Verify MAC Harware vendors against OUI

[jsarcand]

Hi, In order to determine subsets of vendors connecting to Lyrion - directly or through plugins - it would be interesting to validate the vendors against the MAC address of the endpoints.

1- A OUI file can be bundled from the IEEE website
2- The following code should work (Replace 'path/to/oui.txt' with the actual path to the OUI file)

use strict;
use warnings;

#Function to get manufacturer from MAC address
sub get_manufacturer {
    my ($mac) = @_;
    
    # Normalize MAC address
    $mac =~ s/[:-]//g;  # Remove colons or dashes
    my $oui = substr($mac, 0, 6);  # Get the first 6 characters (OUI)

    # Open the OUI file
    open my $fh, '<', 'path/to/oui.txt' or die "Could not open OUI file: $!";
    
    while (my $line = <$fh>) {
        if ($line =~ /^\s*($oui)\s+/) {
            close $fh;
            return $line;  # Return the line containing the manufacturer
        }
    }
    
    close $fh;
    return "Manufacturer not found";
}

# Example MAC address
my $mac_address = '00:1A:2B:3C:4D:5E';
my $manufacturer = get_manufacturer($mac_address);
print "Manufacturer: $manufacturer\n";

[michaelherger]

Thanks for the suggestion. But what insight would we get? Half of my non-original hardware is not recognized, some is Pi (which we already know), and the rest are generic NIC vendor names ("Edimax"). And I believe the bridge plugins even create random virtual MAC addresses... I actually already use those to recognize those bridges 😁 (https://github.com/LMS-Community/slimserver/blob/public/9.0/Slim/Plugin/Analytics/Plugin.pm#L225).

[jsarcand]

Edimax, aren't these WIIM devices?

I haven't realized the bridge plugins did create a virtual MAC address. I guess until it's corrected, if ever, we're missing valuable data. At present time, it's about 20k devices from 3rd parties we don't particularly know anything about.

The goal was to pinpoint what brands were being used through these plugins, understand the usage and determine the point of failure in the associated operations.

I rekon Philippe Could use it to auto-assign a profile to the the endpoints, it could save him some support time but this is another subject.

[michaelherger]

I don't know about the bridge plugins, whether they would see the devices' MAC addresses.

And no, Edimax isn't a WIIM in my case. But that probably shows perfectly how little that information says: the MAC address is tied to the network device manufacturer - which can be different from the device. In my case it's a Pi 2 with a USB wifi dongle.

[philippe44]

The bridge plugin tries to use the devices mac but it fails most of the time and then creates a fake address, which I confess, is not even in the range of local non-allocable Mac's. It's aa:... for AirPlay, cc:... for CC and bb:... for UPnP