OUI Lookup / Display
-
Hi,
I see some MAC Addresses in my DHCP Leases list that show no vendor - but if I try Wireshark's lookup tool (as an example), they are recognized. For example (from Wireshark lookup, https://www.wireshark.org/tools/oui-lookup.html),
4c:ed:fb => 4C:ED:FB AsustekC ASUSTek COMPUTER INC. 3c:dc:bc => 3C:DC:BC SamsungE Samsung Electronics Co.,Ltd
Is there an easy way to update the database that pfSense uses for OUI lookup?
Thanks!
-
If you install the nmap package it will install the database. That's the easiest way.
Steve
-
I actually have nmap installed. I should have been more clear (sorry!) ... some vendors show up, others are missing.
Thanks!
-
Hmm, nmap 7.7 is the most recent version available for FreeBSD11 though the OUI file is dated 2017-08-18.
You might be able to manually update that file at /usr/local/share/nmap/nmap-mac-prefixes
I'm not aware of any easy way update it other than that.Steve
-
Agreed! I looked at Github, I see the same thing (as you say, Aug 2017). I also checked http://standards-oui.ieee.org/oui.txt, and it is more current. Just not sure if there is an easy way (i.e. script of some sort) to convert IEEE to nmap format.
Thanks!
-
OK, I got it working! Here is what I did,
- Found the needed script, it's at https://svn.nmap.org/!svn/bc/3320/nmap/scripts/make-mac-prefixes.pl
- Downloaded the latest file from the IEEE, at http://standards-oui.ieee.org/oui.txt
- Ran said script ... :-). It's
perl make-mac-prefixes.pl oui.txt nmap-mac-prefixes
And it works - thanks for the help!
Would it make sense to include this latest file in pfSense somehow?