Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

get-iab(1) [debian man page]

GET-IAB(1)						      General Commands Manual							GET-IAB(1)

NAME
get-iab - Fetch the arp-scan IAB file from the IEEE website SYNOPSIS
get-iab [options] DESCRIPTION
get-iab fetches the Ethernet IAB file from the IEEE website, and saves it in the format used by arp-scan. The IAB file contains all of the IABs (Individual Address Blocks) that have been registered with IEEE. Each IAB entry in the file speci- fies the first 36-bits of the 48-bit Ethernet hardware address, leaving the remaining 12-bits for use by the registering organisation. For example the IAB entry "0050C2003", registered to Microsoft, applies to any Ethernet hardware address from 00:50:c2:00:30:00 to 00:50:c2:00:3f:ff inclusive. Each IAB assignment represents a total of 2^12 (4,096) Ethernet addresses. Major Ethernet hardware vendors typically use an OUI registration rather than an IAB registration. See get-oui(1) for details. This script can be used to update the arp-scan IAB file from the latest data on the IEEE website. It is relatively rare to see Ethernet addresses from IAB registrations, so the IAB file is not as important as the OUI file. The IAB data is fetched from the URL http://standards.ieee.org/regauth/oui/iab.txt and the output file is saved to the file ieee-iab.txt in the current directory. The URL to fetch the data from can be changed with the -u option, and the output file name can be changed with the -f option. The ieee-iab.txt file that is produced by this script is used by arp-scan to determine the Ethernet card vendor from its hardware address. The directory that arp-scan will look for the ieee-iab.txt file depends on the options used when it was built. If it was built using the default options, then it will look in /usr/local/share/arp-scan. OPTIONS
-h Display a brief usage message and exit. -f <fn> Write the output to the specified file instead of the default ieee-iab.txt. -u <URL> Use the specified URL to fetch the raw IAB data from instead of the default http://standards.ieee.org/regauth/oui/iab.txt -v Display verbose progress messages. FILES
ieee-iab.txt The default output file. EXAMPLES
$ get-iab -v Renaming ieee-iab.txt to ieee-iab.txt.bak Fetching IAB data from http://standards.ieee.org/regauth/oui/iab.txt Fetched 230786 bytes Opening output file ieee-iab.txt 1535 IAB entries written to file ieee-iab.txt NOTES
get-iab is implemented in Perl, so you need to have the Perl interpreter installed on your system to use it. get-iab uses the LWP::Simple Perl module to fetch the data from the IEEE website. You must have this module installed on your system for it to work. This module is available on most distributions, often called libwww-perl. It is also available in source form from CPAN. You can use a proxy server by defining the http_proxy environment variable. AUTHOR
Roy Hills <Roy.Hills@nta-monitor.com> SEE ALSO
arp-scan(1) get-oui(1) arp-fingerprint(1) http://www.nta-monitor.com/wiki/ The arp-scan wiki page. March 30, 2007 GET-IAB(1)

Check Out this Related Man Page

MAC-VENDOR(5)							File Formats Manual						     MAC-VENDOR(5)

NAME
mac-vendor - Ethernet vendor file for arp-scan SYNOPSIS
mac-vendor.txt DESCRIPTION
The mac-vendor.txt contains Ethernet MAC to vendor string mappings for arp-scan. It is used in addition to the IEEE OUI and IAB listings in ieee-oui.txt and ieee-iab.txt. It is for MAC-vendor mappings that are not covered by the IEEE manufacturer listings. Each line in the mac-vendor.txt file contains a MAC-vendor mapping in the form: <MAC-Prefix><TAB><Vendor> Where <MAC-Prefix> is the prefix of the MAC address in hex, and <Vendor> is the name of the vendor. The prefix can be of any length from two hex digits (one octet) to twelve hex digits (six octets, the entire Ethernet hardware address). The alphabetic hex characters [A-F] must be entered in upper case. For example: 012345 would match 01:23:45:xx:xx:xx, where xx represents any value; 0123456 would match 01:23:45:6x:xx:xx; and 01234567 would match 01:23:45:67:xx:xx. Blank lines and lines beginning with "#" are ignored. The order of entries in the file is not important. arp-scan will attempt to match larger prefixes before trying to match smaller ones, and will stop at the first match. FILES
/usr/local/share/arp-scan/mac-vendor.txt EXAMPLE
# From nmap Debian bug report #369681 dated 31 May 2006 525400 QEMU B0C420 Bochs # From RFC 2338: 00-00-5E-00-01-{VRID} 00005E0001 VRRP (last octet is VRID) # Microsoft WLBS (Windows NT Load Balancing Service) # http://www.microsoft.com/technet/prodtechnol/acs/reskit/acrkappb.mspx 02BF Microsoft WLBS (last four octets are IP address) AUTHOR
Roy Hills <Roy.Hills@nta-monitor.com> SEE ALSO
arp-scan(1) get-oui(1) get-iab(1) arp-fingerprint(1) http://www.nta-monitor.com/wiki/ The arp-scan wiki page. March 30, 2007 MAC-VENDOR(5)
Man Page