Include instructions on how to update MAC database
E3V3A opened this issue · comments
From arp-scan man pages:
The vendor decoding uses the files ieee-oui.txt, ieee-iab.txt and mac-vendor.txt, which are supplied with arp-scan. The ieee-oui.txt and ieee-iab.txt files are generated from the OUI and IAB data on the IEEE website at http://standards.ieee.org/regauth/oui/ieee-oui.txt and http://standards.ieee.org/regauth/oui/iab.txt. The Perl scripts get-oui and get-iab, which are included in the arp-scan package, can be used to update these files with the latest data from the IEEE website. The mac-vendor.txt file contains other MAC to Vendor mappings that are not covered by the IEEE OUI and IAB files, and can be used to add custom mappings.
check links:
@E3V3A - currently the module simply uses arp-scan to determine whether a device is online or not. Additional information (such as vendor mappings) are ignored.
What are your thoughts here?
-
I was thinking that if you have more than 3 devices on your network, it's a bit of a PITA to id and copy/paste all the correct device MAC mappings. A simple bash should be able to get the arp-scan results and at least get you the MACs and manuf. info into config file format. Unfortunately arp-scan out-of-the-box is based on MAC lists from 2016... so is not able to id all my devices.
-
Because some more secure conscious device manufacturers are now using MAC randomization, this make the ID process even more difficult, because the next time you connect a device that has been rebooted, it could have a new MAC and would therefore also get assigned a new IP by your router.
- Made a PR for the script to format MAC and config fields for easy insert. The output of running the script with:
./arps2mm.sh:
devices: [
{ macAddress: "aa:bb:cc:11:22:33", name: "Apple,", icon: "mobile" }, // 192.168.1.12
...
],- To update the MAC data files use:
#------------------------------
# Procedure-1 (using scripts)
#------------------------------
# NOTE: This procedure will only update the MAC data files for arp-scan.
cd /usr/share/arp-scan
sudo get-iab -v -u http://standards.ieee.org/develop/regauth/iab/iab.txt
sudo get-oui -v -u http://standards.ieee.org/develop/regauth/oui/oui.txt
#------------------------------
# Procedure-2 (using wget)
#------------------------------
# NOTE: This procedure will update the MAC data files in ieee-data for system use.
# These files are symlinked under: /var/lib/ieee-data/
cd /usr/share/ieee-data/
# Get raw IAB an OUI files:
sudo wget http://standards.ieee.org/develop/regauth/iab/iab.txt # 2.4 MB @ ~7 sec
sudo wget http://standards.ieee.org/develop/regauth/oui/oui.txt # 3.8 MB @ ~2 min - This is very slow for some reason
# Convert raw files to arp-scan format:
cd /usr/share/arp-scan/
sudo get-iab -v
sudo get-oui -v
Please consider adding this to README or Wiki.
Cheers!
@E3V3A good work.
To keep the documentation clean, is procedure 1 sufficient or do we need to put forward both options?
Yes, Using Procedure-1 only make more sense here.
However, before I discovered P1, I had to do P2, so P1 is untested. Please test it.
The update instructions are not working,