how to update ieee-oui.txt on macOS?

[luckman212]

I've got arp-scan 1.10.0 on macOS 13.4.1. Installed via Homebrew.

I noticed today, for example, mac d8:b3:70 is not in the standard OUI db that comes with this version. I also noted there is a get-oui program that can update these db's. When I tried it, it failed with:

Can't locate LWP/UserAgent.pm in @INC (you may need to install the LWP::UserAgent module) (@INC contains: /opt/homebrew/opt/perl/lib/perl5/site_perl/5.36/darwin-thread-multi-2level /opt/homebrew/opt/perl/lib/perl5/site_perl/5.36 /opt/homebrew/opt/perl/lib/perl5/5.36/darwin-thread-multi-2level /opt/homebrew/opt/perl/lib/perl5/5.36 /opt/homebrew/lib/perl5/site_perl/5.36/darwin-thread-multi-2level /opt/homebrew/lib/perl5/site_perl/5.36) at /opt/homebrew/bin/get-oui line 31.
BEGIN failed--compilation aborted at /opt/homebrew/bin/get-oui line 31.

Ok, so researching that it seems my system needs Perl and also the LWP::UserAgent module. Off I went down a bit of a rabbit hole... involving sudo cpan followed by trying to install cpanm but failing, then eventually running sudo cpan followed by install LWP::UserAgent manually, which spit out a huge wall of text around 5,542 lines long of various spew, warnings and compilation.

Evenutally that ceased and it appeared I had the precious LWP::UserAgent module...so I tried again

$ get-oui
Can't locate Text/CSV.pm in @INC (you may need to install the Text::CSV module) (@INC contains: /opt/homebrew/opt/perl/lib/perl5/site_perl/5.36/darwin-thread-multi-2level /opt/homebrew/opt/perl/lib/perl5/site_perl/5.36 /opt/homebrew/opt/perl/lib/perl5/5.36/darwin-thread-multi-2level /opt/homebrew/opt/perl/lib/perl5/5.36 /opt/homebrew/lib/perl5/site_perl/5.36/darwin-thread-multi-2level /opt/homebrew/lib/perl5/site_perl/5.36) at /opt/homebrew/bin/get-oui line 32.
BEGIN failed--compilation aborted at /opt/homebrew/bin/get-oui line 32.

Ok, back to sudo cpan and then install Text::CSV...
another 700+ lines of text...

Then

$ get-oui
Could not get IAB data from https://standards-oui.ieee.org/iab/iab.csv

Here is where I gave up.
Does anyone know how to update this simple text file and put it in the correct place for arp-scan to find it?

Thank you 🙏

[luckman212]

I realized I could specify a custom MAC file via --macfile

So for now, I came up with this

UBNT_OUI_FILE='ubnt-ouis.txt'
IEEE_OUI_DB='https://standards-oui.ieee.org/oui/oui.txt'

#grab latest ouis
curl -Lso- "$IEEE_OUI_DB" |
awk 'BEGIN { FS="\t"; OFS="\t" } /hex.*Ubiquiti/ { print substr($1, 1, 8), $3}' >"$UBNT_OUI_FILE"

arp-scan \
  --interface en1 \
  --localnet \
  --plain \
  --macfile="$UBNT_OUI_FILE" |
grep Ubiquiti

Still would love to know if the original thing is possible...

[royhills]

Thanks for reporting this issue.

The easiest way to add a Mac address prefix is to edit the mac-vendor.txt file.

It looks like you are close to getting get-oui working. If you add a -v then hopefully it will tell you more about the error that it is encountering.

I realise the perl dependencies are a pain. Ideally arp-scan would move away from perl, but I've not found a better alternative so far.

[luckman212]

Thank you. 🚀

For now, the small helper script above has got me sorted. I wish I knew more about Perl.