royhills / arp-scan

The ARP Scanner
GNU General Public License v3.0
977 stars 154 forks source link

Modify IEEE OUI code and scripts to reflect registry changes #78

Closed royhills closed 2 years ago

royhills commented 2 years ago

The IEEE registry was restructured in 2014 as detailed here: http://tools.ietf.org/html/draft-ieee-rac-oui-restructuring-01, "OUI Registry Restructuring".

arp-scan still uses the old registry format with OUI and IAB registries. There are now four IEEE MAC address registries:

The aim is to put the contents of all four registries into one file rather than having one file for each registry. Having four seperate files with four seperate options for specifying their filenames seems unweildy, and arp-scan has supported variable-size MAC address prefixes in its registry files for some time.

Note that Debian have an ieee-data package which also contains this information in raw format from the IEEE site. We should also make it easy to use this package if desired - there is already a patch in the Debian arp-scan package for the existing scripts.

royhills commented 2 years ago

I plan to use the IEEE CSV files instead of the TXT files because the CSV files are about half the size of the TXT files and should have the same contents.

There appear to be some differences between the vendor names in the two files:

  1. Some entries in the CSV file have a trailing tab character at the end of the vendor name. I plan to trim any leading and trailing whitespace from the vendor name to remove these.
rsh@bullseye:/tmp/ieee-data-20210605.1$ grep 901234 oui.txt | xxd
00000000: 3930 3132 3334 2020 2020 2028 6261 7365  901234     (base
00000010: 2031 3629 0909 5368 656e 7a68 656e 2059   16)..Shenzhen Y
00000020: 4f55 4855 4120 5465 6368 6e6f 6c6f 6779  OUHUA Technology
00000030: 2043 6f2e 2c20 4c74 640a                  Co., Ltd.

rsh@bullseye:/tmp/ieee-data-20210605.1$ grep 901234 oui.csv | xxd
00000000: 4d41 2d4c 2c39 3031 3233 342c 2253 6865  MA-L,901234,"She
00000010: 6e7a 6865 6e20 594f 5548 5541 2054 6563  nzhen YOUHUA Tec
00000020: 686e 6f6c 6f67 7920 436f 2e2c 204c 7464  hnology Co., Ltd
00000030: 0922 2c22 526f 6f6d 2034 3037 2053 6865  .","Room 407 She
00000040: 6e7a 6865 6e20 556e 6976 6572 7369 7479  nzhen University
00000050: 2d74 6f77 6e20 4275 7369 6e65 7373 2050  -town Business P
00000060: 6172 6b2c 4c69 7368 616e 2052 6f61 642c  ark,Lishan Road,
00000070: 5461 6f79 7561 6e20 5374 7265 6574 2c4e  Taoyuan Street,N
00000080: 616e 7368 616e 2044 6973 7472 6963 7420  anshan District
00000090: 5368 656e 7a68 656e 2047 7561 6e67 646f  Shenzhen Guangdo
000000a0: 6e67 2043 4e20 3531 3830 3535 2022 0a    ng CN 518055 ".
  1. Some entries in the CSV file contain double quotes within the vendor name but these are not present in the TXT file. I suspect that the CSV entry with quotes (JSC "MASSA-K") is more correct than the TXT entry (JSC MASSA-K), so I do not consider this to be a bug or regression.
rsh@bullseye:/tmp/ieee-data-20210605.1$ grep 001EFC oui.txt
001EFC     (base 16)            JSC MASSA-K

rsh@bullseye:/tmp/ieee-data-20210605.1$ grep 001EFC oui.csv
MA-L,001EFC,"JSC ""MASSA-K""","15, A, Pirogovskaya nab. Saint-Petersburg Leningradskiy reg. RU 194044 "
royhills commented 2 years ago

The get-oui script now fetches data from all four IEEE Ethernet registries, formats the data and concatenates it in ieee-oui.txt. Example run:

$ ./get-oui -v
       Renaming ieee-oui.txt to ieee-oui.txt.bak
       Opening output file ieee-oui.txt
       Fetching IEEE IAB data from http://standards-oui.ieee.org/iab/iab.csv
       Fetched 381454 bytes
       4575 IAB entries written to ieee-oui.txt
       Fetching IEEE MAM data from http://standards-oui.ieee.org/oui28/mam.csv
       Fetched 492368 bytes
       4474 MAM entries written to ieee-oui.txt
       Fetching IEEE OUI data from http://standards-oui.ieee.org/oui/oui.csv
       Fetched 3051812 bytes
       32845 OUI entries written to ieee-oui.txt
       Fetching IEEE OUI36 data from http://standards-oui.ieee.org/oui36/oui36.csv
       Fetched 89060 bytes
       980 OUI36 entries written to ieee-oui.txt

This produces output like this (... = lines skipped)

# ieee-oui.txt -- IEEE Ethernet OUI-Vendor mapping file for arp-scan
#
# This file contains the IEEE Ethernet MAC address registry entries that are
# used to determine the Ethernet vendor for a given MAC address.
...
#
# Start of IEEE IAB registry data
#
0050C27D5       DEUTA-WERKE GmbH
40D85511C       DEUTA-WERKE GmbH
40D8551A1       KRONOTECH SRL
...
40D8551DC       Aplex Technology Inc.
0050C2597       Nautel LTD
0050C2F48       SHURE INCORPORATED
#
# End of IEEE IAB registry data. 4575 entries.
#

#
# Start of IEEE MAM registry data
#
741AE09 Private
208593B IOG Products LLC
B0C5CAF Private
...
C4A5599 Shenzhen Meishifu Technology Co.,Ltd.
C4A559C ALTAM SYSTEMS SL
C4A5590 Archermind Japan Co.,Ltd.
#
# End of IEEE MAM registry data. 4474 entries.
#

#
# Start of IEEE OUI registry data
#
002272  American Micro-Fuel Device Corp.
00D0EF  IGT
086195  Rockwell Automation
...
001B1F  FORCE Technology
A88055  Tuya Smart Inc.
508BB9  Tuya Smart Inc.
#
# End of IEEE OUI registry data. 32845 entries.
#

#
# Start of IEEE OUI36 registry data
#
70B3D5F2F       TELEPLATFORMS
70B3D5719       2M Technology
70B3D59FC       Truecom Telesoft Private Limited
...
8C1F640B0       Bunka Shutter Co., Ltd.
8C1F64958       Sanchar Telesystems limited
8C1F64A42       Rodgers Instruments US
#
# End of IEEE OUI36 registry data. 980 entries.
#