Cross-platform JavaScript Dataset Networking - MAC address manufacturer lookup database combining IEEE, Nmap, Wireshark and HDM Mac-Tracker, with downloadable formats and a browser lookup.
Project website / live view
---
> what_is_this
ringmast4r@github:~$ cat oui-master-db.txt
PURPOSE: MAC address vendor lookup, the comprehensive way
SCOPE: Every IEEE registry + Wireshark + Nmap + HDM Mac-Tracker
COVERAGE: 59,237 unique OUIs, 110,729 cross-validated entries
FORMATS: TXT, CSV, TSV, JSON, JSON-min, XML, SQLite, SQL, Kismet, Kismet.gz
UPDATES: First of every month via GitHub Actions
USE CASES: Wardriving | Network forensics | IoT discovery | Threat intel
STATUS: [ LIVE & AUTO-UPDATING ]
OUI = the first 3 bytes of a MAC address that identifies the manufacturer.
Most lookup databases pick one source. We merged all of them.---
> stats --live
| METRIC | COUNT | NOTES |
|:------:|:-----:|:-----:|
| Total Unique OUIs |
---
59,237 | Deduplicated across 4 sources |
| Cross-Validated | 110,729 | Same OUI from multiple sources |
| IEEE Registry Total | 59,142 | MA-L + MA-M + MA-S + IAB + CID |
| Device Categories | 25 | Auto-classified |
| File Formats | 10 | TXT to SQLite |
| Monthly New OUIs | ~-22403 | IEEE assignments |
> growth --monthly
%%{init: {'theme':'dark', 'themeVariables': {'xyChart': {'backgroundColor':'#00000000','plotColorPalette':'#1E40AF','titleColor':'#1E40AF','xAxisLabelColor':'#ffffff','yAxisLabelColor':'#ffffff'}}}}%%
xychart-beta
title "OUI Count Growth (Last 6 Auto-Updates)"
x-axis ["2026-09-21", "2026-09-30", "2026-10-01", "2026-10-11", "2026-10-21", "2026-11-01"]
y-axis "Total OUIs" 58800 --> 90400
bar [90281, 58972, 58997, 59065, 59134, 59237]
line [90281, 58972, 58997, 59065, 59134, 59237]+-31,044 OUIs in ~6 weeks · IEEE assigns roughly -22,403 new vendors/month · Next refresh: first of next month
> sources --breakdown
%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pie6':'#1E3A8A','pieTitleTextSize':'18px','pieLegendTextSize':'14px'}}}%%
pie showData
title Where Each OUI Comes From
"All 3 (IEEE+Wireshark+Nmap)" : 51666
"IEEE+Wireshark" : 6979
"IEEE+Nmap" : 415
"mac-tracker" : 94
"IEEE only" : 79
"Nmap only" : 451,666 OUIs (87%) are confirmed by all three primary sources. The remaining single-source entries fill gaps that no individual database would catch on its own. That's the point.
Source Roster
| SOURCE | ENTRIES | LICENSE | URL | |:-------|:-------:|:-------:|:----| | !IEEE |59,142 | Public Domain | standards-oui.ieee.org |
| !Wireshark | 58,645 | GPLv2 | wireshark.org |
| !Nmap | 52,085 | GPLv2 (mod.) | nmap-mac-prefixes |
| !HDM | 59,260 | MIT | hdm/mac-tracker |
---
> registries --ieee
%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pieTitleTextSize':'18px','pieLegendTextSize':'14px'}}}%%
pie showData
title IEEE Registry Distribution (59,142 entries)
"MA-L (Large, ~16M each)" : 40426
"MA-S (Small, ~4K each)" : 7253
"MA-M (Medium, ~1M each)" : 6664
"IAB (Individual Block)" : 4575
"CID (Company ID)" : 22440,426 | 24-bit (~16M MACs) | Large-scale manufacturers |
| MA-S | 7,253 | 36-bit (~4K MACs) | IoT, niche hardware |
| MA-M | 6,664 | 28-bit (~1M MACs) | Mid-volume vendors |
| IAB | 4,575 | Individual | Legacy individual blocks |
| CID | 224 | Company-only ID | Non-MAC company markers |
> classification --devices
⚠ IEEE doesn't expose device category. Our classifier is a heuristic on company name +
known-vendor lookups, so only 30,970 of 59,237 OUIs (52.3%) get a category. The
remaining 28,267 stay Unclassified rather than guessed.
%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pie6':'#1E3A8A','pie7':'#00D4FF','pie8':'#9FEF00','pie9':'#FF00FF','pie10':'#8B5CF6','pie11':'#FF6B6B','pie12':'#00FF88','pieTitleTextSize':'16px','pieLegendTextSize':'12px'}}}%%
pie showData
title Classified Device Types (30,970 of 59,237)
"Phone" : 6699
"Industrial" : 3992
"Router" : 3801
"IoT" : 2258
"Access Point" : 2188
"Smart Home" : 2172
"Automotive" : 1196
"Laptop" : 1148
"Camera" : 1052
"Medical" : 861
"Audio" : 829
"Other (14 cats)" : 4774Full device-type table (24 categories)
| CATEGORY | COUNT | CATEGORY | COUNT | |:---------|:-----:|:---------|:-----:| | Phone |6,699 | Modem | 599 |
| Industrial | 3,992 | Media Player | 498 |
| Router | 3,801 | Printer | 458 |
| IoT | 2,258 | Switch | 405 |
| Access Point | 2,188 | VoIP | 335 |
| Smart Home | 2,172 | Appliance | 299 |
| Automotive | 1,196 | Gaming | 252 |
| Laptop | 1,148 | Storage | 207 |
| Camera | 1,052 | Server | 153 |
| Medical | 861 | Wearable | 143 |
| Audio | 829 | Tablet | 52 |
| TV | 693 | Thermostat | 33 |
| Computer | 647 | | |
> demo --live
---
> example
``
MAC Address: 3C:D9:2B:12:34:56
└─OUI─┘ └─Device─┘
OUI: 3C:D9:2B
Manufacturer: Hewlett Packard
Device Type: Computer
Country: US
Registry: MA-L
Sources: IEEE + Wireshark + Nmap
`
Why this matters:
- Identify rogue/unauthorized devices on your network
- Categorize WiFi APs by vendor while wardriving
- Discover IoT devices, cameras, printers across a subnet
- Detect MAC spoofing (compare OUI registry vs claimed vendor)
---
> ls LISTS/
Direct Downloads
| FORMAT | SIZE | BEST FOR | DOWNLOAD |
|:------:|:----:|:---------|:--------:|
| !TXT | minimal | grep/awk, legacy tools | master_oui.txt |
| !CSV | full | Spreadsheets, dataframes | master_oui.csv |
| !TSV | medium | Excel/Sheets (no quote issues) | master_oui.tsv |
| !JSON | pretty | APIs, human-readable | master_oui.json |
| !JSON-min | compact | Scripts, fast loading | master_oui.min.json |
| !XML | enterprise | Java, XSLT | master_oui.xml |
| !SQLite | indexed | Ready-to-query DB | master_oui.db |
| !SQL | script | Postgres/MySQL/D1 import | import-to-d1.sql |
| !Kismet | text | Kismet wireless IDS | kismet_manuf.txt |
| !Kismet.gz | compressed | Kismet drop-in install | kismet_manuf.txt.gz |
Raw URLs (cron / curl friendly)
`bash
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.txt
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.csv
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.json
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.db
`
---
> data_fields
| FIELD | TYPE | EXAMPLE |
|:------|:----:|:--------|
| oui | string | 3C:D9:2B |
| manufacturer | string | Hewlett Packard (canonical - one name per organization) |
| registrant_raw | string | Hewlett Packard Enterprise (the literal registry text) |
| short_name | string | HP |
| registry | enum | MA-L, MA-M, MA-S, IAB, CID |
| device_type | enum | Router, Phone, Camera, IoT, ... |
| address | string | 11445 Compaq Center Dr, Houston TX US |
| country | iso2 | US, CN, DE, JP |
| registered_date | date | 2012-05-15 |
| status | enum | current (IEEE lists it today), deregistered (IEEE deleted it), legacy (only Wireshark/Nmap still carry it) |
| deregistered_date | date | 2021-03-02 (only for deregistered) |
| registrant_history | string | TEKELEC \| PRIVATE \| TEKELEC \| Oracle (every registrant the block has had, oldest first; only when it changed) |
| sources | array | ["IEEE","Wireshark","Nmap"] |
manufacturer is unified per organization: IEEE keeps every spelling a registrant ever typed (Nintendo Co., Ltd. and Nintendo Co.,Ltd were 110 blocks under two names), so the build resolves each registry string through the curated organization map in data/organizations.json and falls back to the most common spelling in the build. registrant_raw always carries the registry's own text, so nothing is lost.
