Update Arpwatch ethercodes.dat file from IEEE source
I was noticing that many of the Arpwatch notification messages coming back were marked "unknown" for the manufacturer name in the MAC address lookup. I looked at the date of the file in my Ubuntu file system and it was last updated in 2012. Arpwatch uses this file to determine the manufacturer name for a given MAC address prefix.
I found a script at this blog post which looked quite promising. A few simple transformations of the file downloaded direct from IEEE, updates from the comments on the blogpost and it was ready to go. I added in the lines to copy the files to the correct locations in Ubuntu's implementation of Arpwatch.
Here is the updated script:
Here are the basic steps and commands to do it on a terminal session.
1.Create the script using nano (copy and paste the script above) into a file called update_mac_addresses and then run it.
2. Make it executable
3. Execute the script. Sudo is only needed to on the last step to copy to updated files to the right place in the files system.
Resources:
http://jhjessup.blogspot.com/2010/04/update-mac-address-manufacturer-tables.html
I found a script at this blog post which looked quite promising. A few simple transformations of the file downloaded direct from IEEE, updates from the comments on the blogpost and it was ready to go. I added in the lines to copy the files to the correct locations in Ubuntu's implementation of Arpwatch.
Here is the updated script:
Here are the basic steps and commands to do it on a terminal session.
1.Create the script using nano (copy and paste the script above) into a file called update_mac_addresses and then run it.
nano ~/update_mac_addresses.sh
2. Make it executable
chmod +x ~/update_mac_addresses.sh
3. Execute the script. Sudo is only needed to on the last step to copy to updated files to the right place in the files system.
sudo ./update_mac_addresses.sh
Resources:
http://jhjessup.blogspot.com/2010/04/update-mac-address-manufacturer-tables.html
For anyone running across this now, several years after this post, the URL has changed for the script. Must edit the scripts wget line to read:
ReplyDeletewget http://standards-oui.ieee.org/oui/oui.txt
Thanks for the update
Delete