MAC-VENDOR(5)

📦
version 1.10.0 · 2 versions
  • 1.10.0 · alpine 3.24, arch rolling, debian bookworm, debian trixie, epel 10, epel 9, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu noble, ubuntu resolute, ubuntu stonking (latest)
  • 1.9.7 · ubuntu jammy
, in alpine 3.24, arch rolling, debian bookworm, debian trixie, epel 10, epel 9, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu noble, ubuntu resolute, ubuntu stonking

💖 MAC-VENDOR(5) — the Ethernet vendor file for arp-scan, bestie edition 💖

okay so this is the File Formats Manual page for mac-vendor, and honestly? she's a whole vibe. sit down, grab a strawberry 🍓, let's get into it.

✨ NAME ✨

mac-vendor — the Ethernet vendor file for arp-scan, no cap 🫶

🦋 SYNOPSIS 🦋

mac-vendor.txt

👑 DESCRIPTION 👑

So mac-vendor.txt is literally just a little file full of Ethernet MAC → vendor string mappings for arp-scan. It's used in addition to the IEEE OUI listings in ieee-oui.txt. It exists for the MAC-vendor mappings that the IEEE manufacturer listings just… don't cover. Not their fault, they're just built different. 💅

Every line in mac-vendor.txt holds one MAC-vendor mapping, and the format is:

<MAC-Prefix><TAB><Vendor>

Where <MAC-Prefix> is the prefix of the MAC address in hex, and <Vendor> is the name of the vendor. And the prefix? She's flexible, queen. It can be any length from two hex digits (one octet) all the way up to twelve hex digits (six octets — the entire Ethernet hardware address). Range, honey. ✨

Alphabetic hex characters [A-F] can be upper or lower case, whichever you feel like, and separator symbols like ":", "-" and "." are ignored entirely. So yes bestie, you can absolutely drop standard format MAC addresses in this file and it'll eat them up. 😌

For example:

  • 01:23:45 matches 01:23:45:xx:xx:xx, where xx represents any value;
  • 01:23:45:6 matches 01:23:45:6x:xx:xx; and
  • 01:23:45:67 matches 01:23:45:67:xx:xx.
🚨 okay important one: do NOT include entries from the IEEE OUI listings, because those are already sitting pretty in the file ieee-oui.txt, which arp-scan automatically uses. Don't double up, it's not the move. See get-oui(1) for details on how to update the OUI listings. 💖

The order of entries in the file is not important. Chaos order? Fine. Alphabetical? Also fine. Live your truth.

Blank lines and lines beginning with "#" are ignored. And here's the icon behaviour: arp-scan will attempt to match larger prefixes before trying to match smaller ones, and will stop at the first match. First come, first served, periodt. 💅

🎀 FILES 🎀

  • /usr/local/share/arp-scan/mac-vendor.txt

🌸 EXAMPLE 🌸

# From nmap Debian bug report #369681 dated 31 May 2006
52:54:00        QEMU
b0:c4:20        Bochs

# From RFC 2338: 00-00-5E-00-01-{VRID}
00:00:5e:00:01  VRRP (last octet is VRID)

# Microsoft WLBS (Windows NT Load Balancing Service)
# http://www.microsoft.com/technet/prodtechnol/acs/reskit/acrkappb.mspx
02:bf   Microsoft WLBS (last four octets are IP address)

# Cisco HSRP (Hot Standby Routing Protocol)
# 00-00-0c-07-ac-XX, where XX is the HSRP group number (0 to 255)
00:00:0c:07:ac  HSRP (last octet is group number)

look at her. gorgeous. 🔥

💜 SEE ALSO 💜

go read those too, iykyk 🧚

and that's the page!! this one's from October 28, 2022, bestie — dated and slaying ever since. mwah, ily, go map some MACs 💅💖✨

📦 where this page comes from