mac-vendor.5

'\" t
.\" Copyright (C) Roy Hills
.\"
.\" Copying and distribution of this file, with or without modification,
.\" are permitted in any medium without royalty provided the copyright
.\" notice and this notice are preserved.
.\"
.TH MAC-VENDOR 5 "October 28, 2022"
.\" Please adjust this date whenever revising the man page.
.SH NAME
mac-vendor \- Ethernet vendor file for arp-scan
.SH SYNOPSIS
.I mac-vendor.txt
.SH DESCRIPTION
The
.I mac-vendor.txt
contains Ethernet MAC to vendor string mappings for
.BR arp-scan .
It is used in addition to the IEEE OUI listings in
.IR ieee-oui.txt .
It is for MAC-vendor mappings that are not covered by the IEEE manufacturer
listings.
.PP
Each line in the
.I mac-vendor.txt
file contains a MAC-vendor mapping in the form:
.PP
.nf
<MAC-Prefix><TAB><Vendor>
.fi
.PP
Where <MAC-Prefix> is the prefix of the MAC address in hex, and <Vendor>
is the name of the vendor.  The prefix can be of any length from two hex
digits (one octet) to twelve hex digits (six octets, the entire Ethernet
hardware address).
.PP
Alphabetic hex characters [A-F] may use either upper or lower case, and
seperator symbols such as ":", "-" and "." are ignored. This permits the
use of standard format MAC addresses in this file.
.PP
For example:
.TS
L L .
01:23:45      matches 01:23:45:xx:xx:xx, where xx represents any value;
01:23:45:6    matches 01:23:45:6x:xx:xx; and
01:23:45:67   matches 01:23:45:67:xx:xx.
.TE
.PP
Do not include entries from the IEEE OUI listings, as these are
already in the file ieee-oui.txt, which is automatically
used by arp-scan.  See get-oui(1) for details of how to
update the OUI listings.
.PP
The order of entries in the file is not important.
.PP
Blank lines and lines beginning with "#" are ignored.
.B arp-scan
will attempt to match larger prefixes before trying to match smaller ones, and
will stop at the first match.
.SH FILES
.I /usr/local/share/arp-scan/mac-vendor.txt
.SH EXAMPLE
.nf
# From nmap Debian bug report #369681 dated 31 May 2006
52:54:00        QEMU
b0:c4:20        Bochs

# From RFC 2338: 00-00-5E-00-01-{VRID}
00:00:5e:00:01  VRRP (last octet is VRID)

# Microsoft WLBS (Windows NT Load Balancing Service)
# http://www.microsoft.com/technet/prodtechnol/acs/reskit/acrkappb.mspx
02:bf   Microsoft WLBS (last four octets are IP address)

# Cisco HSRP (Hot Standby Routing Protocol)
# 00-00-0c-07-ac-XX, where XX is the HSRP group number (0 to 255)
00:00:0c:07:ac  HSRP (last octet is group number)
.fi
.SH "SEE ALSO"
.TP
.BR arp-scan (1)
.TP
.BR get-oui (1)
.TP
.BR arp-fingerprint (1)