12

I have found some tools that seems to update the OUI MAC address vendor database on my system, like get-oui, airodump-ng-oui-update or update-oui :

update-oui(8)                          OUI                         update-oui(8)

NAME
       update-oui - download new version of the OUI and IAB lists

SYNOPSIS
       update-oui

DESCRIPTION
       update-oui  fetches  the  current  version  of the OUI and IAB lists from
       http://standards.ieee.org/regauth/oui/index.shtml and installs it, if the
       installed versions is older than 5 days.

       This utility requires curl, wget or libwww-perl to be installed.

OPTIONS
       -q     Be quiet. Do not output messages.

       -f     Force the update, even if the file is newer than 5 days.

FILES
       /usr/share/misc/
              Directory holding symbolic links to oui.txt and iab.txt

But if I search for IPs on my network:

luis@Zarzamoro:~$ sudo netdiscover -i eth1

 92 Captured ARP Req/Rep packets, from 12 hosts.   Total size: 5520
 _____________________________________________________________________________
   IP            At MAC Address      Count  Len   MAC Vendor
 -----------------------------------------------------------------------------
 192.168.4.31    bc:f1:f2:12:b4:93    60    3600   Unknown vendor
 192.168.4.24    f0:db:e2:de:11:80    02    120   Unknown vendor
 192.168.4.242   00:1d:7e:9c:6e:fc    05    300   Cisco-Linksys, LLC
 192.168.4.243   00:1c:10:64:63:ac    05    300   Cisco-Linksys, LLC
 192.168.4.244   00:1c:10:64:5f:94    05    300   Cisco-Linksys, LLC
 192.168.4.1     d8:61:94:e5:0b:1d    05    300   Unknown vendor
 192.168.4.246   00:1a:70:2f:ab:4b    04    240   Cisco-Linksys, LLC
 192.168.4.10    84:11:9e:2b:1c:d6    01    060   Unknown vendor
 192.168.4.11    ec:1f:72:5d:42:d0    02    120   Unknown vendor
 192.168.4.245   00:1a:70:2f:aa:63    01    060   Cisco-Linksys, LLC
 192.168.4.248   00:1a:70:2f:aa:d1    01    060   Cisco-Linksys, LLC
 192.168.4.251   44:d9:e7:0a:0b:98    01    060   Unknown vendor

As long as there are some MACs reported as Unknown vendor, I would like to search on any OUI database for its info.

What is the proper command-line way to perform this search?
Maybe something like:

oui-info 44:d9:e7

Note: I know that using the web browser I can google for the MAC's first 3 pairs, but I would like some command-line method, so I could script it or use via remote login (SSH).

1

Although it could be written more elegantly, the following works across Linux distros without any dependencies on specialized packages. It parses the output of the IP command, isolates the vendor part of the mac address into a variable which is finally grep'ed through an online DB of vendor prefixes.

#!/bin/bash

OUI=$(ip addr list|grep -w 'link'|awk '{print $2}'|grep -P '^(?!00:00:00)'| grep -P '^(?!fe80)' | tr -d ':' | head -c 6)

curl -sS "http://standards-oui.ieee.org/oui.txt" | grep -i "$OUI" | cut -d')' -f2 | tr -d '\t'

With a bit of creativity you could adapt this to execute remotely via ssh. I've seen other suggestions to identify vendor details using dmidecode for OS fingerprinting, but experienced inconsistent results with that tool when testing. On Raspberry Pi dmidecode fails totally. HTH-

  • This is the best answer in my humble opinion, because it gives an answer without the need of (nearly) installed tools, and, as long as IEEE.Org keeps updated (it should), it must be the best database to access. The only downside is the need for internet; not a big issue nowadays. – Sopalajo de Arrierez Apr 12 at 18:40
  • There were a lot of OUI online databases run by private individuals/orgs. But I chose the ieee.org one because there was less risk of it disappearing or the link changing. Glad I could help you out- – F1Linux Apr 13 at 8:19
12

I do not think there is an automated tool to do what you ask, but can be done by working directly on files oui.txt.

