Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #268127 > unrolled thread

Commandline client to lookup MAC vendor

Back to article view | Back to linux.debian.user

Contents

  Commandline client to lookup MAC vendor Ralph Aichinger <ra@h5.or.at> - 2024-03-07 10:10 +0100
    Re: Commandline client to lookup MAC vendor "Jonathan Dowland" <jmtd@debian.org> - 2024-03-07 10:40 +0100
      Re: Commandline client to lookup MAC vendor Thomas Pircher <thp.debian@p5r.uk> - 2024-03-07 11:00 +0100
        Re: Commandline client to lookup MAC vendor Ralph Aichinger <ra@h5.or.at> - 2024-03-07 11:30 +0100
          Re: Commandline client to lookup MAC vendor Thomas Pircher <thp.debian@p5r.uk> - 2024-03-07 16:10 +0100
            Re: Commandline client to lookup MAC vendor Lee <ler762@gmail.com> - 2024-03-07 18:50 +0100
              Re: Commandline client to lookup MAC vendor Thomas Pircher <thp.debian@p5r.uk> - 2024-03-07 22:30 +0100
    Re: Commandline client to lookup MAC vendor Jeffrey Walton <noloader@gmail.com> - 2024-03-08 01:40 +0100

#268127 — Commandline client to lookup MAC vendor

Hi!

Several packages in Debian can somehow (either by embedding it or
querying it from some common database) display the MAC Vendor
information of network adapters (derived from hardware addresses). 

One example is nmap, that displays the device vendor when scanning.

Is there some commandline tool doing this directly in Debian? I know
that there are websites that offer this as a service, but sometimes a
CLI is more convenient.

Alternatively, and if this information is stored in some shared
databases, can this be queried e.g. from a Pyhton script? If so, how?

TIA
/ralph

[toc] | [next] | [standalone]

#268129

On Thu Mar 7, 2024 at 8:50 AM GMT, Ralph Aichinger wrote:
> Several packages in Debian can somehow (either by embedding it or
> querying it from some common database) display the MAC Vendor
> information of network adapters (derived from hardware addresses). 
>
> One example is nmap, that displays the device vendor when scanning.
>
> Is there some commandline tool doing this directly in Debian? I know
> that there are websites that offer this as a service, but sometimes a
> CLI is more convenient.
>
> Alternatively, and if this information is stored in some shared
> databases, can this be queried e.g. from a Pyhton script? If so, how?

The nmap-common package ships the DB that nmap queries in a plain text
format: /usr/share/nmap/nmap-mac-prefixes

Example

    $ ip link show wlp0s20f3 | grep ether
        link/ether 90:09:df:ba:0c:cf brd ff:ff:ff:ff:ff:ff
    $ grep -i ^9009df /usr/share/nmap/nmap-mac-prefixes
    9009DF Intel Corporate


HTH,

-- 
Please do not CC me for listmail.

👱🏻	Jonathan Dowland
✎	 jmtd@debian.org
🔗	https://jmtd.net

[toc] | [prev] | [next] | [standalone]

#268130

On 2024-03-07 09:37, Jonathan Dowland wrote:
>     $ grep -i ^9009df /usr/share/nmap/nmap-mac-prefixes
>     9009DF Intel Corporate

Alternatively, the ieee-data package also contains the OUI database:

     $ grep -i ^9009df /usr/share/ieee-data/oui.txt
     9009DF     (base 16)            Intel Corporate

Thomas

[toc] | [prev] | [next] | [standalone]

#268131

On Thu, 2024-03-07 at 09:52 +0000, Thomas Pircher wrote:
> On 2024-03-07 09:37, Jonathan Dowland wrote:
> >     $ grep -i ^9009df /usr/share/nmap/nmap-mac-prefixes
> >     9009DF Intel Corporate
> 
> Alternatively, the ieee-data package also contains the OUI database:
> 
>      $ grep -i ^9009df /usr/share/ieee-data/oui.txt
>      9009DF     (base 16)            Intel Corporate

Thanks to the both of you. Any idea if one or the other is preferable
or newer?

/ralph

[toc] | [prev] | [next] | [standalone]

#268140

On 2024-03-07 10:11, Ralph Aichinger wrote:
> Any idea if one or the other is preferable or newer?

I think there is not much difference between the two files, the 
ieee-data packages the data directly from the IEEE, with nmap you have 
one intermediary project that needs to download and release the file 
before Debian can pick it up.

Then on the other hand, the ieee-data package is one minor version 
behind on the data, while the nmap file was modified ~6 months ago in 
Debian's VCS.

The only difference I can see is that with the ieee-data package you get 
some visibility which upstream version was used, while it would take 
more effort to trace that back in the nmap case.

Thomas

[toc] | [prev] | [next] | [standalone]

#268147

On Thu, Mar 7, 2024 at 12:22 PM Thomas Pircher wrote:
>
> On 2024-03-07 10:11, Ralph Aichinger wrote:
> > Any idea if one or the other is preferable or newer?
>
> I think there is not much difference between the two files, the
> ieee-data packages the data directly from the IEEE, with nmap you have
> one intermediary project that needs to download and release the file
> before Debian can pick it up.
>
> Then on the other hand, the ieee-data package is one minor version
> behind on the data, while the nmap file was modified ~6 months ago in
> Debian's VCS.
>
> The only difference I can see is that with the ieee-data package you get
> some visibility which upstream version was used, while it would take
> more effort to trace that back in the nmap case.

I haven't tried either package - I just use the file from IEEE
  https://standards-oui.ieee.org/oui/oui.txt

[toc] | [prev] | [next] | [standalone]

#268159

Lee wrote:
>I haven't tried either package - I just use the file from IEEE

Sure, that's directly from the source. One has to find a compromise
between always using the latest version and using a limited common
resources (like ieee's bandwidth in this case) in a responsible way.

Thomas

[toc] | [prev] | [next] | [standalone]

#268162

On Thu, Mar 7, 2024 at 4:06 AM Ralph Aichinger <ra@h5.or.at> wrote:
>
> Several packages in Debian can somehow (either by embedding it or
> querying it from some common database) display the MAC Vendor
> information of network adapters (derived from hardware addresses).
>
> One example is nmap, that displays the device vendor when scanning.
>
> Is there some commandline tool doing this directly in Debian? I know
> that there are websites that offer this as a service, but sometimes a
> CLI is more convenient.
>
> Alternatively, and if this information is stored in some shared
> databases, can this be queried e.g. from a Pyhton script? If so, how?

Here's a Python project that does what you want:
<https://github.com/bauerj/mac_vendor_lookup>. The update function
uses <https://standards-oui.ieee.org/oui/oui.txt> as Lee suggested.

Jeff

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web