mac-vendor(5) [debian man page]
MAC-VENDOR(5) File Formats Manual MAC-VENDOR(5) NAME
mac-vendor - Ethernet vendor file for arp-scan SYNOPSIS
mac-vendor.txt DESCRIPTION
The mac-vendor.txt contains Ethernet MAC to vendor string mappings for arp-scan. It is used in addition to the IEEE OUI and IAB listings in ieee-oui.txt and ieee-iab.txt. It is for MAC-vendor mappings that are not covered by the IEEE manufacturer listings. Each line in the mac-vendor.txt file contains a MAC-vendor mapping in the form: <MAC-Prefix><TAB><Vendor> Where <MAC-Prefix> is the prefix of the MAC address in hex, and <Vendor> is the name of the vendor. The prefix can be of any length from two hex digits (one octet) to twelve hex digits (six octets, the entire Ethernet hardware address). The alphabetic hex characters [A-F] must be entered in upper case. For example: 012345 would match 01:23:45:xx:xx:xx, where xx represents any value; 0123456 would match 01:23:45:6x:xx:xx; and 01234567 would match 01:23:45:67:xx:xx. Blank lines and lines beginning with "#" are ignored. The order of entries in the file is not important. arp-scan will attempt to match larger prefixes before trying to match smaller ones, and will stop at the first match. FILES
/usr/local/share/arp-scan/mac-vendor.txt EXAMPLE
# From nmap Debian bug report #369681 dated 31 May 2006 525400 QEMU B0C420 Bochs # From RFC 2338: 00-00-5E-00-01-{VRID} 00005E0001 VRRP (last octet is VRID) # Microsoft WLBS (Windows NT Load Balancing Service) # http://www.microsoft.com/technet/prodtechnol/acs/reskit/acrkappb.mspx 02BF Microsoft WLBS (last four octets are IP address) AUTHOR
Roy Hills <Roy.Hills@nta-monitor.com> SEE ALSO
arp-scan(1) get-oui(1) get-iab(1) arp-fingerprint(1) http://www.nta-monitor.com/wiki/ The arp-scan wiki page. March 30, 2007 MAC-VENDOR(5)
Check Out this Related Man Page
MASSAGEVENDOR(8) System Manager's Manual MASSAGEVENDOR(8) NAME
massagevendor - convert the ethernet vendor codes master list to arpwatch format SYNOPSIS
massagevendor vendorfile DESCRIPTION
massagevendor is a program that converts a text file containing ethernet vendor codes into a format suitable for use by arpwatch(8) and arpsnmp(8). The input vendorfile is a master text file containing vendor codes. The output is sent to stdout. Each line of the vendorfile is expected to have a six digit hexadecimal vendor code followed by spaces followed by the name of the manufacturer. All ethernet devices have a unique identifier which includes a vendor code specifying the manufacturer of the device. In normal operation arpwatch(8) and arpsnmp(8) use the file ethercodes.dat to report this vendor code. massagevendor is used to generate the ethercodes.dat file from text files containing these vendor codes. Locations where an ethernet vendor codes master text file can be obtained are given below. FILES
/var/lib/arpwatch - default location of the ethernet vendor list ethercodes.dat - file containing the list of ethernet vendor codes SEE ALSO
arpwatch(8), arpsnmp(8) NOTES
Sources for ethernet vendor codes seen in the wild are http://map-ne.com/Ethernet/vendor.html ftp://ftp.cavebear.com/pub/Ethernet.txt http://www.cavebear.com/CaveBear/Ethernet/vendor.html Useful for comparison or completeness are the ethernet vendor codes as assigned by the IEEE which can be found at http://standards.ieee.org/regauth/oui/oui.txt BUGS
Please send bug reports to arpwatch@ee.lbl.gov. AUTHORS
Craig Leres of the Lawrence Berkeley National Laboratory Network Research Group, University of California, Berkeley, CA. The current version is available via anonymous ftp: ftp://ftp.ee.lbl.gov/arpwatch.tar.gz This manual page was contributed by Hugo Graumann. MASSAGEVENDOR(8)