Re: Commandline client to lookup MAC vendor

[Jeffrey Walton]

On Thu, Mar 7, 2024 at 4:06 AM Ralph Aichinger  wrote:
>
> Several packages in Debian can somehow (either by embedding it or
> querying it from some common database) display the MAC Vendor
> information of network adapters (derived from hardware addresses).
>
> One example is nmap, that displays the device vendor when scanning.
>
> Is there some commandline tool doing this directly in Debian? I know
> that there are websites that offer this as a service, but sometimes a
> CLI is more convenient.
>
> Alternatively, and if this information is stored in some shared
> databases, can this be queried e.g. from a Pyhton script? If so, how?

Here's a Python project that does what you want:
. The update function
uses  as Lee suggested.

Jeff

Re: Commandline client to lookup MAC vendor

[Thomas Pircher]

Lee wrote:

I haven't tried either package - I just use the file from IEEE


Sure, that's directly from the source. One has to find a compromise
between always using the latest version and using a limited common
resources (like ieee's bandwidth in this case) in a responsible way.

Thomas

Re: Commandline client to lookup MAC vendor

[Lee]

On Thu, Mar 7, 2024 at 12:22 PM Thomas Pircher wrote:
>
> On 2024-03-07 10:11, Ralph Aichinger wrote:
> > Any idea if one or the other is preferable or newer?
>
> I think there is not much difference between the two files, the
> ieee-data packages the data directly from the IEEE, with nmap you have
> one intermediary project that needs to download and release the file
> before Debian can pick it up.
>
> Then on the other hand, the ieee-data package is one minor version
> behind on the data, while the nmap file was modified ~6 months ago in
> Debian's VCS.
>
> The only difference I can see is that with the ieee-data package you get
> some visibility which upstream version was used, while it would take
> more effort to trace that back in the nmap case.

I haven't tried either package - I just use the file from IEEE
  https://standards-oui.ieee.org/oui/oui.txt

Re: Commandline client to lookup MAC vendor

[Thomas Pircher]

On 2024-03-07 10:11, Ralph Aichinger wrote:

Any idea if one or the other is preferable or newer?


I think there is not much difference between the two files, the 
ieee-data packages the data directly from the IEEE, with nmap you have 
one intermediary project that needs to download and release the file 
before Debian can pick it up.


Then on the other hand, the ieee-data package is one minor version 
behind on the data, while the nmap file was modified ~6 months ago in 
Debian's VCS.


The only difference I can see is that with the ieee-data package you get 
some visibility which upstream version was used, while it would take 
more effort to trace that back in the nmap case.


Thomas

Re: Commandline client to lookup MAC vendor

[Ralph Aichinger]

On Thu, 2024-03-07 at 09:52 +, Thomas Pircher wrote:
> On 2024-03-07 09:37, Jonathan Dowland wrote:
> >     $ grep -i ^9009df /usr/share/nmap/nmap-mac-prefixes
> >     9009DF Intel Corporate
> 
> Alternatively, the ieee-data package also contains the OUI database:
> 
>  $ grep -i ^9009df /usr/share/ieee-data/oui.txt
>  9009DF (base 16)    Intel Corporate

Thanks to the both of you. Any idea if one or the other is preferable
or newer?

/ralph

Re: Commandline client to lookup MAC vendor

[Thomas Pircher]

On 2024-03-07 09:37, Jonathan Dowland wrote:

$ grep -i ^9009df /usr/share/nmap/nmap-mac-prefixes
9009DF Intel Corporate


Alternatively, the ieee-data package also contains the OUI database:

$ grep -i ^9009df /usr/share/ieee-data/oui.txt
9009DF (base 16)Intel Corporate

Thomas

Re: Commandline client to lookup MAC vendor

[Jonathan Dowland]

On Thu Mar 7, 2024 at 8:50 AM GMT, Ralph Aichinger wrote:
> Several packages in Debian can somehow (either by embedding it or
> querying it from some common database) display the MAC Vendor
> information of network adapters (derived from hardware addresses). 
>
> One example is nmap, that displays the device vendor when scanning.
>
> Is there some commandline tool doing this directly in Debian? I know
> that there are websites that offer this as a service, but sometimes a
> CLI is more convenient.
>
> Alternatively, and if this information is stored in some shared
> databases, can this be queried e.g. from a Pyhton script? If so, how?

The nmap-common package ships the DB that nmap queries in a plain text
format: /usr/share/nmap/nmap-mac-prefixes

Example

$ ip link show wlp0s20f3 | grep ether
link/ether 90:09:df:ba:0c:cf brd ff:ff:ff:ff:ff:ff
$ grep -i ^9009df /usr/share/nmap/nmap-mac-prefixes
9009DF Intel Corporate


HTH,

-- 
Please do not CC me for listmail.

  Jonathan Dowland
✎j...@debian.org
   https://jmtd.net