Duplicate MAC prefixes in nmap-mac-prefixes

[David Fifield]

I found that there are some duplicate prefixes in nmap-map-prefixes.

0001C8 Thomas Conrad
0001C8 Conrad

080030 Network Research
080030 Cern
080030 Royal Melbourne Inst OF Tech

Their presence is harmless. When looking up a vendor by prefix, the
first one listed will win. When looking up a prefix by vendor string (as
with the --spoof-mac option), usually the first one will win, but there
is a slight chance that a later one will win, if the linear probing in
the hash table that stores the information wraps around the end of the
table.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/

[DePriest, Jason R.]

I know this isn't unique to nmap.

What is the benefit of the IEEE assigning multiple vendors to the same
vendor prefix?

Did this issue slowly arise from companies being purchased by other
companies or going out of business?

It doesn't make sense that something that is supposed to be unique by
vendor isn't actually unique by vendor.

Again, I realize that this isn't something nmap can fix, I just want
to understand why we have this problem in the first place.

Thanks.

-Jason

On Wed, Nov 11, 2009 at 9:30 PM, David Fifield <> wrote:

> I found that there are some duplicate prefixes in nmap-map-prefixes.
>
> 0001C8 Thomas Conrad
> 0001C8 Conrad
>
> 080030 Network Research
> 080030 Cern
> 080030 Royal Melbourne Inst OF Tech
>
> Their presence is harmless. When looking up a vendor by prefix, the
> first one listed will win. When looking up a prefix by vendor string (as
> with the --spoof-mac option), usually the first one will win, but there
> is a slight chance that a later one will win, if the linear probing in
> the hash table that stores the information wraps around the end of the
> table.
>
> David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/

[Fyodor]

On Wed, Nov 11, 2009 at 09:58:47PM +0000, DePriest, Jason R. wrote:
> I know this isn't unique to nmap.
>
> What is the benefit of the IEEE assigning multiple vendors to the same
> vendor prefix?

I'm guessing it is an accident.  Out of more than 13,000 assignments,
only the two that David mentioned have duplicates.  You can see them
in the original file (http://standards.ieee.org/regauth/oui/oui.txt), like:

00-01-C8   (hex) THOMAS CONRAD CORP.
0001C8     (base 16) THOMAS CONRAD CORP.
                                1908-R KRAMER LANE
                                AUSTIN TX 78758
                                UNITED STATES

00-01-C8   (hex) CONRAD CORP.
0001C8     (base 16) CONRAD CORP.

> It doesn't make sense that something that is supposed to be unique by
> vendor isn't actually unique by vendor.

Someone on nmap-dev posted about how he was able to get the IEEE to
change the oui.txt file to use consistent capitalization for a certain
company earlier this year.  So it is possible that if someone contacts
the IEEE, they can get these duplicates removed too.

Cheers,
-F
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/