How to Lookup OUI (Organizationally Unique Identifier) In Linux?

Network switches or Layer 2 technology Ethernet protocol uses MAC addresses in order to transfer frames between systems. MAC addresses are 48-bit value. This 48-bit value contains the device manufacturer ID as the first 24 bit. In this tutorial we will learn how to look, search and find the Organizationally Unique Identifier in Linux distributions like Ubuntu, Debian, Mint, Kali, Fedora, CentOS, RHEL, etc.

Mac Address

As stated in the previous part MAC address is used to address and route Ethernet frames. MAC address consists of a 48-bit value and simply expressed as the hexadecimal format. Here is an example of MAC Address.

00:50:56:c0:00:4b

OUI (Organizationally Unique Identifier)

OUI or Organizationally Unique Identifier is the first 24 bit or 6 hexadecimal value of the MAC address. IEEE is responsible for the OUI in MAC addresses. They provide the Ethernet card manufacturer company. In the previous example 00:50:56 is OUI of the MAC address.

Print MAC Address

First, we will start by printing the MAC address of the system. There are a lot of commands those have used to print MAC address but the ip link command is the easiest way.

$ ip link

Find OUI with get-oui Command

get-oui command is the most popular way to learn OUI . It is provided by arp-scan package. We can install arp-scan package like below.

Ubuntu, Debian, Mint, Kali

$ sudo apt install arp-scan -y

Fedora, CentOS, RHEL

$ sudo yum install arp-scan

Find OUI with ieee-data

ieee-data is another package which provides the oui.txt file . We can install this with the following commands

Ubuntu, Debian, Mint, Kali

$ sudo apt install ieee-data/bionic

Fedora, CentOS, RHEL

$ sudo yum install ieee-data

Search and Look For OUI In oui.txt

Installing previously explianed commands will create a file named oui.txt in the /usr/share/ieee-data/oui.txt this file provides the OUI data.

Lets look into oui.txt file to learn its format.

$ less /usr/share/ieee-data/oui.txt

As we can see the first column is about OUI and the second column provides the organization name and the address of the organization. OUI is written in two formats first one is dash-separated and the other is without a separator.

B4-99-BA   (hex)                 
B499BA     (base 16)

Lookup Using Less

We will lookup using less command provided by Linux system. We will open the oui.txt file and search with /

$ less /usr/share/ieee-data/oui.txt

AND then put the OUI . In this example we search for 00179A or 00-17-9A

/00179A

OR

/00-17-9A

Lookup Using Grep

We can also use grep command to search and filter OUI. We will provide the OUI part and the oui.txt file as below. In this example, we will search for 00179A or 00-17-9A

$ grep 00179A  /usr/share/ieee-data/oui.txt

OR

$ grep 00-17-9A  /usr/share/ieee-data/oui.txt

Lookup Using Nmap Mac Prefixes File

nmap is a popular network scanner which provides a lot of features. One of them is the OUI information. OUI information is stored in a file /usr/share/nmap/nmap-mac-prefixes . We can search for a given OUI in this file with the grep command. First we need to install nmap package if it is not installed.

Ubuntu, Debian, Mint, Kali:

$ sudo apt install nmap

Fedora, CentOS, RHEL:

$ sudo yum install nmap

Now we will search with grep the OUI 0024A5 in this case.

$ grep 0024A5  /usr/share/nmap/nmap-mac-prefixes