mjhjmtu

I have found some tools that seems to update the OUI MAC address vendor database on my system, like get-oui, airodump-ng-oui-update or update-oui :

update-oui(8) OUI update-oui(8)

NAME
 update-oui - download new version of the OUI and IAB lists

SYNOPSIS
 update-oui

DESCRIPTION
 update-oui fetches the current version of the OUI and IAB lists from
 http://standards.ieee.org/regauth/oui/index.shtml and installs it, if the
 installed versions is older than 5 days.

 This utility requires curl, wget or libwww-perl to be installed.

OPTIONS
 -q Be quiet. Do not output messages.

 -f Force the update, even if the file is newer than 5 days.

FILES
 /usr/share/misc/
 Directory holding symbolic links to oui.txt and iab.txt

But if I search for IPs on my network:

luis@Zarzamoro:~$ sudo netdiscover -i eth1

 92 Captured ARP Req/Rep packets, from 12 hosts. Total size: 5520
 _____________________________________________________________________________
 IP At MAC Address Count Len MAC Vendor
 -----------------------------------------------------------------------------
 192.168.4.31 bc:f1:f2:12:b4:93 60 3600 Unknown vendor
 192.168.4.24 f0:db:e2:de:11:80 02 120 Unknown vendor
 192.168.4.242 00:1d:7e:9c:6e:fc 05 300 Cisco-Linksys, LLC
 192.168.4.243 00:1c:10:64:63:ac 05 300 Cisco-Linksys, LLC
 192.168.4.244 00:1c:10:64:5f:94 05 300 Cisco-Linksys, LLC
 192.168.4.1 d8:61:94:e5:0b:1d 05 300 Unknown vendor
 192.168.4.246 00:1a:70:2f:ab:4b 04 240 Cisco-Linksys, LLC
 192.168.4.10 84:11:9e:2b:1c:d6 01 060 Unknown vendor
 192.168.4.11 ec:1f:72:5d:42:d0 02 120 Unknown vendor
 192.168.4.245 00:1a:70:2f:aa:63 01 060 Cisco-Linksys, LLC
 192.168.4.248 00:1a:70:2f:aa:d1 01 060 Cisco-Linksys, LLC
 192.168.4.251 44:d9:e7:0a:0b:98 01 060 Unknown vendor

As long as there are some MACs reported as Unknown vendor, I would like to search on any OUI database for its info.

What is the proper command-line way to perform this search?

Maybe something like:

oui-info 44:d9:e7

Note: I know that using the web browser I can google for the MAC's first 3 pairs, but I would like some command-line method, so I could script it or use via remote login (SSH).

I do not think there is an automated tool to do what you ask, but can be done by working directly on files oui.txt.

First of all it identifies the file downloaded, for example:

root@kalilloX:~# locate oui.txt
/var/lib/ieee-data/oui.txt

then search for the string you are interested. You must remove : or instead insert a -:

root@kalilloX:~# grep -i "44d9e7" /var/lib/ieee-data/oui.txt
44D9E7 (base 16) Ubiquiti Networks, Inc.

A similar answer to the one of LilloX, but using nMap (if installed in the system):

luis@balanceador:~$ locate nmap-mac-prefixes
/usr/share/nmap/nmap-mac-prefixes
luis@balanceador:~$ grep 0024A5 -i /usr/share/nmap/nmap-mac-prefixes
0024A5 Buffalo

Supposedly working with any other program that stores OUI info, like airodump-ng-oui-update (to oui.txt file in this case), or several others:

• 
  /usr/share/btscanner/oui.txt


• /usr/share/bluelog/oui.txt


• /usr/share/ieee-data/oui.txt


• /usr/share/golismero/thirdparty_libs/netaddr/eui/oui.txt


• /usr/share/metasploit-framework/vendor/bundle/ruby/2.1.0/gems/packetfu-1.1.11/examples/oui.txt


• /etc/unicornscan/oui.txt


• /var/lib/ieee-data/oui.txt

I have written a script for updating oui and iab-files. Main-problem is, that the form of nmap-files is not the same as for btscan or arpwatch etc., they often have different forms (MAC-Address with double-points, with hyphens, without delimiters, upper cases, lower cases etc.

You could try this script, it is stored at https://github.com/burningfog/refresh_oui.

Please read the readme-file and if there are any questions give me a hint per mail please.
If there are other tools than named in github, please give me the path for the oui-file and some lines from this file so I can take a look on that form.

Greetings
Burning Fog

cat `locate nmap-mac-prefixes` | grep -i ^YOUR_OID_START

#!/bin/bash

arp -an | egrep -v incomplete | while read line ; do mac=$( echo $line | awk -F' ' 'print $4' | sed 's/:/-/g' | tr "[:lower:]" "[:upper:]" | cut -c 1-8 ) ; vendor=$( egrep "$mac" /usr/share/hwdata/oui.txt ) ; echo "$line : $vendor" ; done

Output:

? (192.168.88.36) at 60:03:08:a8:4e:86 [ether] on eth0 : 60-03-08 (hex) Apple, Inc.
? (192.168.88.38) at d8:8f:76:6f:59:0a [ether] on eth0 : D8-8F-76 (hex) Apple, Inc.