I Built the Most Comprehensive MAC Address Database on the Internet — Then Doubled Kismet's Knowledge Base
86,098 Vendors. 8 Data Sources. 10 Output Formats. And a Pull Request That More Than Doubled the Device Identification of the World's Most Important Wireless Security Tool.
Every Device Has a Fingerprint
Every network device on planet Earth — every router, every phone, every laptop, every smart toaster, every Bluetooth-connected anything — has a MAC address. A 48-bit hardware identifier burned into the network interface at the factory. And the first three octets of that MAC address tell you exactly who manufactured it.
That prefix is called the OUI — Organizationally Unique Identifier. It’s assigned by the IEEE (Institute of Electrical and Electronics Engineers). Cisco owns 00:00:0C. Apple owns A4:83:E7. Samsung, Intel, Huawei, TP-Link — every manufacturer that builds network hardware has registered their prefixes with the IEEE.
When you wardrive a city and capture 50,000 BSSIDs, the OUI tells you the manufacturer of every single access point. When you scan a network and see a device at 00:17:88:XX:XX:XX, the OUI tells you it’s a Philips Hue bridge. When a Bluetooth device advertises its MAC, the OUI tells you if it’s a Fitbit, an AirTag, or a Tesla.
OUI lookup is the backbone of device identification. And until I built the OUI Master Database, every available source was incomplete.
The Problem: Fragmented Data
The IEEE maintains the official registry. You can download it. It’s got about 56,430 entries across five different registries:
MA-L (Large) — 38,630 entries. The traditional 24-bit OUI. Each block covers ~16 million addresses. This is what most people think of when they say “OUI.”
MA-M (Medium) — 6,189 entries. 28-bit blocks, ~1 million addresses each.
MA-S (Small) — 6,827 entries. 36-bit blocks, ~4,096 addresses each.
IAB (Individual Address Block) — 4,575 entries. Legacy program, no longer accepting applications.
CID (Company ID) — 209 entries. Identifiers that aren’t meant for network traffic.
56,430 vendors. Sounds comprehensive. It’s not.
The problem is that not every manufacturer registers with IEEE. Some use MAC addresses from ODM (Original Design Manufacturer) partners. Some devices use randomized MACs. Some small manufacturers just never bothered with the paperwork. And the IEEE registry only tells you who registered the prefix — it doesn’t include all the vendors that security tools have discovered in the wild through decades of real-world scanning.
That’s where the community databases come in:
Wireshark’s manuf file — 55,963 entries. Maintained by the Wireshark project for packet analysis. Cross-validated entries with short names for display. Contains vendors that Wireshark contributors have identified through protocol analysis.
Nmap’s nmap-mac-prefixes — 49,058 entries. Built from network scanning data. Contains vendors that Nmap users have discovered through active and passive scanning across the internet.
HDM Mac-Tracker — 56,543 entries. Maintained by HD Moore (creator of Metasploit). Historical registration dates that no other source tracks.
Each source knows things the others don’t. Each source has entries that exist nowhere else. And nobody had ever merged them all into one.
The Build: One Master List to Rule Them All
I built a merge engine in Node.js that downloads all eight data sources, normalizes the data, deduplicates, cross-references, and outputs a single master database.
The Merge Logic
IEEE is the base layer. All five registries are parsed, normalized to a common format with full manufacturer name, address, registry type, and country code.
Wireshark enriches. For every OUI that already exists from IEEE, Wireshark adds a short name (useful for display in tools). For OUIs that exist only in Wireshark, they’re added as new entries. The merge prefers the longer manufacturer name between sources.
Nmap fills gaps. Same merge logic — existing entries get cross-referenced, new entries get added. Nmap’s real-world scanning data catches vendors that both IEEE and Wireshark miss.
HDM adds history. Registration dates from HD Moore’s tracker get layered onto matching entries. This lets you see when a manufacturer first registered their OUI — useful for identifying legacy vs modern hardware.
Device type classification. Every entry gets automatically categorized using pattern matching against the manufacturer name. Over 20 categories: Router, Switch, Access Point, Phone, Computer, Camera, IoT, Smart Home, Medical, Automotive, Industrial, VoIP, and more. Cisco gets tagged as “Router.” Apple gets tagged as “Phone.” Hikvision gets tagged as “Camera.”
Country extraction. The IEEE includes company addresses as free text. The merge engine parses this with 40+ regex patterns to extract ISO country codes. This lets you answer questions like “how many OUI registrations come from China vs the United States.”
The Result
86,098 unique OUI entries. That’s a 53% increase over IEEE alone. 75,353 of those entries are confirmed by multiple sources — same OUI validated independently by IEEE, Wireshark, and/or Nmap.
Every entry includes:
OUI prefix — The MAC address prefix (e.g.,
00:00:0C)Full manufacturer name — The complete registered name
Short name — Abbreviated (e.g., “Cisco” instead of “Cisco Systems, Inc”)
Registry type — MA-L, MA-M, MA-S, IAB, or CID
Device type — Automatically classified category
Country code — Extracted from IEEE address data
Registration date — When the OUI was first assigned (from HDM)
Sources — Which databases confirmed this entry (e.g., “IEEE+Wireshark+Nmap”)
10 Output Formats
One database. Every format you could need:
TXT (2.43 MB) — Simple
OUI → Manufacturerpairs. Grep-friendly.CSV (9.05 MB) — Full data with all fields. Spreadsheet-ready.
TSV (5.47 MB) — Tab-separated. Excel/Google Sheets compatible.
JSON (25.52 MB) — Pretty-printed. API-ready. Human-readable.
JSON compact (19.52 MB) — Minified. Fast loading for scripts.
XML (18.67 MB) — Enterprise/Java integration.
SQLite (18.08 MB) — Ready-to-query database with indexes.
SQL (11.30 MB) — Import script for PostgreSQL, MySQL, Cloudflare D1.
Kismet manuf (2.60 MB) — Kismet’s native manufacturer format.
Kismet manuf.gz (0.60 MB) — Gzipped, drop-in Kismet install.
Every format is regenerated from the same master merge. Nothing is stale. Nothing is manually maintained.
The Automation
A GitHub Actions workflow runs on the 1st of every month. It downloads fresh copies of all eight sources, runs the full merge, updates the counts in the documentation, commits, and pushes. The database stays current without me touching it.
IEEE updates their registries regularly as new manufacturers register. Wireshark and Nmap update as their communities discover new vendors. The monthly automation ensures the master database always reflects the latest from all sources.
The CLI Tool
The OUI Master Database includes a cross-platform CLI tool that goes beyond simple lookups:
MAC lookup — Feed it any MAC address, get the manufacturer, device type, country, registration date, and which sources confirmed it.
Manufacturer search — Search by company name. Find all OUIs registered to “Huawei” or “Cisco” or “Samsung.”
Live WiFi scan — Triggers a real WiFi scan on your machine, captures nearby access point BSSIDs, and resolves every one to its manufacturer. Works on Windows (
netsh), Linux (nmcli), and macOS (airport).Live Bluetooth scan — Discovers nearby Bluetooth devices and identifies their manufacturers via OUI.
ARP table lookup — Reads your local ARP cache and identifies every device on your network by manufacturer.
Stats — Database breakdown by device type, country, registry, and source.
File import — Feed it any text file containing MAC addresses. It extracts every MAC and resolves them all.
The Web Interface
A GitHub Pages deployment provides instant browser-based OUI lookup. Load the page, type a MAC address or manufacturer name, get results in milliseconds. All 86,098 entries load client-side from the minified JSON — no server, no API calls, no latency.
Five cinema-themed visual skins because looking up MAC addresses should have style: Dark Night, Sin City, Kill Bill, Grindhouse, and From Dusk Till Dawn.
The Kismet Contribution: Doubling the Knowledge Base
This is the part of the story I’m most proud of.
Kismet is the most important wireless security tool in existence. It’s the open-source wireless intrusion detection system and network monitoring framework that security professionals, wardrivers, and researchers have relied on for over two decades. Created by Mike Kershaw (dragorn), Kismet is the foundation of serious wireless security work.
Kismet uses a manufacturer database to identify devices by their MAC address OUI. When you’re monitoring a network and see a device connect, Kismet tells you “that’s a Cisco AP” or “that’s a Samsung phone” or “that’s a Hikvision camera” based on the OUI lookup.
Kismet’s manufacturer database had 37,974 entries.
I submitted Pull Request #582 to the official Kismet repository: “Update OUI manufacturer database to 86,098 entries.”
That’s a 127% increase in device identification coverage.
But I didn’t just submit a data file. Mike Kershaw’s feedback was that Kismet’s OUI database is generated by a Python script (tools/create_oui_db.py) that runs as part of the release build process. Package maintainers need to generate fresh databases. The release pipeline needs it automated. A static data file wouldn’t cut it.
So I rewrote Kismet’s OUI fetch script. The new create_oui_db.py pulls from all seven sources (5 IEEE registries + Wireshark + Nmap), merges them using the same logic as the master database, and outputs Kismet’s native format. Now every Kismet build gets the full 86,098-entry database automatically.
When Mike merged it, he noted something interesting — my multi-source merge accidentally exposed a pre-existing bug in Kismet’s original fetcher that was creating duplicate OUI entries. The old single-source approach had been silently generating duplicates that nobody caught until a proper merge engine highlighted the discrepancies.
PR #582 was merged on January 17, 2026. The OUI Master Database now powers Kismet’s manufacturer lookups. Every Kismet installation worldwide now benefits from the same multi-source merge that started as a personal project.
Why OUI Matters Beyond Lookups
The OUI database isn’t just a lookup table. It’s a lens for understanding the wireless world:
Network Security Auditing
When you scan a corporate network and find devices with OUIs registered to consumer IoT manufacturers — Tuya, Espressif, Shenzhen Bilian — those are unauthorized smart home devices on an enterprise network. Shadow IT. Potential attack surface.
Wardriving Intelligence
When I wardrive a city with 50,000 captured BSSIDs, the OUI data tells me the manufacturer distribution. Which neighborhoods are dominated by TP-Link consumer routers vs Ubiquiti enterprise gear vs Cisco Meraki managed networks. The manufacturer profile of a neighborhood tells you its economic profile, its technical sophistication, and its security posture.
IoT Discovery
The explosive growth of IoT has created an OUI explosion. Espressif Systems (makers of the ESP32) alone has registered dozens of OUI prefixes. Every smart bulb, smart plug, smart speaker, and smart sensor has a MAC address with an identifiable manufacturer. The OUI database is the index to the Internet of Things.
Historical Analysis
With registration dates from HDM’s tracker, you can analyze when manufacturers entered the market, when they registered additional blocks (indicating growing sales), and when registration activity in certain countries spiked. It’s a historical record of the hardware industry’s expansion.
Device Fingerprinting
Combined with other passive indicators — signal strength patterns, beacon intervals, supported rates, capability flags — the OUI provides the first layer of device fingerprinting. Knowing the manufacturer narrows the device type, which informs the security assessment.
The Numbers
86,098 unique OUI entries
8 data sources merged (5 IEEE + 3 community)
75,353 entries confirmed by multiple sources
10 output formats generated
20+ device type categories
40+ country code patterns
28 GitHub stars
Monthly automated updates via GitHub Actions
127% increase to Kismet’s manufacturer database
PR #582 merged into Kismet — the wireless security tool used worldwide
Open Source
The OUI Master Database is MIT licensed. The data, the merge engine, the CLI tool, the web interface, and the automation are all public. Use it. Build on it. Integrate it into your tools.
One master list to rule them all.
Ringmast4r — The WarLord Founder of #wardriving | WiGLE Rank #157 | Kismet Contributor
OUI-Master-Database: https://github.com/Ringmast4r/OUI-Master-Database