Update Arpwatch ethercodes.dat file from IEEE source

I was noticing that many of the Arpwatch notification messages coming back were marked "unknown" for the manufacturer name in the MAC address lookup. I looked at the date of the file in my Ubuntu file system and it was last updated in 2012. Arpwatch uses this file to determine the manufacturer name for a given MAC address prefix.

I found a script at this blog post which looked quite promising. A few simple transformations of the file downloaded direct from IEEE, updates from the comments on the blogpost and it was ready to go. I added in the lines to copy the files to the correct locations in Ubuntu's implementation of Arpwatch.

Here is the updated script:

Here are the basic steps and commands to do it on a terminal session.

1.Create the script using nano (copy and paste the script above) into a file called update_mac_addresses and then run it.
nano ~/update_mac_addresses.sh

2. Make it executable
chmod +x ~/update_mac_addresses.sh

3. Execute the script. Sudo is only needed to on the last step to copy to updated files to the right place in the files system.
sudo ./update_mac_addresses.sh


Resources:
http://jhjessup.blogspot.com/2010/04/update-mac-address-manufacturer-tables.html

Comments

  1. For anyone running across this now, several years after this post, the URL has changed for the script. Must edit the scripts wget line to read:

    wget http://standards-oui.ieee.org/oui/oui.txt

    ReplyDelete

Post a Comment

Popular posts from this blog

Moen 1225 Kitchen Faucet Cartridge Repair or Replacement

Outdoor Temperature - Waiting for Update Honeywell WiFI Thermostat (RTH9580WF)

Comcast Xfinity HD uDTA Pace DC60Xu Unboxing and Setup Instructions