1MAC-VENDOR(5)                 File Formats Manual                MAC-VENDOR(5)
2
3
4

NAME

6       mac-vendor - Ethernet vendor file for arp-scan
7

SYNOPSIS

9       mac-vendor.txt
10

DESCRIPTION

12       The  mac-vendor.txt contains Ethernet MAC to vendor string mappings for
13       arp-scan.  It is used in addition to the IEEE  OUI  listings  in  ieee-
14       oui.txt.   It  is  for  MAC-vendor mappings that are not covered by the
15       IEEE manufacturer listings.
16
17       Each line in the mac-vendor.txt file contains a MAC-vendor  mapping  in
18       the form:
19
20       <MAC-Prefix><TAB><Vendor>
21
22       Where  <MAC-Prefix>  is the prefix of the MAC address in hex, and <Ven‐
23       dor> is the name of the vendor.  The prefix can be of any  length  from
24       two hex digits (one octet) to twelve hex digits (six octets, the entire
25       Ethernet hardware address).
26
27       Alphabetic hex characters [A-F] may use either upper or lower case, and
28       seperator  symbols  such  as ":", "-" and "." are ignored. This permits
29       the use of standard format MAC addresses in this file.
30
31       For example:
32
33       01:23:45      matches 01:23:45:xx:xx:xx, where xx represents any value;
34       01:23:45:6    matches 01:23:45:6x:xx:xx; and
35       01:23:45:67   matches 01:23:45:67:xx:xx.
36
37       Do not include entries from the IEEE OUI listings, as these are already
38       in the file ieee-oui.txt, which is automatically used by arp-scan.  See
39       get-oui(1) for details of how to update the OUI listings.
40
41       The order of entries in the file is not important.
42
43       Blank lines and lines beginning with "#" are  ignored.   arp-scan  will
44       attempt  to  match larger prefixes before trying to match smaller ones,
45       and will stop at the first match.
46

FILES

48       /usr/local/share/arp-scan/mac-vendor.txt
49

EXAMPLE

51       # From nmap Debian bug report #369681 dated 31 May 2006
52       52:54:00        QEMU
53       b0:c4:20        Bochs
54
55       # From RFC 2338: 00-00-5E-00-01-{VRID}
56       00:00:5e:00:01  VRRP (last octet is VRID)
57
58       # Microsoft WLBS (Windows NT Load Balancing Service)
59       # http://www.microsoft.com/technet/prodtechnol/acs/reskit/acrkappb.mspx
60       02:bf   Microsoft WLBS (last four octets are IP address)
61
62       # Cisco HSRP (Hot Standby Routing Protocol)
63       # 00-00-0c-07-ac-XX, where XX is the HSRP group number (0 to 255)
64       00:00:0c:07:ac  HSRP (last octet is group number)
65

SEE ALSO

67       arp-scan(1)
68
69       get-oui(1)
70
71       arp-fingerprint(1)
72
73
74
75                               October 28, 2022                  MAC-VENDOR(5)
Impressum