MAC-VENDOR(5) File Formats Manual MAC-VENDOR(5)
NAME
mac-vendor - Ethernet vendor file for arp-scan
SYNOPSIS
mac-vendor.txt
DESCRIPTION
The mac-vendor.txt contains Ethernet MAC to vendor string mappings for arp-scan. It is used in addition to the IEEE OUI and IAB listings
in ieee-oui.txt and ieee-iab.txt. It is for MAC-vendor mappings that are not covered by the IEEE manufacturer listings.
Each line in the mac-vendor.txt file contains a MAC-vendor mapping in the form:
<MAC-Prefix><TAB><Vendor>
Where <MAC-Prefix> is the prefix of the MAC address in hex, and <Vendor> is the name of the vendor. The prefix can be of any length from
two hex digits (one octet) to twelve hex digits (six octets, the entire Ethernet hardware address). The alphabetic hex characters [A-F]
must be entered in upper case.
For example:
012345 would match 01:23:45:xx:xx:xx, where xx represents any value;
0123456 would match 01:23:45:6x:xx:xx; and
01234567 would match 01:23:45:67:xx:xx.
Blank lines and lines beginning with "#" are ignored.
The order of entries in the file is not important. arp-scan will attempt to match larger prefixes before trying to match smaller ones, and
will stop at the first match.
FILES
/usr/local/share/arp-scan/mac-vendor.txt
EXAMPLE
# From nmap Debian bug report #369681 dated 31 May 2006
525400 QEMU
B0C420 Bochs
# From RFC 2338: 00-00-5E-00-01-{VRID}
00005E0001 VRRP (last octet is VRID)
# Microsoft WLBS (Windows NT Load Balancing Service)
# http://www.microsoft.com/technet/prodtechnol/acs/reskit/acrkappb.mspx
02BF Microsoft WLBS (last four octets are IP address)
AUTHOR
Roy Hills <Roy.Hills@nta-monitor.com>
SEE ALSO
arp-scan(1)
get-oui(1)
get-iab(1)
arp-fingerprint(1)
http://www.nta-monitor.com/wiki/ The arp-scan wiki page.
March 30, 2007 MAC-VENDOR(5)