https://github.com/hdm/mac-ages

MAC address age tracking
https://github.com/hdm/mac-ages

deepmac ieee oui

Last synced: 1 day ago
JSON representation

MAC address age tracking

• Host: GitHub
• URL: https://github.com/hdm/mac-ages
• Owner: hdm
• License: other
• Created: 2018-09-30T21:19:30.000Z (about 6 years ago)
• Default Branch: main
• Last Pushed: 2024-12-11T23:01:07.000Z (2 days ago)
• Last Synced: 2024-12-12T00:17:48.863Z (2 days ago)
• Topics: deepmac, ieee, oui
• Language: Ruby
• Homepage:
• Size: 134 MB
• Stars: 577
• Watchers: 29
• Forks: 37
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.CODE

Awesome Lists containing this project

README

        
# MAC Address Age Tracking

This repository is used to determine an approximate issuance date for 

IEEE allocated hardware address ranges. The dataset was bootstrapped

using a combination of the DeepMAC project and

[Wireshark](http://www.wireshark.org) archives and maintained via

daily pulls from the IEEE website.

## Usage

If you would like to use the MAC address age dataset in your application, download regular snapshots of the [mac-ages.csv](https://raw.githubusercontent.com/hdm/mac-ages/main/data/mac-ages.csv) from this repository. This file contains three comma-separated fields; the prefix followed by a forward slash and the mask, the first date this prefix was seen, and the source of this date field. This dataset is updated daily from the IEEE CSV files and new file revisions are checked into the main branch as updates are found.

If you would like to maintain a fork of this repository, you need a system with a recent version of Ruby (2.2+), and to run the `update` script in the main directory at whatever interval makes sense. This script will load the current dataset, download the IEEE CSV files, update records as necessary, save the new dataset, and commit the results back to the repository, pushing changes to the `main` branch of the remote `origin`.

## Matching

In order to match a given MAC address to the IEEE datasets, the entries with the largest mask must be checked first (/36), then the next largest (/28), and so on (/24). Matching just the first three bytes is not sufficient for accurate vendor identification, as some prefixes are split into multiple smaller ranges, each corresponding with a different vendor.

For example, when matching the MAC address `70:b3:d5:fe:90:1e`, there are 2,681 entries which match the first three bytes. These include the base allocation from 2014 (`70:b3:d5/24`) and thousands of /36 masked prefixes. Searching for the /36 masked prefixes first identifies the device with prefix `70:b3:d5:fe:90:00/36`, which corresponds to `Zenros ApS` from Denmark.