First of all it identifies the file downloaded, for example:

root@kalilloX:~# locate oui.txt
/var/lib/ieee-data/oui.txt

then search for the string you are interested. You must remove : or instead insert a -:

root@kalilloX:~# grep -i "44d9e7" /var/lib/ieee-data/oui.txt
44D9E7     (base 16)        Ubiquiti Networks, Inc.
  • And indirect method, but completely functional, and probably valid on any *nix, even some embedded devices. Thanks you. – Sopalajo de Arrierez Dec 11 '15 at 16:02
  • 1
    For ease of use, you can define a function in your .bashrc as follows: oui() { grep -i "$1" /var/lib/ieee-data/oui.txt; } and use it like this oui 44D9E7 – Aralox Mar 16 '17 at 1:18
3

A similar answer to the one of LilloX, but using nMap (if installed in the system):

luis@balanceador:~$ locate nmap-mac-prefixes
/usr/share/nmap/nmap-mac-prefixes
luis@balanceador:~$ grep 0024A5 -i /usr/share/nmap/nmap-mac-prefixes
0024A5 Buffalo

Supposedly working with any other program that stores OUI info, like airodump-ng-oui-update (to oui.txt file in this case), or several others:

  • /usr/share/btscanner/oui.txt
  • /usr/share/bluelog/oui.txt
  • /usr/share/ieee-data/oui.txt
  • /usr/share/golismero/thirdparty_libs/netaddr/eui/oui.txt
  • /usr/share/metasploit-framework/vendor/bundle/ruby/2.1.0/gems/packetfu-1.1.11/examples/oui.txt
  • /etc/unicornscan/oui.txt
  • /var/lib/ieee-data/oui.txt
1

You can retrieve the actual vendor by making a request using something like CURL to this API:

curl -XGET "https://api.macaddress.io/v1?apiKey=at_2d31hlNQAO1PXZVTecL6yoVAxI8IW&output=vendor&search=bc:f1:f2:12:b4:93"

OR

wget -qO- "https://api.macaddress.io/v1?apiKey=at_2d31hlNQAO1PXZVTecL6yoVAxI8IW&output=vendor&search=bc:f1:f2:12:b4:93"

For the unknown MAC addresses listed, it returned the following results:

bc:f1:f2:12:b4:93 -> Cisco Systems, Inc
f0:db:e2:de:11:80 -> Apple, Inc
d8:61:94:e5:0b:1d -> Objetivos y Sevicios de Valor Añadido
84:11:9e:2b:1c:d6 -> Samsung Electronics Co, Ltd
ec:1f:72:5d:42:d0 -> Samsung Electro-Mechanics(Thailand)
44:d9:e7:0a:0b:98 -> Ubiquiti Networks Inc

To use the service, you need to obtain an apiKey which is free if you're under 1000 requests a day.

  • A practical method, indeed. This seems to be a site that offers MAC identification services (see the pricing for high number of requests at macaddress.io/pricing ), and, as for today (October 2018), API requests like the described in this answer appears to be free. Thanks you, Dmitri S. – Sopalajo de Arrierez Oct 18 '18 at 22:43
0

I have written a script for updating oui and iab-files. Main-problem is, that the form of nmap-files is not the same as for btscan or arpwatch etc., they often have different forms (MAC-Address with double-points, with hyphens, without delimiters, upper cases, lower cases etc.

You could try this script, it is stored at https://github.com/burningfog/refresh_oui.

Please read the readme-file and if there are any questions give me a hint per mail please. If there are other tools than named in github, please give me the path for the oui-file and some lines from this file so I can take a look on that form.

Greetings Burning Fog

-1
cat `locate nmap-mac-prefixes` | grep -i ^YOUR_OID_START
-2
#!/bin/bash

arp -an | egrep -v incomplete | while read line ; do mac=$( echo $line | awk -F' ' '{print $4}' | sed 's/:/-/g' | tr "[:lower:]" "[:upper:]" | cut -c 1-8 ) ; vendor=$( egrep "$mac" /usr/share/hwdata/oui.txt ) ; echo "$line : $vendor" ; done

Output:

? (192.168.88.36) at 60:03:08:a8:4e:86 [ether]  on eth0 : 60-03-08   (hex)              Apple, Inc.
? (192.168.88.38) at d8:8f:76:6f:59:0a [ether]  on eth0 : D8-8F-76   (hex)              Apple, Inc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.