Pfsense get MAC-Adress Manufacturer
-
Hi,
just for my curiosity: how is pfsense getting the name of the manufacturer of network devices by the MAC-Adress? Is there a build in database?
Example here:
LAN Interface (lan, igb0)
MAC-Adress xx:0d:xx:4d:aa:c4 - PC Engines GmbHWIFI Interface (opt1, ath0_wlan0)
MAC-Adress xx:9a:xx:a4:c7:c8 - Apple(from Status/Interfaces)
Thanks,
fireodoKettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
pfsense 2.7.2 CE
Packages: Apcupsd Cron Iftop Iperf LCDproc Nmap pfBlockerNG RRD_Summary Shellcmd Snort Speedtest System_Patches. -
@fireodo I believe that db gets populated if you install the nmap package, or possible ntop as well.. Do you have either of those installed, or installed at any point?
Could be possible other packages populate it.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.7.2, 24.11 -
Hummm. second time today on the forum that I see MAC + vendor text.
For myself, I thought it was the arpwatch package.
Install it, and you'll see :
and indeed, I have a 1 Mbytes 'ethercodes.dat' file in the arpwatch folder /usr/local/arpwatch/
I had to check :
for an initial download.
And there was something else .... can't remember. Like placing this / such a file 'else where' so 'pfSense' can use it ....
-
@gertjan I know nmap does it as well
I had uninstalled nmap before update to 23.01 - took a look at my dhcp leases, no vendor info.. Installed nmap and shazam vendor info showing up
You can also manually update it I believe - because it might be dated? If there is a place to move it too so pfsense sees it without the nmap package that would be good info too.
-
@johnpoz said in Pfsense get MAC-Adress Manufacturer:
Do you have either of those installed, or installed at any point?
nmap is installed. ntop isnt
thanks
-
@fireodo have to look in redmine for a feature request, a built in way of getting this info, and having it updated say in a cron like they do bogon list, etc. without having to install a package might be a nice addition.
Here is a question - if you have both nmap and say arpwatch installed. Seems to place the lists in different places - which one does pfsense use say in the dhcp lease output? Because one might be more up to date than the other, etc.
@Gertjan you love to look at pfsense code do you not - where does the dhcp lease page look for that vendor info ;)
-
@johnpoz said in Pfsense get MAC-Adress Manufacturer:
You can also manually update it I believe - because it might be dated
Well, arpwatch shows you the cron way to do it.
The aprwatch package comes with a download shell script.I'll drill down into DHCP Leases to see when where this vendor info is added.
-
@gertjan thanks - but might be nice if you didn't have to install any packages to get this info.. when I get a chance later will look in redmine if anyone has put in a feature request.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.7.2, 24.11 -
In the mean time I have done a little "hack"
I located the nmap database in /usr/local/share/nmap/nmap-mac-prefixes
made a backup of the original file. After that I took the newest database from:
https://svn.nmap.org/nmap/nmap-mac-prefixes
and put it in /usr/local/share/nmapand ... it works!!
(the "hack" has to be repeated after each update ... ;-) -
It need a package.
On the "Sastus > DHCP Leases" page you will find :
// Load MAC-Manufacturer table
$mac_man = load_mac_manufacturer_table();The function load_mac_manufacturer_table() is defined in /etc/inc/pfsense-utils.inc, line 2914.
Is this evidence :
if (file_exists("/usr/local/share/nmap/nmap-mac-prefixes")) { $macs=file("/usr/local/share/nmap/nmap-mac-prefixes");as on my pfSense 23.01 the folder /usr/local/share/nmap/ doesn't exist.
And I'm pretty sure it will exist if I install the 'nmap' pfSense package
edit : and of course it will exist now - I've installed nmap :
# $Id: nmap-mac-prefixes 38424 2022-08-29 19:00:58Z dmiller $ generated with make-mac-prefixes.pl # Original data comes from http://standards.ieee.org/regauth/oui/oui.txt # These values are known as Organizationally Unique Identifiers (OUIs) # See http://standards.ieee.org/faqs/OUI.html # We have added a few unregistered OUIs at the end. 000000 Xerox 000001 Xerox 000002 Xerox 000003 Xerox 000004 Xerox 000005 Xerox 000006 Xerox 000007 Xerox 000008 Xerox 000009 Xerox .....The identical file, used by the pfSense Arpwatch package, "ethercodes.dat" uses this format :
00:00:00 XEROX CORPORATION 00:00:01 XEROX CORPORATION 00:00:02 XEROX CORPORATION 00:00:03 XEROX CORPORATION 00:00:04 XEROX CORPORATION 00:00:05 XEROX CORPORATION 00:00:06 XEROX CORPORATION 00:00:07 XEROX CORPORATION 00:00:08 XEROX CORPORATION 00:00:09 XEROX CORPORATION 00:00:0a OMRON TATEISI ELECTRONICS CO.and now I have the MAC addresses on the DHCP leases page also polluted with vendor codes, and probably elsewhere.
-
@gertjan so your saying that dhcp lease page wouldn't load it if arpwatch was used and not nmap?
-
My DHCP Leaes page loads just fine for me, never had any issues ( I do not have DNS / unbound issue, I'm resolving ).
The question was about the added vendor name info :Arpwatch uses / loads an nearly identical file : the first 6 digits of a all known MAC vendor codes.
Arpwatch uses another file format, they add ':' in the MAC addresses - see my post above.To answer the initial question : "Pfsense get MAC-Adress Manufacturer " : install have to install a pfSense called 'nmap' and 'suddenly', on several GUI pages, the vendor name is added to the MAC addresses of our devices.
@fireodo said in Pfsense get MAC-Adress Manufacturer:
how is pfsense getting the name of the manufacturer of network devices by the MAC-Adress? Is there a build in database?
The answer is : install nmap.
@johnpoz said in Pfsense get MAC-Adress Manufacturer:
but might be nice if you didn't have to install any packages to get this info..
I
that.This would mean that there would be another file that needs to be installed and auto updated ?
Like 'bogons' and 'bogons6' and probably more.
=> another thing that can fail, and has to be supported.The mac vendor code file would will still be present in the packages arpwatch and nmap ...
I know where it is now, and Google will help me remembering it ;)
-
@gertjan yeah no not that it wouldn't load - but that it wouldn't have the vendor info added to the mac address ;)
Sounded like the dhcp pages was only looking for the vendor info in the nmap location?
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.7.2, 24.11 -
Hello!
You can always...
mkdir /usr/local/share/nmap curl -o /usr/local/share/nmap/nmap-mac-prefixes https://raw.githubusercontent.com/nmap/nmap/master/nmap-mac-prefixes...at your own risk.
John
Lex parsimoniae
-
The DHCP Status page loads the dhcpleases file, and, if it exists, a file with MAC-vendor info. If it finds the file, MAC's are shown with this vendor info. For the file to exist, the pfSense nmap package has to be installed.
If this is not the case, then that is no issue at all. You just won't see the vendor info.No "help me" PM's please. Use the forum, the community will thank you.
Edit : and where are the logs ?? -
@serbus
Thanks !
Nice clean & lean. -
@gertjan hahaha - not sure why having a hard time asking this question..
So it doesn't look at the vendor info that arpwatch adds.. If you have arpwatch package installed, but not nmap - then your dhcp lease table will not list the vendor info ;)
-
Thanks to all for the "Enlightenment" (especially at @serbus for the clean solution)
Wish you a good WeekEnd!
-
@fireodo said in Pfsense get MAC-Adress Manufacturer:
Hi,
just for my curiosity: how is pfsense getting the name of the manufacturer of network devices by the MAC-Adress? Is there a build in database?
Example here:
LAN Interface (lan, igb0)
MAC-Adress xx:0d:xx:4d:aa:c4 - PC Engines GmbHWIFI Interface (opt1, ath0_wlan0)
MAC-Adress xx:9a:xx:a4:c7:c8 - Apple(from Status/Interfaces)
Thanks,
fireodoAn OUI {Organizationally Unique Identifier} is a 24-bit number that uniquely identifies a vendor or manufacturer. They are purchased and assigned by the IEEE. The OUI is basically the first three octets of a MAC address.
-
Hello!
As far as I can tell, the current pfsense code doesnt parse or use the nmap-mac-prefixes file correctly - you might see "Ieee Registration Authority" listed when there is actually more detailed ownership info in the file. Its not that what it displays sometimes is completely wrong (maybe), but it could be more right (definitely), and it burns resources without being better.
I think hw mac ownership checking would need some love to become more accurate and informative. Personally, its one of the first things I look at when I ask, "Who/what is that hooking up to my network?!?!". It would also be nice if it highlighted LAAs.
John
