Ask Your Question

Mac Address and Network Interface

asked 2021-03-16 18:56:21 +0000

AG111 gravatar image

Can Wireshark automatically extract the Network Interface Card vendor from the MAC address alone? How is this possible?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2021-03-17 15:22:58 +0000

grahamb gravatar image

The first three octets of the MAC address (if not locally assigned) are the vendor code, Wireshark uses an internal list compiled from a number of sources, see the header of the manuf file.

edit flag offensive delete link more


To add some detail to this: Ethernet NIC manufacturers must acquire ranges of MAC addresses that they are allowed to use. E.g., if I wanted to sell Ethernet NICs I'd have to request a range of MAC addresses which I could use in my NICs.

This MAC address range -> Vendor information is publicly available; Wireshark gathers this publicly available information into the manuf file Graham mentioned.

JeffMorriss gravatar imageJeffMorriss ( 2021-03-17 17:42:53 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-03-16 18:56:21 +0000

Seen: 417 times

Last updated: Mar 17 '21