Every source spells a block its own way (00:55:DA:0 at IEEE, 00:55:DA:00/28 in Wireshark, 0055DA0 in Nmap), so the merge now keys everything by the IEEE form; the same assignment no longer appears twice. status says whether IEEE lists a block today, has deleted it (deregistered_date), or whether only the community lists still carry it - old captures need those rows, but they are not current registrations. registrant_history comes from runZero's mac-tracker, which has tracked every IEEE add, change and delete since 1998.
---
> usage
python
`python
import json
with open('LISTS/master_oui.min.json') as f:
db = json.load(f)
def lookup(mac):
oui = mac[:8].upper()
return db.get(oui, {'manufacturer': 'Unknown'})
print(lookup('00:00:0C:12:34:56'))
{'manufacturer': 'Cisco Systems, Inc', 'device_type': 'Router', 'country': 'US'}
`
node.js
`javascript
const db = require('./LISTS/master_oui.json');
const lookup = mac => db[mac.substring(0,8).toUpperCase()] || { manufacturer: 'Unknown' };
console.log(lookup('00:00:0C:12:34:56'));
`
sqlite3
`bash
sqlite3 LISTS/master_oui.db "SELECT * FROM oui_registry WHERE oui = '00:00:0C'"
sqlite3 LISTS/master_oui.db "SELECT device_type, COUNT(*) FROM oui_registry GROUP BY device_type ORDER BY 2 DESC"
`
grep (TXT)
`bash
grep "3CD92B" LISTS/master_oui.txt
grep -i "apple" LISTS/master_oui.txt | head
`
curl (one-liner)
`bash
curl -s https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.txt | grep -i "00000C"
`
---
> cli_tool
Cross-platform Node.js CLI in CLI TOOL/ — works on Windows / Linux / macOS.
`bash
cd "CLI TOOL"
node oui-lookup.js --interactive # Continuous lookup REPL
node oui-lookup.js 00:00:0C:12:34:56 # Single lookup
node oui-lookup.js --search cisco # Search by manufacturer
node oui-lookup.js --wifi # Scan nearby WiFi + show vendors
node oui-lookup.js --bluetooth # Scan BT devices + show vendors
node oui-lookup.js --arp # Local ARP table with vendors
node oui-lookup.js --stats # Database statistics
`
| FEATURE | WIN | LINUX | MAC |
|:--------|:---:|:-----:|:---:|
| WiFi Scan | netsh wlan | nmcli | airport |
| Bluetooth | PowerShell | bluetoothctl | system_profiler |
| ARP Table | arp -a | arp -a | arp -a |
---
> generate --fresh
`bash
git clone https://github.com/Ringmast4r/OUI-Master-Database.git
cd OUI-Master-Database
npm install
bash download-sources.sh # Pulls IEEE + Wireshark + Nmap + HDM
node merge-oui-databases.js # Merges into LISTS/master_oui.*
`
Windows: double-click update-database.bat.
---
> update_schedule
The repo auto-updates on a monthly cron via GitHub Actions:
`
.github/workflows/update.yml -> runs at 02:00 UTC on the 1st of each month
`
Why monthly and not weekly? IEEE assigns ~300-400 OUIs/month. Polling more often
just generates churn for marginal freshness on a slow-moving registry.
To self-host updates:
`cron
0 0 1 cd /path/to/OUI-Master-Database && bash download-sources.sh && node merge-oui-databases.js
`
---
> use_cases
`mermaid
%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pie6':'#9FEF00','pieTitleTextSize':'16px','pieLegendTextSize':'12px'}}}%%
pie showData
title Who Uses This (and How)
"Wardriving / WiFi mapping" : 30
"Network forensics & IR" : 22
"IoT / asset discovery" : 18
"Threat intel pipelines" : 12
"Educational / classroom" : 10
"Spoofing detection" : 8
`
---
> credits
Combining four authoritative sources, with respect for each license:
- IEEE Registration Authority · public domain · standards-oui.ieee.org
- Wireshark Manufacturer DB · GPLv2 · wireshark.org
- Nmap MAC Prefixes · modified GPLv2 · nmap.org
- HDM Mac-Tracker · MIT · hdm/mac-tracker
This project is MIT — use commercially, modify, redistribute, embed in proprietary tools.
---
> related_projects
---
> contributing
Issues and PRs welcome. Most-wanted contributions:
- Better device-type heuristics (we're at 17.6% classified; let's get to 30%+)
- Country-code derivation from address strings
- Additional authoritative sources beyond the current four
- API wrapper libraries (Go, Rust, Ruby)
---
Last updated: 2026-11-01 · Total OUIs: 59,237` · Maintained by @Ringmast4r