Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

how to update ieee-oui.txt on macOS? #165

Open
luckman212 opened this issue Jul 13, 2023 · 6 comments
Open

how to update ieee-oui.txt on macOS? #165

luckman212 opened this issue Jul 13, 2023 · 6 comments

Comments

@luckman212
Copy link

luckman212 commented Jul 13, 2023

I've got arp-scan 1.10.0 on macOS 13.4.1. Installed via Homebrew.

I noticed today, for example, mac d8:b3:70 is not in the standard OUI db that comes with this version. I also noted there is a get-oui program that can update these db's. When I tried it, it failed with:

Can't locate LWP/UserAgent.pm in @INC (you may need to install the LWP::UserAgent module) (@INC contains: /opt/homebrew/opt/perl/lib/perl5/site_perl/5.36/darwin-thread-multi-2level /opt/homebrew/opt/perl/lib/perl5/site_perl/5.36 /opt/homebrew/opt/perl/lib/perl5/5.36/darwin-thread-multi-2level /opt/homebrew/opt/perl/lib/perl5/5.36 /opt/homebrew/lib/perl5/site_perl/5.36/darwin-thread-multi-2level /opt/homebrew/lib/perl5/site_perl/5.36) at /opt/homebrew/bin/get-oui line 31.
BEGIN failed--compilation aborted at /opt/homebrew/bin/get-oui line 31.

Ok, so researching that it seems my system needs Perl and also the LWP::UserAgent module. Off I went down a bit of a rabbit hole... involving sudo cpan followed by trying to install cpanm but failing, then eventually running sudo cpan followed by install LWP::UserAgent manually, which spit out a huge wall of text around 5,542 lines long of various spew, warnings and compilation.

Evenutally that ceased and it appeared I had the precious LWP::UserAgent module...so I tried again

$ get-oui
Can't locate Text/CSV.pm in @INC (you may need to install the Text::CSV module) (@INC contains: /opt/homebrew/opt/perl/lib/perl5/site_perl/5.36/darwin-thread-multi-2level /opt/homebrew/opt/perl/lib/perl5/site_perl/5.36 /opt/homebrew/opt/perl/lib/perl5/5.36/darwin-thread-multi-2level /opt/homebrew/opt/perl/lib/perl5/5.36 /opt/homebrew/lib/perl5/site_perl/5.36/darwin-thread-multi-2level /opt/homebrew/lib/perl5/site_perl/5.36) at /opt/homebrew/bin/get-oui line 32.
BEGIN failed--compilation aborted at /opt/homebrew/bin/get-oui line 32.

Ok, back to sudo cpan and then install Text::CSV...
another 700+ lines of text...

Then

$ get-oui
Could not get IAB data from https://standards-oui.ieee.org/iab/iab.csv

Here is where I gave up.
Does anyone know how to update this simple text file and put it in the correct place for arp-scan to find it?

Thank you 🙏

@luckman212
Copy link
Author

luckman212 commented Jul 13, 2023

I realized I could specify a custom MAC file via --macfile

So for now, I came up with this

UBNT_OUI_FILE='ubnt-ouis.txt'
IEEE_OUI_DB='https://standards-oui.ieee.org/oui/oui.txt'

#grab latest ouis
curl -Lso- "$IEEE_OUI_DB" |
awk 'BEGIN { FS="\t"; OFS="\t" } /hex.*Ubiquiti/ { print substr($1, 1, 8), $3}' >"$UBNT_OUI_FILE"

arp-scan \
  --interface en1 \
  --localnet \
  --plain \
  --macfile="$UBNT_OUI_FILE" |
grep Ubiquiti

Still would love to know if the original thing is possible...

@royhills
Copy link
Owner

Thanks for reporting this issue.

The easiest way to add a Mac address prefix is to edit the mac-vendor.txt file.

It looks like you are close to getting get-oui working. If you add a -v then hopefully it will tell you more about the error that it is encountering.

I realise the perl dependencies are a pain. Ideally arp-scan would move away from perl, but I've not found a better alternative so far.

@luckman212
Copy link
Author

Thank you. 🚀

For now, the small helper script above has got me sorted. I wish I knew more about Perl.

