Mac Address and Network Interface
Can Wireshark automatically extract the Network Interface Card vendor from the MAC address alone? How is this possible?
1 Answer
- Sort by
oldest newest most voted
0
The first three octets of the MAC address (if not locally assigned) are the vendor code, Wireshark uses an internal list compiled from a number of sources, see the header of the manuf file.
Comments
To add some detail to this: Ethernet NIC manufacturers must acquire ranges of MAC addresses that they are allowed to use. E.g., if I wanted to sell Ethernet NICs I'd have to request a range of MAC addresses which I could use in my NICs.
This MAC address range -> Vendor information is publicly available; Wireshark gathers this publicly available information into the manuf file Graham mentioned.
Your Answer
Please start posting anonymously - your entry will be published after you log in or create a new account.
This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.
Comments