Wireless Hacks

Finding Radio Manufacturers by MAC Address

Find out what sort of radio cards and laptops are in use on your local network.

If you just joined us from the last hack [Hack #26], you might be wondering about who is using your wireless network. Sure, you have their IP addresses, and their MAC addresses are easily found with a simple arp -an. But what kind of computers are they using?

The IEEE maintains the database of Organizationally Unique Identifiers (OUI). These are the first 24 bits of the MAC address, parceled out to vendors who manufacture Ethernet devices. If you know the first three bytes of a MAC address, you can look up the device’s manufacturer directly from the IEEE. There is a searchable database on the Web at http://standards.ieee.org/regauth/oui/index.shtml. Note that to use this service, you need to specify the OUI separated by hyphens, not colons (e.g., 00-02-2d, not 00:02:2d.).

The Code

Of course, this is handy for the occasional query, but what if you want to instantly see the manufacturer of all devices on your local subnet? Just after performing a broadcast ping [Hack #26], try this bit of Perl:

#!/usr/bin/perl my %cards; my %ips; open(ARP,"arp -an|") || die "Couldn't open arp table: $!\n"; print "Looking up OUIs."; while(<ARP>) { chomp; my $addr = $_; my $ip = $_; $addr =~ s/.* ([\d\w]+:[\d\w]+:[\d\w]+):.*/$1/; $addr =~ s/\b([\d\w])\b/0$1/g; $addr =~ s/:/-/g; next unless $addr =~ /..-..-../; $ip =~ s/.*?(\d+\.\d+\.\d+\.\d+).*/$1/; print "."; $cards{$addr}||=`curl ...