GET-IAB(1) General Commands Manual GET-IAB(1)NAME
get-iab - Fetch the arp-scan IAB file from the IEEE website
SYNOPSIS
get-iab [options]
DESCRIPTION
get-iab fetches the Ethernet IAB file from the IEEE website, and saves it in the format used by arp-scan.
The IAB file contains all of the IABs (Individual Address Blocks) that have been registered with IEEE. Each IAB entry in the file speci-
fies the first 36-bits of the 48-bit Ethernet hardware address, leaving the remaining 12-bits for use by the registering organisation. For
example the IAB entry "0050C2003", registered to Microsoft, applies to any Ethernet hardware address from 00:50:c2:00:30:00 to
00:50:c2:00:3f:ff inclusive. Each IAB assignment represents a total of 2^12 (4,096) Ethernet addresses.
Major Ethernet hardware vendors typically use an OUI registration rather than an IAB registration. See get-oui(1) for details.
This script can be used to update the arp-scan IAB file from the latest data on the IEEE website. It is relatively rare to see Ethernet
addresses from IAB registrations, so the IAB file is not as important as the OUI file.
The IAB data is fetched from the URL http://standards.ieee.org/regauth/oui/iab.txt and the output file is saved to the file ieee-iab.txt in
the current directory. The URL to fetch the data from can be changed with the -u option, and the output file name can be changed with the
-f option.
The ieee-iab.txt file that is produced by this script is used by arp-scan to determine the Ethernet card vendor from its hardware address.
The directory that arp-scan will look for the ieee-iab.txt file depends on the options used when it was built. If it was built using the
default options, then it will look in /usr/local/share/arp-scan.
OPTIONS -h Display a brief usage message and exit.
-f <fn>
Write the output to the specified file instead of the default ieee-iab.txt.
-u <URL>
Use the specified URL to fetch the raw IAB data from instead of the default http://standards.ieee.org/regauth/oui/iab.txt
-v Display verbose progress messages.
FILES
ieee-iab.txt
The default output file.
EXAMPLES
$ get-iab -v
Renaming ieee-iab.txt to ieee-iab.txt.bak
Fetching IAB data from http://standards.ieee.org/regauth/oui/iab.txt
Fetched 230786 bytes
Opening output file ieee-iab.txt
1535 IAB entries written to file ieee-iab.txt
NOTES
get-iab is implemented in Perl, so you need to have the Perl interpreter installed on your system to use it.
get-iab uses the LWP::Simple Perl module to fetch the data from the IEEE website. You must have this module installed on your system for it
to work. This module is available on most distributions, often called libwww-perl. It is also available in source form from CPAN.
You can use a proxy server by defining the http_proxy environment variable.
AUTHOR
Roy Hills <Roy.Hills@nta-monitor.com>
SEE ALSO arp-scan(1)get-oui(1)arp-fingerprint(1)
http://www.nta-monitor.com/wiki/ The arp-scan wiki page.
March 30, 2007 GET-IAB(1)
Check Out this Related Man Page
Vendor(3pm) User Contributed Perl Documentation Vendor(3pm)NAME
Net::MAC::Vendor - look up the vendor for a MAC
SYNOPSIS
use Net::MAC::Vendor;
my $mac = "00:0d:93:29:f6:c2";
my $array = Net::MAC::Vendor::lookup( $mac );
You can also run this as a script with as many arguments as you like. The module realizes it is a script, looks up the information for
each MAC, and outputs it.
perl Net/MAC/Vendor.pm 00:0d:93:29:f6:c2 00:0d:93:29:f6:c5
DESCRIPTION
The Institute of Electrical and Electronics Engineers (IEEE) assigns an Organizational Unique Identifier (OUI) to manufacturers of network
interfaces. Each interface has a Media Access Control (MAC) address of six bytes. The first three bytes are the OUI.
This module allows you to take a MAC address and turn it into the OUI and vendor information. You can, for instance, scan a network,
collect MAC addresses, and turn those addresses into vendors. With vendor information, you can often guess at what what you are looking at
(e.g. an Apple product).
You can use this as a module as its individual functions, or call it as a script with a list of MAC addresses as arguments. The module can
figure it out.