@littlewing7
Copy link

same problem on voidlinux: Could not get IAB data from https://standards-oui.ieee.org/iab/iab.csv

$ perl /usr/bin/get-oui -vvvv
Renaming ieee-oui.txt to ieee-oui.txt.bak
Opening ieee-oui.txt for output
Processing IEEE IAB registry data from https://standards-oui.ieee.org/iab/iab.csv
Could not get IAB data from https://standards-oui.ieee.org/iab/iab.csv

the perl script is this :
$ vim /usr/bin/get-oui
...

147    print "Processing IEEE $key registry data from $url\n" if $verbose;
148    my $ua = LWP::UserAgent->new;
149    my $res = $ua->get($url);
150    die "Could not get $key data from $url\n" unless $res->is_success;

the error is on $ua->get($url), but how to debug ?

Max

@sonikbhoom
Copy link

sonikbhoom commented Jan 8, 2025

hmmm. This one is interesting and I had the same problem... so I got more information by adding a print statement in the perl script between line 149 & 150

print $res->message . "\n";
print $res->status_line . "\n"

run:

└─$ sudo get-oui -v
Renaming ieee-oui.txt to ieee-oui.txt.bak
Opening ieee-oui.txt for output
Processing IEEE IAB registry data from https://standards-oui.ieee.org/iab/iab.csv
Protocol scheme 'https' is not supported (LWP::Protocol::https not installed)
501 Protocol scheme 'https' is not supported (LWP::Protocol::https not installed)
Could not get IAB data from https://standards-oui.ieee.org/iab/iab.csv

Uh-oh, I ran into packaging bug 115
I then installed the necessary perl modules:
(for me it was: perl-LWP-Protocol-https-6.14-1.fc40.noarch; I use Fedora)

but then I got:

└─$ sudo /usr/sbin/get-oui -vvvv 
Renaming ieee-oui.txt to ieee-oui.txt.bak
Opening ieee-oui.txt for output
Processing IEEE IAB registry data from https://standards-oui.ieee.org/iab/iab.csv
Unknown Code
418 Unknown Code
Could not get IAB data from https://standards-oui.ieee.org/iab/iab.csv

Oh no... which is the "IMATEAPOT" error. pfft I have to keep digging..

The HTTP 418 status code, also known as the "I'm a Teapot" error, indicates that a request to a web browser endpoint has failed:

Explanation
The error code references RFC 2324, which contains the Hyper Text Coffee Pot Control Protocol (HTCPCP). The error code was defined in 1998 as an IETF April Fools' joke. It's not expected to be implemented by actual HTTP servers. 

Meaning
The error code indicates that the server refuses to brew coffee because it's permanently a teapot.
Use
Some websites use this response for requests they don't want to handle, such as automated queries.

I feel like perhaps the server is getting grumpy at the script. Maybe I can spoof the user agent with some success.

@sonikbhoom
Copy link

soooo... Looks like ieee.org is rejecting the LWP User agent

149    my $ua = LWP::UserAgent->new(ssl_opts => {
150            SSL_cipher_list => '',
151    }); # I added this to allow all the Ciphers available; it is not needed, but might be useful for debugging
152    $ua->agent("Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"); # pretend to be Firefox 133
153    my $res = $ua->get($url);
154    print $res->message . "\n";
155    print $res->status_line . "\n";

Let's run it...

└─$ sudo  /usr/sbin/get-oui -vvvv
Renaming ieee-oui.txt to ieee-oui.txt.bak
Opening ieee-oui.txt for output
Processing IEEE IAB registry data from https://standards-oui.ieee.org/iab/iab.csv
OK
200 OK
	Downloaded 381906 bytes
	4575 IAB entries written to ieee-oui.txt
Processing IEEE MAM registry data from https://standards-oui.ieee.org/oui28/mam.csv
OK
200 OK
	Downloaded 638989 bytes
	5664 MAM entries written to ieee-oui.txt
Processing IEEE OUI registry data from https://standards-oui.ieee.org/oui/oui.csv
OK
200 OK
	Downloaded 3471112 bytes
	36745 OUI entries written to ieee-oui.txt
Processing IEEE OUI36 registry data from https://standards-oui.ieee.org/oui36/oui36.csv
OK
200 OK
	Downloaded 579999 bytes
	6307 OUI36 entries written to ieee-oui.txt

Total of 53291 MAC/Vendor mappings written to ieee-oui.txt

┌──16:40:46 (sonik💀tomahawk13)-[~]
└─$

Oops it is because ieee.org is rejecting LWP User agent ( libwww-perl/6.77 )

/sonik

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants