Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsense get MAC-Adress Manufacturer

    Scheduled Pinned Locked Moved General pfSense Questions
    23 Posts 5 Posters 6.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @Gertjan
      last edited by

      @gertjan thanks - but might be nice if you didn't have to install any packages to get this info.. when I get a chance later will look in redmine if anyone has put in a feature request.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      fireodoF GertjanG 2 Replies Last reply Reply Quote 2
      • fireodoF
        fireodo @johnpoz
        last edited by

        @johnpoz

        In the mean time I have done a little "hack" ๐Ÿ˜

        I located the nmap database in /usr/local/share/nmap/nmap-mac-prefixes

        made a backup of the original file. After that I took the newest database from:
        https://svn.nmap.org/nmap/nmap-mac-prefixes
        and put it in /usr/local/share/nmap

        and ... it works!!
        (the "hack" has to be repeated after each update ... ;-)

        Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
        SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
        pfsense 2.8.0 CE
        Packages: Apcupsd Cron Iftop Iperf LCDproc Nmap pfBlockerNG RRD_Summary Shellcmd Snort Speedtest System_Patches.

        1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @johnpoz
          last edited by Gertjan

          @johnpoz

          It need a package.

          On the "Sastus > DHCP Leases" page you will find :

          // Load MAC-Manufacturer table
          $mac_man = load_mac_manufacturer_table();

          The function load_mac_manufacturer_table() is defined in /etc/inc/pfsense-utils.inc, line 2914.

          Is this evidence :

          	if (file_exists("/usr/local/share/nmap/nmap-mac-prefixes")) {
          		$macs=file("/usr/local/share/nmap/nmap-mac-prefixes");
          

          as on my pfSense 23.01 the folder /usr/local/share/nmap/ doesn't exist.
          And I'm pretty sure it will exist if I install the 'nmap' pfSense package ๐Ÿ˜Š

          edit : and of course it will exist now - I've installed nmap :

          # $Id: nmap-mac-prefixes 38424 2022-08-29 19:00:58Z dmiller $ generated with make-mac-prefixes.pl
          # Original data comes from http://standards.ieee.org/regauth/oui/oui.txt
          # These values are known as Organizationally Unique Identifiers (OUIs)
          # See http://standards.ieee.org/faqs/OUI.html
          # We have added a few unregistered OUIs at the end.
          000000 Xerox
          000001 Xerox
          000002 Xerox
          000003 Xerox
          000004 Xerox
          000005 Xerox
          000006 Xerox
          000007 Xerox
          000008 Xerox
          000009 Xerox
          .....
          

          The identical file, used by the pfSense Arpwatch package, "ethercodes.dat" uses this format :

          00:00:00	XEROX CORPORATION
          00:00:01	XEROX CORPORATION
          00:00:02	XEROX CORPORATION
          00:00:03	XEROX CORPORATION
          00:00:04	XEROX CORPORATION
          00:00:05	XEROX CORPORATION
          00:00:06	XEROX CORPORATION
          00:00:07	XEROX CORPORATION
          00:00:08	XEROX CORPORATION
          00:00:09	XEROX CORPORATION
          00:00:0a	OMRON TATEISI ELECTRONICS CO.
          

          and now I have the MAC addresses on the DHCP leases page also polluted with vendor codes, and probably elsewhere.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @Gertjan
            last edited by

            @gertjan so your saying that dhcp lease page wouldn't load it if arpwatch was used and not nmap?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            GertjanG 1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @johnpoz
              last edited by Gertjan

              @johnpoz

              My DHCP Leaes page loads just fine for me, never had any issues ( I do not have DNS / unbound issue, I'm resolving ).
              The question was about the added vendor name info :

              Arpwatch uses / loads an nearly identical file : the first 6 digits of a all known MAC vendor codes.
              Arpwatch uses another file format, they add ':' in the MAC addresses - see my post above.

              To answer the initial question : "Pfsense get MAC-Adress Manufacturer " : install have to install a pfSense called 'nmap' and 'suddenly', on several GUI pages, the vendor name is added to the MAC addresses of our devices.

              @fireodo said in Pfsense get MAC-Adress Manufacturer:

              how is pfsense getting the name of the manufacturer of network devices by the MAC-Adress? Is there a build in database?

              The answer is : install nmap.

              @johnpoz said in Pfsense get MAC-Adress Manufacturer:

              but might be nice if you didn't have to install any packages to get this info..

              I ๐Ÿ‘ that.

              This would mean that there would be another file that needs to be installed and auto updated ?
              Like 'bogons' and 'bogons6' and probably more.
              => another thing that can fail, and has to be supported.

              The mac vendor code file would will still be present in the packages arpwatch and nmap ...

              I know where it is now, and Google will help me remembering it ;)

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @Gertjan
                last edited by johnpoz

                @gertjan yeah no not that it wouldn't load - but that it wouldn't have the vendor info added to the mac address ;)

                Sounded like the dhcp pages was only looking for the vendor info in the nmap location?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                GertjanG 1 Reply Last reply Reply Quote 0
                • S
                  serbus
                  last edited by

                  Hello!

                  You can always...

                  mkdir /usr/local/share/nmap
                  
                  curl -o /usr/local/share/nmap/nmap-mac-prefixes https://raw.githubusercontent.com/nmap/nmap/master/nmap-mac-prefixes
                  

                  ...at your own risk.

                  John

                  Lex parsimoniae

                  GertjanG 1 Reply Last reply Reply Quote 2
                  • GertjanG
                    Gertjan @johnpoz
                    last edited by Gertjan

                    @johnpoz

                    The DHCP Status page loads the dhcpleases file, and, if it exists, a file with MAC-vendor info. If it finds the file, MAC's are shown with this vendor info. For the file to exist, the pfSense nmap package has to be installed.
                    If this is not the case, then that is no issue at all. You just won't see the vendor info.

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @serbus
                      last edited by Gertjan

                      @serbus
                      Thanks !
                      Nice clean & lean.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @Gertjan
                        last edited by

                        @gertjan hahaha - not sure why having a hard time asking this question..

                        So it doesn't look at the vendor info that arpwatch adds.. If you have arpwatch package installed, but not nmap - then your dhcp lease table will not list the vendor info ;)

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • fireodoF
                          fireodo
                          last edited by fireodo

                          Thanks to all for the "Enlightenment" (especially at @serbus for the clean solution)

                          Wish you a good WeekEnd!

                          Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
                          SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
                          pfsense 2.8.0 CE
                          Packages: Apcupsd Cron Iftop Iperf LCDproc Nmap pfBlockerNG RRD_Summary Shellcmd Snort Speedtest System_Patches.

                          1 Reply Last reply Reply Quote 0
                          • Dobby_D
                            Dobby_
                            last edited by Dobby_

                            @fireodo said in Pfsense get MAC-Adress Manufacturer:

                            Hi,

                            just for my curiosity: how is pfsense getting the name of the manufacturer of network devices by the MAC-Adress? Is there a build in database?

                            Example here:

                            LAN Interface (lan, igb0)
                            MAC-Adress xx:0d:xx:4d:aa:c4 - PC Engines GmbH

                            WIFI Interface (opt1, ath0_wlan0)
                            MAC-Adress xx:9a:xx:a4:c7:c8 - Apple

                            (from Status/Interfaces)

                            Thanks,
                            fireodo

                            An OUI {Organizationally Unique Identifier} is a 24-bit number that uniquely identifies a vendor or manufacturer. They are purchased and assigned by the IEEE. The OUI is basically the first three octets of a MAC address.

                            More information about and well explained

                            #~. @Dobby

                            Turris Omnia - 4 Ports - 2 GB RAM / TurrisOS 7 Release (Btrfs)
                            PC Engines APU4D4 - 4 Ports - 4 GB RAM / pfSense CE 2.7.2 Release (ZFS)
                            PC Engines APU6B4 - 4 Ports - 4 GB RAM / pfSense+ (Plus) 24.03_1 Release (ZFS)

                            1 Reply Last reply Reply Quote 1
                            • S
                              serbus
                              last edited by

                              Hello!

                              As far as I can tell, the current pfsense code doesnt parse or use the nmap-mac-prefixes file correctly - you might see "Ieee Registration Authority" listed when there is actually more detailed ownership info in the file. Its not that what it displays sometimes is completely wrong (maybe), but it could be more right (definitely), and it burns resources without being better.

                              I think hw mac ownership checking would need some love to become more accurate and informative. Personally, its one of the first things I look at when I ask, "Who/what is that hooking up to my network?!?!". It would also be nice if it highlighted LAAs.

                              Redmine references

                              John

                              Lex parsimoniae

                              fireodoF 1 Reply Last reply Reply Quote 1
                              • fireodoF
                                fireodo @serbus
                                last edited by fireodo

                                @serbus

                                Hi,

                                I took the script that is referenced in this Redmine and I can say its working well - the results are valid. Thanks again for pointing there!

                                Edit: The oui database Url has slightly changed from:

                                http://standards.ieee.org/develop/regauth/oui/oui.txt

                                to:

                                https://standards-oui.ieee.org/oui/oui.txt

                                So if someone wants to use the script maybe make also this change.

                                Regards,
                                fireodo

                                Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
                                SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
                                pfsense 2.8.0 CE
                                Packages: Apcupsd Cron Iftop Iperf LCDproc Nmap pfBlockerNG RRD_Summary Shellcmd Snort Speedtest System_Patches.

                                GertjanG 1 Reply Last reply Reply Quote 1
                                • GertjanG
                                  Gertjan @fireodo
                                  last edited by

                                  @fireodo said in Pfsense get MAC-Adress Manufacturer:

                                  I took the script that is referenced in this Redmine and I can say its working well

                                  Oh ... lol, this is/was a 5 years old known issue ...

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  fireodoF 1 Reply Last reply Reply Quote 0
                                  • fireodoF
                                    fireodo @Gertjan
                                    last edited by fireodo

                                    @gertjan said in Pfsense get MAC-Adress Manufacturer:

                                    Oh ... lol, this is/was a 5 years old known issue ...

                                    ๐Ÿ˜ ๐Ÿ˜ I saw the script is go moldy ... ๐Ÿ˜ ๐Ÿ˜

                                    Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
                                    SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
                                    pfsense 2.8.0 CE
                                    Packages: Apcupsd Cron Iftop Iperf LCDproc Nmap pfBlockerNG RRD_Summary Shellcmd Snort Speedtest System_Patches.

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.