Identifying Network Vendors by MAC Address

by Oct 2, 2014

All PowerShell Versions

Each MAC address uniquely identifies a network device. The MAC address is assigned by a network equipment vendor. So you can backtrack the vendor from any MAC address.

All you need is the official IEEE vendor list which is more than 2MB in size. Here is a script that downloads the list for you:

$url = 'http://standards.ieee.org/develop/regauth/oui/oui.txt'
$outfile = "$home\vendorlist.txt"

Invoke-WebRequest -Uri $url -OutFile $outfile

Next, you can use the list to identify the vendor. Get some MAC addresses, for example like this:

PS> getmac

Physical Address    Transport Name                                            
=================== ==========================================================
5C-51-4F-62-F2-7D   \Device\Tcpip_{FF034A81-CBFE-4B11-9D81-FC8FC889A33C}      
5C-51-4F-62-F2-81   Media disconnected  

Take the first 3 octets of any MAC address, for example 5c-51-4f, and run these against the file you just downloaded:

PS> Get-Content -Path $outfile | Select-String 5c-51-4f -Context 0,6

>   5C-51-4F   (hex)        Intel Corporate
    5C514F     (base 16)        Intel Corporate
                    Lot 8, Jalan Hi-Tech 2/3
                  Kulim Hi-Tech Park
                  Kulim Kedah 09000
                  MALAYSIA
 

Not only will you get the vendor (Intel in this case), but also its address and location.

Twitter This Tip! ReTweet this Tip!