For an extra fee to IEEE, vendors can hide their details. In this case, this flag is set to 'true' and companyName, companyAddress and countryCode are 'private'. Name of the company which registered the MAC addresses block. Company's full address. Company's country code in ISO 3166 format. Date when the range was allocated, in YYYY-MM-DD format. Note: Excluding a MAC OUI from being used for matching purposes does not stop a MAC address from being displayed multiple times (duplicated) as a property in the System Tree. The McAfee Agent collects information about the installed MAC address and reports it to McAfee ePO; this is expected in an environment where multiple machines have the.
- For an extra fee to IEEE, vendors can hide their details. In this case, this flag is set to 'true' and companyName, companyAddress and countryCode are 'private'. Name of the company which registered the MAC addresses block. Company's full address. Company's country code in ISO 3166 format. Date when the range was allocated, in YYYY-MM-DD format.
- Sep 28, 2021 Download: MAC address and vendors JSON database. MAC Address Lookup. Find the vendor name of a device by entering an OUI or a MAC address.
Released:
Parser library for Wireshark's OUI database
Project description
Parser library for Wireshark's OUI database.
Converts MAC addresses into a manufacturer using Wireshark's OUI database.
Optimized for quick lookup performance by reading the entire file into memoryon initialization. Maps ranges of MAC addresses to manufacturers and comments(descriptions). Contains full support for netmasks and other strange things inthe database.
See Wireshark's OUI lookup tool.
Written by Michael Huang (coolbho3k).
Install
With PyPi
Or Manually
Usage
As a library:
As a command line:
Hp Mac Oui
Use a manuf file in a custom location:
Automatically update the manuf file from Wireshark's git:
Note, that this command will update the manuf file bundled with this package. If you do not wish tomodify this, or do not have permissions to do so, you must specify a custom manuf file to perform an update.
Alternatively you can call the program with:
or by executung the manuf.py
script directly
Features and advantages of manuf
Note: the examples use the manuf file provided in the first commit, 9a180b5.
manuf.py is more accurate than more naive scripts that parse the manuf file.Critically, it contains support for netmasks.
For a usual entry, such as BC:EE:7B (AsustekC), the manufacturer 'owns' thelast half (24 bits) of the MAC address and is free to assign the addressesBC:EE:7B:00:00:00 through BC:EE:7B:FF:FF:FF, inclusive, to its devices.
However, entries like the following also appear commonly in the file:
/36 is a netmask, which means that the listed manufacturer 'owns' only the last12 bits of the MAC address instead of the usual 24 bits (since MAC addressesare 48 bits long, and 48 bits - 36 bits = 12 bits).
This means that Converging Systems is only free to assign the addresss block00:1B:C5:00:00:00 through 00:1B:C5:00:0F:FF. Anything after that belongs toother manufacturers. manuf.py takes this fact into account:
Even Wireshark's web lookup tool fails here. '00:1B:C5:00:0F:FF' returns only'IEEE REGISTRATION AUTHORITY' while it should instead return 'ConvergingSystems Inc.' If a netmask is not explicitly specified, a netmask of /24 isimplied. Since this covers most of the entries, most tools only parse the first24 bits.
manuf.py fully supports even more esoteric entries in the database. For example,consider these two entries:
With a netmask of /45, only the last 3 bits of the address are significant.This means that a device is considered 'OAM-Multicast-DA-Class-1' only if thelast digit falls between 0x0 and 0x7 and 'OAM-Multicast-DA-Class-2' only if thelast digit falls between 0x8 and 0xF.
If the last octet is 0x40 or over, or 0x2F or under, the address doesn't belongto any manufacturer.
Again, the official lookup tool fails here as well, with '01:80:C2:00:00:31'returning no results.
Algorithm
Although optimized for correctness, manuf.py is also quite fast, with averageO(1) lookup time, O(n) setup time, and O(n) memory footprint.
First, the entire manuf file is read into memory. Each manuf line is stored ina dict mapping a tuple calculated from the MAC address and netmask to eachmanuf:
The (48 - netmask) value is called the 'bits left' value in the code.
Mac Oui Lookup
For example, Converging Systems' MAC is 0x001BC5000000 and its netmask is 36,so its key in the dict is this:
To lookup '00:1B:C5:00:0F:FF' we will check the dict beginning with a 'bitsleft' value of 0, incrementing until we find a match or go over 47 (which meanswe have no match):
Oui Mac
Since (12, 0x001BC5000FFF >> 12) equals (12, 0x001BC5000000 >> 12), we have amatch on the 13th iteration of the loop.
Copying
This library does not link to Wireshark's manuf database; it merely parses it,so I have chosen to publish it under the LGPLv3 and Apache License 2.0instead of the GPLv2. The manuf database is provided for your convenience inthis repository, but will not be updated.
