OUI Lookup / Display

arrmo

Hi,

I see some MAC Addresses in my DHCP Leases list that show no vendor - but if I try Wireshark's lookup tool (as an example), they are recognized. For example (from Wireshark lookup, https://www.wireshark.org/tools/oui-lookup.html),

4c:ed:fb => 4C:ED:FB AsustekC	ASUSTek COMPUTER INC.
3c:dc:bc => 3C:DC:BC SamsungE	Samsung Electronics Co.,Ltd

Is there an easy way to update the database that pfSense uses for OUI lookup?

Thanks!

stephenw10

If you install the nmap package it will install the database. That's the easiest way.

Steve

arrmo

I actually have nmap installed. I should have been more clear (sorry!) ... some vendors show up, others are missing.

Thanks!

stephenw10

Hmm, nmap 7.7 is the most recent version available for FreeBSD11 though the OUI file is dated 2017-08-18.
You might be able to manually update that file at /usr/local/share/nmap/nmap-mac-prefixes
I'm not aware of any easy way update it other than that.

Steve

arrmo

Agreed! I looked at Github, I see the same thing (as you say, Aug 2017). I also checked http://standards-oui.ieee.org/oui.txt, and it is more current. Just not sure if there is an easy way (i.e. script of some sort) to convert IEEE to nmap format.

Thanks!

arrmo

OK, I got it working! Here is what I did,

Found the needed script, it's at https://svn.nmap.org/!svn/bc/3320/nmap/scripts/make-mac-prefixes.pl
Downloaded the latest file from the IEEE, at http://standards-oui.ieee.org/oui.txt
Ran said script ... :-). It's

perl make-mac-prefixes.pl oui.txt nmap-mac-prefixes

And it works - thanks for the help!

Would it make sense to include this latest file in pfSense somehow?