15

I want to incorporate into a piece of software the ability to look up a manufacturer based on a mac address. By googling "mac address lookup" and similar, I have noticed several websites that make this correlation which suggests this data source is available somewhere. Where can I find this data source that correlates a mac address (input) with a manufacturer (output)?

John R
  • 297
  • 4
  • 10

3 Answers3

27

The first half (24 bits) of your mac-address is called an OUI (Organizationally Unique Identifier), and identifies the company. The list is available on ieee.org:

http://standards.ieee.org/develop/regauth/oui/oui.txt

They are formatted like this:

00-03-93   (hex)        Apple Computer, Inc.
000393     (base 16)    Apple Computer, Inc.
                        20650 Valley Green Dr.
                        Cupertino CA 95014
                        UNITED STATES

The gaps between sequential hex-numbers are probably Privately Registered OUI's. There is no open list for those, but I've never encountered a MAC-address in such ranges.

voretaq7
  • 79,345
  • 17
  • 128
  • 213
Bart De Vos
  • 17,761
  • 6
  • 62
  • 81
  • One question - how reliably do Mac addresses, which can commonly be reset in hardware, reflect this database? – Danny Staple Apr 30 '12 at 16:12
  • 1
    It is indeed, fairly easy to change your mac-address. There is however no way of knowing it then. Nothing you can do about this. – Bart De Vos Apr 30 '12 at 16:34
  • @Danny : in 15 years, I've never come across a MAC address that's been changed. (or at least, where the MAC didn't match the manufacturer once we identified what the item was). There may be industries where it's typical to change it, but in most cases it never happens. – Joe H. May 01 '12 at 03:18
  • I thought of this because I have worked in an environment where we routinely had to alter mac address, and had to use various things to avoid/check for collisions (not good). I work in environments typically with embedded devices - either in development, or doing dev ops/integration. Sometimes a whole batch comes with 1 mac address. – Danny Staple May 01 '12 at 15:26
  • @JoeH. One common case I'm aware of where the MAC doesn't match the manufacturer of the NIC is CARP interfaces on *BSD operating systems (the MAC OUI is 00:00:5E, assigned to IANA). This makes it pretty difficult to determine the manufacturer if you only have network connectivity and not a login/other way to read the MAC off the NIC itself. Also the hazy bits of my memory say that on Sun systems using the EEPROM's MAC address ("system MAC address") you can change the OUI with some not-sanctioned-by-Sun hackery of the EEPROM. – voretaq7 May 02 '12 at 06:50
  • @voretag7: it's possible on Sun hardware and many others to change it -- but my point is, people rarely do. Even with CARP, you're masking it to the network, not changing it ... and I don't have any experience with that sort of load balancing ... the only times I've done it in software it's been on Suns or Macs, and they share an extra IP address for the service, rather than masking the MAC. – Joe H. May 02 '12 at 13:13
20

As @Bart De Vos says the IEEE maintains the canonical list of OUIs. Additionally there is an Individual Address Block (IAB) list at http://standards.ieee.org/develop/regauth/iab/iab.txt. However, entries can be privately registered which means that they will be omitted from oui.txt and iab.txt. The Wireshark development team maintains a much more complete list:

https://code.wireshark.org/review/gitweb?p=wireshark.git;a=blob_plain;f=manuf

We pull entries from the IEEE's public OUI and IAB lists, individual contributors and any other source we can.

The Nmap team maintains a separate list at http://nmap.org/svn/nmap-mac-prefixes.

Gerald Combs
  • 6,331
  • 23
  • 35
-1

You might have better luck pulling this out via Hardware ID, which is a lot more specific, and harder to spoof

PCI\VEN_8086&DEV_10EA&SUBSYS_040A1028&REV_05

you should be able to get it via a simple WMI call to Win32_PnPSignedDriver

though unfortunately this would only work for Windows based machines.

Matt Hamende
  • 129
  • 1
  • 11