Look up manufacturer based on Mac Address?

Question

I want to incorporate into a piece of software the ability to look up a manufacturer based on a mac address. By googling "mac address lookup" and similar, I have noticed several websites that make this correlation which suggests this data source is available somewhere. Where can I find this data source that correlates a mac address (input) with a manufacturer (output)?

Solution 1

The first half (24 bits) of your mac-address is called an OUI (Organizationally Unique Identifier), and identifies the company. The list is available on ieee.org:

http://standards.ieee.org/develop/regauth/oui/oui.txt

They are formatted like this:

00-03-93   (hex)        Apple Computer, Inc.
000393     (base 16)    Apple Computer, Inc.
                        20650 Valley Green Dr.
                        Cupertino CA 95014
                        UNITED STATES

The gaps between sequential hex-numbers are probably Privately Registered OUI's. There is no open list for those, but I've never encountered a MAC-address in such ranges.

Solution 2

As @Bart De Vos says the IEEE maintains the canonical list of OUIs. Additionally there is an Individual Address Block (IAB) list at http://standards.ieee.org/develop/regauth/iab/iab.txt. However, entries can be privately registered which means that they will be omitted from oui.txt and iab.txt. The Wireshark development team maintains a much more complete list:

https://code.wireshark.org/review/gitweb?p=wireshark.git;a=blob_plain;f=manuf

We pull entries from the IEEE's public OUI and IAB lists, individual contributors and any other source we can.

The Nmap team maintains a separate list at http://nmap.org/svn/nmap-mac-prefixes.

Comments

[SpacemanSpiff]

I would e-mail the writers of one of those pieces of software.

[Danny Staple]

One question - how reliably do Mac addresses, which can commonly be reset in hardware, reflect this database?

[APR]

It is indeed, fairly easy to change your mac-address. There is however no way of knowing it then. Nothing you can do about this.

[Joe H.]

@Danny : in 15 years, I've never come across a MAC address that's been changed. (or at least, where the MAC didn't match the manufacturer once we identified what the item was). There may be industries where it's typical to change it, but in most cases it never happens.

[voretaq7]

@JoeH. One common case I'm aware of where the MAC doesn't match the manufacturer of the NIC is CARP interfaces on *BSD operating systems (the MAC OUI is 00:00:5E, assigned to IANA). This makes it pretty difficult to determine the manufacturer if you only have network connectivity and not a login/other way to read the MAC off the NIC itself. Also the hazy bits of my memory say that on Sun systems using the EEPROM's MAC address ("system MAC address") you can change the OUI with some not-sanctioned-by-Sun hackery of the EEPROM.

[Joe H.]

@voretag7: it's possible on Sun hardware and many others to change it -- but my point is, people rarely do. Even with CARP, you're masking it to the network, not changing it ... and I don't have any experience with that sort of load balancing ... the only times I've done it in software it's been on Suns or Macs, and they share an extra IP address for the service, rather than masking the MAC.