Finding Radio Manufacturers by MAC Address
Find out what sort of radio cards and laptops are in use on your local network.
If you just joined us from the last
hack [Hack #26], you might be wondering
about who is using your wireless network. Sure, you have their IP
addresses, and their MAC addresses are easily found with a simple
arp
-an
. But what kind
of computers are they using?
The IEEE maintains the database of Organizationally Unique Identifiers (OUI). These are the first 24 bits of the MAC address, parceled out to vendors who manufacture Ethernet devices. If you know the first three bytes of a MAC address, you can look up the device’s manufacturer directly from the IEEE. There is a searchable database on the Web at http://standards.ieee.org/regauth/oui/index.shtml. Note that to use this service, you need to specify the OUI separated by hyphens, not colons (e.g., 00-02-2d, not 00:02:2d.).
The Code
Of course, this is handy for the occasional query, but what if you want to instantly see the manufacturer of all devices on your local subnet? Just after performing a broadcast ping [Hack #26], try this bit of Perl:
#!/usr/bin/perl my %cards; my %ips; open(ARP,"arp -an|") || die "Couldn't open arp table: $!\n"; print "Looking up OUIs."; while(<ARP>) { chomp; my $addr = $_; my $ip = $_; $addr =~ s/.* ([\d\w]+:[\d\w]+:[\d\w]+):.*/$1/; $addr =~ s/\b([\d\w])\b/0$1/g; $addr =~ s/:/-/g; next unless $addr =~ /..-..-../; $ip =~ s/.*?(\d+\.\d+\.\d+\.\d+).*/$1/; print "."; $cards{$addr}||=`curl ...
Get Wireless Hacks now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.