The first three octets of the MAC address (if not locally assigned) are the vendor code, Wireshark uses an internal list compiled from a number of sources, see the header of the manuf file.