- License for Python library: LGPLv3 and Apache License 2.0 (dual licensed)
- License for manuf database: GPLv2
Mac Oui Database Download Software
The latest version of the manuf database can be found in theWireshark git repository.The database there is updated about once a week, so you may want to grab thelatest version to use instead of using the one provided here by using the--update flag on the command line:
Run tests
Release historyRelease notifications | RSS feed
1.1.1
1.1.1.dev0 pre-release
1.0.0
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Filename, size | File type | Python version | Upload date | Hashes |
---|---|---|---|---|
Filename, size manuf-1.1.1-py2.7.egg (543.2 kB) | File type Egg | Python version 2.7 | Upload date | Hashes |
Filename, size manuf-1.1.1-py2-none-any.whl (539.3 kB) | File type Wheel | Python version py2 | Upload date | Hashes |
Filename, size manuf-1.1.1-py3.7.egg (543.3 kB) | File type Egg | Python version 3.7 | Upload date | Hashes |
Filename, size manuf-1.1.1-py3-none-any.whl (539.3 kB) | File type Wheel | Python version py3 | Upload date | Hashes |
Filename, size manuf-1.1.1.tar.gz (538.4 kB) | File type Source | Python version None | Upload date | Hashes |
Hashes for manuf-1.1.1-py2.7.egg
Algorithm | Hash digest |
---|---|
SHA256 | 837321516caaa0c9239209d342137a13921586e09461a88ce2079e10125e0083 |
MD5 | fd875687d5bd16d725b554bf0241e414 |
BLAKE2-256 | 04968e3040c33e0ac1ae1b48163db15e58880e0f3945695444e79dd1878040c3 |
Hashes for manuf-1.1.1-py2-none-any.whl
Algorithm | Hash digest |
---|---|
SHA256 | c2824df37cc79b7d69113bd93cb155a13185ce22e48fbef93aaab1dadbbc074a |
MD5 | b53d192f7f2d89c19165e49f9259a219 |
BLAKE2-256 | 7e92e99bb4435c70f35eda9e30de9a3ed4c186dbdadc2301a0f3bbbf39e2fd4a |
Hashes for manuf-1.1.1-py3.7.egg
Algorithm | Hash digest |
---|---|
SHA256 | 793615ccac3c8b2259b42737ce525f4921575c19492662f2d9a7ad0e99f4ba75 |
MD5 | 651df69422bbe4fbda47725650e9c909 |
BLAKE2-256 | 632cd70d275aced41bf96e23b80469afcc74a221b7ae9aca98c0a1eb774bdacc |
Hashes for manuf-1.1.1-py3-none-any.whl
Algorithm | Hash digest |
---|---|
SHA256 | d48e780ebc4158764901a0b3a2e160f0e87ed0a1d7e504c723dc633836f1f0dc |
MD5 | 379b0ae241b87a2f0d46c4a78e9a76d4 |
BLAKE2-256 | 207c363e369c274faa3dde92500fe0320fa0f5a17a77bfe8e07b0ed1a24e49f4 |
Hashes for manuf-1.1.1.tar.gz
Algorithm | Hash digest |
---|---|
SHA256 | 15faee73b91805ef1547e375628452dc3d5f2b9cf8ec005185a85c1345a828a4 |
MD5 | 261e603c6194b451dc186125d57ab94a |
BLAKE2-256 | 9ecf354dddc57508194082c74310dec15341c008d47b7d37fd813d7fb0c46349 |
Network switches or Layer 2 technology Ethernet protocol uses MAC addresses in order to transfer frames between systems. MAC addresses are 48-bit value. This 48-bit value contains the device manufacturer ID as the first 24 bit. In this tutorial we will learn how to look, search and find the Organizationally Unique Identifier in Linux distributions like Ubuntu, Debian, Mint, Kali, Fedora, CentOS, RHEL, etc.
Mac Address
As stated in the previous part MAC address is used to address and route Ethernet frames. MAC address consists of a 48-bit value and simply expressed as the hexadecimal format. Here is an example of MAC Address.
OUI (Organizationally Unique Identifier)
OUI or Organizationally Unique Identifier is the first 24 bit or 6 hexadecimal value of the MAC address. IEEE is responsible for the OUI in MAC addresses. They provide the Ethernet card manufacturer company. In the previous example 00:50:56
is OUI of the MAC address.
Print MAC Address
First, we will start by printing the MAC address of the system. There are a lot of commands those have used to print MAC address but the ip link
command is the easiest way.
Find OUI with get-oui Command
get-oui
command is the most popular way to learn OUI . It is provided by arp-scan
package. We can install arp-scan
package like below.
Ubuntu, Debian, Mint, Kali
Fedora, CentOS, RHEL
Find OUI with ieee-data
ieee-data
is another package which provides the oui.txt
file . We can install this with the following commands
Ubuntu, Debian, Mint, Kali
Fedora, CentOS, RHEL
Search and Look For OUI In oui.txt
Installing previously explianed commands will create a file named oui.txt
in the /usr/share/ieee-data/oui.txt
this file provides the OUI data.
Lets look into oui.txt
file to learn its format.
As we can see the first column is about OUI and the second column provides the organization name and the address of the organization. OUI is written in two formats first one is dash-separated and the other is without a separator.
Lookup Using Less
We will lookup using less
command provided by Linux system. We will open the oui.txt
file and search with /
AND then put the OUI . In this example we search for 00179A or 00-17-9A
OR
Lookup Using Grep
We can also use grep
command to search and filter OUI. We will provide the OUI part and the oui.txt file as below. In this example, we will search for 00179A
or 00-17-9A
OR
Lookup Using Nmap Mac Prefixes File
nmap
is a popular network scanner which provides a lot of features. One of them is the OUI information. OUI information is stored in a file /usr/share/nmap/nmap-mac-prefixes
. We can search for a given OUI in this file with the grep command. First we need to install nmap
package if it is not installed.
Ubuntu, Debian, Mint, Kali:
Fedora, CentOS, RHEL:
Now we will search with grep
the OUI 0024A5
in this case.