ringmast4r@github:~$ cat oui-master-db.txt
PURPOSE: MAC address vendor lookup, the comprehensive way
SCOPE: Every IEEE registry + Wireshark + Nmap + HDM Mac-Tracker
COVERAGE: 88,577 unique OUIs, 78,014 cross-validated entries
FORMATS: TXT, CSV, TSV, JSON, JSON-min, XML, SQLite, SQL, Kismet, Kismet.gz
UPDATES: First of every month via GitHub Actions
USE CASES: Wardriving | Network forensics | IoT discovery | Threat intel
STATUS: [ LIVE & AUTO-UPDATING ]OUI = the first 3 bytes of a MAC address that identifies the manufacturer. Most lookup databases pick one source. We merged all of them.
| METRIC | COUNT | NOTES |
|---|---|---|
| Total Unique OUIs | 88,577 |
Deduplicated across 4 sources |
| Cross-Validated | 78,014 |
Same OUI from multiple sources |
| IEEE Registry Total | 57,497 |
MA-L + MA-M + MA-S + IAB + CID |
| Device Categories | 24 |
Auto-classified |
| File Formats | 10 |
TXT to SQLite |
| Monthly New OUIs | ~365 |
IEEE assignments |
%%{init: {'theme':'dark', 'themeVariables': {'xyChart': {'backgroundColor':'#00000000','plotColorPalette':'#1E40AF','titleColor':'#1E40AF','xAxisLabelColor':'#ffffff','yAxisLabelColor':'#ffffff'}}}}%%
xychart-beta
title "OUI Count Growth (Last 3 Auto-Updates)"
x-axis ["2026-03-12", "2026-04-01", "2026-05-01"]
y-axis "Total OUIs" 87800 --> 88800
bar [87970, 88212, 88577]
line [87970, 88212, 88577]
+607 OUIs in ~7 weeks · IEEE assigns roughly 300-400 new vendors/month · Next refresh: first of next month
%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pie6':'#1E3A8A','pieTitleTextSize':'18px','pieLegendTextSize':'14px'}}}%%
pie showData
title Where Each OUI Comes From
"All 3 (IEEE+Wireshark+Nmap)" : 38512
"IEEE only" : 17995
"Wireshark only" : 17924
"Nmap only" : 13159
"IEEE + Wireshark" : 573
"IEEE + Nmap" : 414
38,512 OUIs (43%) are confirmed by all three primary sources. The remaining single-source entries fill gaps that no individual database would catch on its own. That's the point.
| SOURCE | ENTRIES | LICENSE | URL |
|---|---|---|---|
57,497 |
Public Domain | standards-oui.ieee.org | |
57,009 |
GPLv2 | wireshark.org | |
52,085 |
GPLv2 (mod.) | nmap-mac-prefixes | |
57,611 |
MIT | hdm/mac-tracker |
%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pieTitleTextSize':'18px','pieLegendTextSize':'14px'}}}%%
pie showData
title IEEE Registry Distribution (57,497 entries)
"MA-L (Large, ~16M each)" : 39345
"MA-S (Small, ~4K each)" : 6991
"MA-M (Medium, ~1M each)" : 6375
"IAB (Individual Block)" : 4575
"CID (Company ID)" : 211
| REGISTRY | ENTRIES | BLOCK SIZE | TYPICAL USE |
|---|---|---|---|
| MA-L | 39,345 |
24-bit (~16M MACs) | Large-scale manufacturers |
| MA-S | 6,991 |
36-bit (~4K MACs) | IoT, niche hardware |
| MA-M | 6,375 |
28-bit (~1M MACs) | Mid-volume vendors |
| IAB | 4,575 |
Individual | Legacy individual blocks |
| CID | 211 |
Company-only ID | Non-MAC company markers |
⚠ IEEE doesn't expose device category. Our classifier is a heuristic on company name + known-vendor lookups, so only 15,582 of 88,577 OUIs (17.6%) get a category. The remaining 72,995 stay
Unclassifiedrather than guessed.
