Determining Vendor information from MAC Addresses – Redux
- June 7th, 2010
- By Z-95
- Write comment
I was never really happy with the old way that I had parsed the IEEE oui.txt file to determine vendor names based on MAC addresses. It was slow, required manual manipulation of the oui file before processing, and was tailored only to gpsdrive’s geoinfo MYSQL schema. Along with the ongoing Kismet/AP work I’ve been (slowly) doing, I wanted a better way to determine AP vendors from MAC addresses that was easily run, updatable, and fast.
The best way I found was to store parsed MAC to vendor information in a database table which was easy to do since I was already using SQLite for the WIP Kismet parsing code. I used this schema:
CREATE TABLE manuf (
mac TEXT PRIMARY KEY NOT NULL,
manuf TEXT NOT NULL);and the following parsing code:
<?php
try
{
$dbh = new PDO("sqlite:/path/to/database.sqlite");
}
catch(PDOException $e)
{
echo $e->getMessage();
}
$ouifile = file("http://standards.ieee.org/regauth/oui/oui.txt");
$dbh->exec("BEGIN;");
$delete = $dbh->prepare("DELETE FROM manuf;");
$insert = $dbh->prepare("INSERT INTO manuf (mac, manuf) VALUES (?, ?);");
$insert->bindParam(1, $mac);
$insert->bindParam(2, $manuf);
$vacuum = $dbh->prepare("VACUUM;");
$delete->execute();
$vacuum->execute();
foreach ($ouifile as $line)
{
if (!substr_count($line, "(hex)"))
{
continue;
}
$mac = str_replace("-", ":", substr($line, 0, 8));
$manuf = trim(substr($line, strpos($line, "(hex)") + 5));
$manuf = preg_replace('/[\',\.\(\)]/', '', $manuf);
$manuf = preg_replace(
'/(the|inc|incorporated|plc|s\/a|a\/s|ab|ag|kg|gmbh|limited|ltd|spa|llc)/i',
'', $manuf);
$manuf = ucwords(strtolower($manuf));
$manuf = preg_replace('/\s\s+/', ' ', $manuf);
$manuf = trim($manuf);
$insert->execute();
}
$dbh->exec("END;");
$dbh = null;
echo "Done inserting";
?>Basically, it pulls the oui.txt from the IEEE, parses it and removes some unneeded characters/info, and puts it in the database. This is then easy to query against using standard SQL and it is now easily run and updated and takes milliseconds instead of seconds to run.