OUI Lookup / Display
I see some MAC Addresses in my DHCP Leases list that show no vendor - but if I try Wireshark's lookup tool (as an example), they are recognized. For example (from Wireshark lookup, https://www.wireshark.org/tools/oui-lookup.html),
4c:ed:fb => 4C:ED:FB AsustekC ASUSTek COMPUTER INC. 3c:dc:bc => 3C:DC:BC SamsungE Samsung Electronics Co.,Ltd
Is there an easy way to update the database that pfSense uses for OUI lookup?
If you install the nmap package it will install the database. That's the easiest way.
I actually have nmap installed. I should have been more clear (sorry!) ... some vendors show up, others are missing.
Hmm, nmap 7.7 is the most recent version available for FreeBSD11 though the OUI file is dated 2017-08-18.
You might be able to manually update that file at /usr/local/share/nmap/nmap-mac-prefixes
I'm not aware of any easy way update it other than that.
Agreed! I looked at Github, I see the same thing (as you say, Aug 2017). I also checked http://standards-oui.ieee.org/oui.txt, and it is more current. Just not sure if there is an easy way (i.e. script of some sort) to convert IEEE to nmap format.
OK, I got it working! Here is what I did,
- Found the needed script, it's at https://svn.nmap.org/!svn/bc/3320/nmap/scripts/make-mac-prefixes.pl
- Downloaded the latest file from the IEEE, at http://standards-oui.ieee.org/oui.txt
- Ran said script ... :-). It's
perl make-mac-prefixes.pl oui.txt nmap-mac-prefixes
And it works - thanks for the help!
Would it make sense to include this latest file in pfSense somehow?