%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pie6':'#1E3A8A','pie7':'#00D4FF','pie8':'#9FEF00','pie9':'#FF00FF','pie10':'#8B5CF6','pie11':'#FF6B6B','pie12':'#00FF88','pieTitleTextSize':'16px','pieLegendTextSize':'12px'}}}%%
pie showData
title Classified Device Types (15,582 of 88,577)
"Phone" : 6171
"Router" : 2315
"Computer" : 1611
"Smart Home" : 1349
"IoT" : 818
"Automotive" : 441
"Industrial" : 416
"Switch" : 367
"Storage" : 328
"Medical" : 315
"Camera" : 267
"Other (12 cats)" : 1184
Full device-type table (24 categories)
| CATEGORY | COUNT | CATEGORY | COUNT |
|---|---|---|---|
| Phone | 6,171 |
TV | 199 |
| Router | 2,315 |
Media Player | 168 |
| Computer | 1,611 |
Gaming | 164 |
| Smart Home | 1,349 |
VoIP | 143 |
| IoT | 818 |
Appliance | 138 |
| Automotive | 441 |
Printer | 113 |
| Industrial | 416 |
Access Point | 59 |
| Switch | 367 |
Server | 57 |
| Storage | 328 |
Wearable | 51 |
| Medical | 315 |
Audio | 35 |
| Camera | 267 |
Modem | 27 |
| Thermostat | 23 |
||
| Tablet | 7 |
MAC Address: 3C:D9:2B:12:34:56
└─OUI─┘ └─Device─┘
OUI: 3C:D9:2B
Manufacturer: Hewlett Packard
Device Type: Computer
Country: US
Registry: MA-L
Sources: IEEE + Wireshark + Nmap
Why this matters:
- Identify rogue/unauthorized devices on your network
- Categorize WiFi APs by vendor while wardriving
- Discover IoT devices, cameras, printers across a subnet
- Detect MAC spoofing (compare OUI registry vs claimed vendor)
| FORMAT | SIZE | BEST FOR | DOWNLOAD |
|---|---|---|---|
| minimal | grep/awk, legacy tools |
master_oui.txt | |
| full | Spreadsheets, dataframes | master_oui.csv | |
| medium | Excel/Sheets (no quote issues) | master_oui.tsv | |
| pretty | APIs, human-readable | master_oui.json | |
| compact | Scripts, fast loading | master_oui.min.json | |
| enterprise | Java, XSLT | master_oui.xml | |
| indexed | Ready-to-query DB | master_oui.db | |
| script | Postgres/MySQL/D1 import | import-to-d1.sql | |
| text | Kismet wireless IDS | kismet_manuf.txt | |
| compressed | Kismet drop-in install | kismet_manuf.txt.gz |
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.txt
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.csv
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.json
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.db| FIELD | TYPE | EXAMPLE |
|---|---|---|
oui |
string | 3C:D9:2B |
manufacturer |
string | Hewlett Packard |
short_name |
string | HP |
registry |
enum | MA-L, MA-M, MA-S, IAB, CID |
device_type |
enum | Router, Phone, Camera, IoT, ... |
address |
string | 11445 Compaq Center Dr, Houston TX US |
country |
iso2 | US, CN, DE, JP |
registered_date |
date | 2012-05-15 |
sources |
array | ["IEEE","Wireshark","Nmap"] |
import json
with open('LISTS/master_oui.min.json') as f:
db = json.load(f)
def lookup(mac):
oui = mac[:8].upper()
return db.get(oui, {'manufacturer': 'Unknown'})
print(lookup('00:00:0C:12:34:56'))
# {'manufacturer': 'Cisco Systems, Inc', 'device_type': 'Router', 'country': 'US'}const db = require('./LISTS/master_oui.json');
const lookup = mac => db[mac.substring(0,8).toUpperCase()] || { manufacturer: 'Unknown' };
console.log(lookup('00:00:0C:12:34:56'));sqlite3 LISTS/master_oui.db "SELECT * FROM oui_registry WHERE oui = '00:00:0C'"
sqlite3 LISTS/master_oui.db "SELECT device_type, COUNT(*) FROM oui_registry GROUP BY device_type ORDER BY 2 DESC"grep "3CD92B" LISTS/master_oui.txt
grep -i "apple" LISTS/master_oui.txt | headcurl -s https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.txt | grep -i "00000C"Cross-platform Node.js CLI in CLI TOOL/ — works on Windows / Linux / macOS.
cd "CLI TOOL"
node oui-lookup.js --interactive # Continuous lookup REPL
node oui-lookup.js 00:00:0C:12:34:56 # Single lookup
node oui-lookup.js --search cisco # Search by manufacturer
node oui-lookup.js --wifi # Scan nearby WiFi + show vendors
node oui-lookup.js --bluetooth # Scan BT devices + show vendors
node oui-lookup.js --arp # Local ARP table with vendors
node oui-lookup.js --stats # Database statistics| FEATURE | WIN | LINUX | MAC |
|---|---|---|---|
| WiFi Scan | netsh wlan |
nmcli |
airport |
| Bluetooth | PowerShell | bluetoothctl |
system_profiler |
| ARP Table | arp -a |
arp -a |
arp -a |
git clone https://github.com/Ringmast4r/OUI-Master-Database.git
cd OUI-Master-Database
npm install
bash download-sources.sh # Pulls IEEE + Wireshark + Nmap + HDM
node merge-oui-databases.js # Merges into LISTS/master_oui.*Windows: double-click update-database.bat.
The repo auto-updates on a monthly cron via GitHub Actions:
.github/workflows/update.yml -> runs at 02:00 UTC on the 1st of each month
Why monthly and not weekly? IEEE assigns ~300-400 OUIs/month. Polling more often just generates churn for marginal freshness on a slow-moving registry.
To self-host updates:
0 0 1 * * cd /path/to/OUI-Master-Database && bash download-sources.sh && node merge-oui-databases.js%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pie6':'#9FEF00','pieTitleTextSize':'16px','pieLegendTextSize':'12px'}}}%%
pie showData
title Who Uses This (and How)
"Wardriving / WiFi mapping" : 30
"Network forensics & IR" : 22
"IoT / asset discovery" : 18
"Threat intel pipelines" : 12
"Educational / classroom" : 10
"Spoofing detection" : 8
Combining four authoritative sources, with respect for each license:
- IEEE Registration Authority · public domain · standards-oui.ieee.org
- Wireshark Manufacturer DB · GPLv2 · wireshark.org
- Nmap MAC Prefixes · modified GPLv2 · nmap.org
- HDM Mac-Tracker · MIT · hdm/mac-tracker
This project is MIT — use commercially, modify, redistribute, embed in proprietary tools.
Issues and PRs welcome. Most-wanted contributions:
- Better device-type heuristics (we're at 17.6% classified; let's get to 30%+)
- Country-code derivation from address strings
- Additional authoritative sources beyond the current four
- API wrapper libraries (Go, Rust, Ruby)
Last updated: 2026-05-01 · Total OUIs: 88,577 · Maintained by @Ringmast4r