If OUI is not found from manuf package, attempt to detect if client MAC is an LAA MAC, and note that the client is using MAC randomization.
Notes from Adrian:
When Apple started randomizing MACs in iOS 8, they would randomize every byte of the MAC but still generating LAA MACs. Then, in iOS 10, they started using an Apple OUI, flipping the LAA bit and randomizing the remaining 3 bytes of the address.
There's another IEEE registry database called CID (company identifier) that provided OUIs to be used as LAAs but only a few companies have registered there. Google is one and I think they have used their CID OUI for randomization in Android. Apple is not there. http://standards-oui.ieee.org/cid/cid.csv
You can look at the vendor specific IEs and see if there’s information there that can help you identify the vendor. In some cases, like Apple, there’s no more confusion. In others, the presence of a vendor-specific IE doesn’t mean the device is from that manufacturer.
If OUI is not found from
manuf
package, attempt to detect if client MAC is an LAA MAC, and note that the client is using MAC randomization.Notes from Adrian: