Suggestion: print "locally administered" instead of "Unknown" for qualifying OUIs

[sanderjo]

arp-scan now prints "(Unknown)" for locally administered addresses / OUIs (so: with the second-least-significant bit of the first octet of the address set to 1 , see https://en.wikipedia.org/wiki/MAC_address#Universal_vs._local)

I think it would be better if arp-scan would print "(Unknown: locally administered)". That would avoid that people (like me) would search for an updated OUI list...

With three lines of C code in arp-scan.c I was able to achieve this. See below.

So:

• would you like to add this feature to arp-scan?
• if so, shall I send a PR?

Old:

sander@netbook:~/git/arp-scan$ sudo ./arp-scan --localnet --interface=eth1
Interface: eth1, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9.5 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.0.1	64:d1:a3:1d:76:33	Sitecom Europe BV
192.168.0.108	02:01:9c:45:40:2d	(Unknown)
192.168.0.111	00:11:32:15:7f:60	Synology Incorporated
192.168.0.117	18:f4:6a:9c:ce:d4	Hon Hai Precision Ind. Co.,Ltd.
192.168.0.105	ac:cf:23:12:1d:85	Hi-flying electronics technology Co.,Ltd
192.168.0.117	18:f4:6a:9c:ce:d4	Hon Hai Precision Ind. Co.,Ltd. (DUP: 2)

6 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.5: 256 hosts scanned in 4.755 seconds (53.84 hosts/sec). 6 responded

New:

sander@netbook:~/git/arp-scan$ sudo ./arp-scan --localnet --interface=eth1
Interface: eth1, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9.5 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.0.1	64:d1:a3:1d:76:33	Sitecom Europe BV
192.168.0.108	02:01:9c:45:40:2d	(Unknown: locally administered)
192.168.0.111	00:11:32:15:7f:60	Synology Incorporated
192.168.0.117	18:f4:6a:9c:ce:d4	Hon Hai Precision Ind. Co.,Ltd.
192.168.0.105	ac:cf:23:12:1d:85	Hi-flying electronics technology Co.,Ltd

5 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.5: 256 hosts scanned in 4.614 seconds (55.48 hosts/sec). 5 responded

[royhills]

That's a good idea. A PR would be appreciated.

[sanderjo]

Hi @royhills, did you see my PR? Is it OK for you?

[sanderjo]

Solved with #26