oui mac address identifier utility with perl

wireshark has a good online oui lookup utility that will tell you the manufacturer of a particular network interface card based on the first six bytes of the mac address referred to as the oui (organizationally unique identifier).  nmap, at least the version on my ubuntu machine, has this feature but I am dissatisfied with it’s accuracy or lack thereof.  Being fond of perl,  I searched cpan.org before I attempted to reinvent the wheel.  I found the Net::MAC::Vendor module.  I found it to be slow, and relied on querying an online database (which didn’t work well).

I decided to write my own to augment the functionality of my own network scanner.  I downloaded a local copy of the text file provided by wireshark and wrote the following script to scan my local arp cache and tell me the manufacturer of  each device on the network.

#!/usr/bin/perl -w
use strict;

#update arp table
`arp > arp.txt`;

open(AF, '<', 'arp.txt') or die $!;

while(){
	if($_ =~ /(\d+\.\d+\.\d+\.\d+).+(..:..:..)(:..:..:..)/){
		my $match_flag = 0; 
		my $ip = $1;
		my $oui = $2;
		print "$ip\t$oui$3\t";
		reset;
		open(OU, '<', 'oui_mac.txt') or die $!; 
			#open oui file and search
			my $i=0;
			while(){
				#print "$oui \n";
				if($_  =~ /$oui/i){
					print "$_";
					$match_flag = 1;
					last;
				}#end if
				$i++;
			}#end while
		close OU;
		if($match_flag == 0){
			print "NO OUI MATCH!\n";
		}#end if
	}#end if
}#end while

close AF;

Simple and effective.

mac oui lookup tool written in perl
mac oui lookup tool written in perl

Leave a Reply

Your email address will not be published. Required fields are marked *