This module tries to persistently cache with DBM::Deep the OUI information so it can avoid using the network. If it cannot load DBM::Deep,
it uses a normal hash (which is lost when the process finishes). You can preload this cache with the load_cache() function.
So far, the module looks in the current working directory for a file named mac_oui.db to find the cache. I need to come up with a way to
let the user set that location.
Functions
run( @macs )
If I call this module as a script, this class method automatically runs. It takes the MAC addresses and prints the registered vendor
information for each address. I can pass it a list of MAC addresses and run() processes each one of them. It prints out what it
discovers.
This method does try to use a cache of OUI to cut down on the times it has to access the network. If the cache is fully loaded
(perhaps using "load_cache"), it may not even use the network at all.
lookup( MAC )
Given the MAC address, return an anonymous array with the vendor information. The first element is the OUI, the second element is the
vendor name, and the remaining elements are the address lines. Different records may have different numbers of lines, although the
first two should be consistent.
The normalize_mac() function explains the possible formants for MAC.
normalize_mac( MAC )
Takes a MAC address and turns it into the form I need to send to the IEEE lookup, which is the first six bytes in hex separated by
hyphens. For instance, 00:0d:93:29:f6:c2 turns into 00-0D-93.
The input string can be a separated by colons or hyphens. They can omit leading 0's (which might make things look odd). We only need
the first three bytes
00:0d:93:29:f6:c2 # usual form
00-0d-93-29-f6-c2 # with hyphens
00:0d:93 # first three bytes
0:d:93 # missing leading zero
:d:93 # missing all leading zeros
fetch_oui( MAC )
Looks up the OUI information on the IEEE website, or uses a cached version of it. Pass it the result of "normalize_mac()" and you
should be fine.
The "normalize_mac()" function explains the possible formants for MAC.
To avoid multiple calls on the network, use "load_cache" to preload the entire OUI space into an in-memory cache. This can take a long
time over a slow network, thoug; the file is about 60,000 lines.
fetch_oui_from_ieee( MAC )
Looks up the OUI information on the IEEE website. Pass it the result of "normalize_mac()" and you should be fine.
The "normalize_mac()" function explains the possible formants for MAC.
fetch_oui_from_cache( MAC )
Looks up the OUI information in the cached OUI information (see "load_cache").
The "normalize_mac()" function explains the possible formats for MAC.
To avoid multiple calls on the network, use "load_cache" to preload the entire OUI space into an in-memory cache.
If it doesn't find the MAC in the cache, it returns nothing.
extract_oui_from_html( HTML )
Gets rid of the HTML around the OUI information. It may still be ugly. The HTML is the search results page of the IEEE ouisearch
lookup.
Returns false if it could not extract the information. This could mean unexpected input or a change in format.
parse_oui( STRING )
Takes a string that looks like
00-03-93 (hex) Apple Computer, Inc.
000393 (base 16) Apple Computer, Inc.
20650 Valley Green Dr.
Cupertino CA 95014
UNITED STATES
and turns it into an array of lines. It discards the first line, strips the leading information from the second line, and strips the
leading whitespace from all of the lines.
With no arguments, it returns an empty anonymous array.
load_cache( [ SOURCE ] )
Downloads the current list of all OUIs, parses it with "parse_oui()", and stores it in $Cached anonymous hash keyed by the OUIs (i.e.
00-0D-93). The "fetch_oui()" will use this cache if it exists. The cache is stored as a "DBM::Deep" file named after the
"NET_MAC_VENDOR_CACHE" environment variable, or "mac_oui.db" by default.
By default, this uses "http://standards.ieee.org/regauth/oui/oui.txt" , but given an argument, it tries to use that. To load from a
local file, use the "file://" scheme.
If "load_cache" cannot load the data, it issues a warning and returns nothing.
SEE ALSO
Net::MacMap
SOURCE AVAILABILITY
This source is part of a SourceForge project which always has the latest sources in CVS, as well as all of the previous releases.
http://sourceforge.net/projects/brian-d-foy/
If, for some reason, I disappear from the world, one of the other members of the project can shepherd this module appropriately.
AUTHOR
brian d foy "<bdfoy@cpan.org>"
COPYRIGHT AND LICENSE
Copyright (c) 2004-2007 brian d foy. All rights reserved.
This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.
perl v5.14.2 2007-10-28 Vendor(3pm)