc.
? (192.168.88.38) at d8:8f:76:6f:59:0a [ether]  on eth0 : D8-8F-76   (hex)              Apple, Inc.

edited Aug 10, 2018 at 20:00

Michael Mrozek

93.9k40 gold badges241 silver badges233 bronze badges

answered Aug 10, 2018 at 17:10

FabioM

693 bronze badges

Add a comment |

Stack Exchange Network

Command-line tool to obtain OUI vendor info from MAC address?

8 Answers 8

Cross-Distro Fully Automated Solution:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
mac-address
.

Linked

Hot Network Questions

Command-line tool to obtain OUI vendor info from MAC address?

8 Answers 8

Cross-Distro Fully Automated Solution:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged mac-address.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
mac-address
.