ringmast4r@github:~$ cat oui-master-db.txt
PURPOSE: MAC address vendor lookup, the comprehensive way
SCOPE: Every IEEE registry + Wireshark + Nmap + HDM Mac-Tracker
COVERAGE: 88,873 unique OUIs, 78,179 cross-validated entries
FORMATS: TXT, CSV, TSV, JSON, JSON-min, XML, SQLite, SQL, Kismet, Kismet.gz
UPDATES: First of every month via GitHub Actions
USE CASES: Wardriving | Network forensics | IoT discovery | Threat intel
STATUS: [ LIVE & AUTO-UPDATING ]OUI = the first 3 bytes of a MAC address that identifies the manufacturer. Most lookup databases pick one source. We merged all of them.
| METRIC | COUNT | NOTES |
|---|---|---|
| Total Unique OUIs | 88,873 |
Deduplicated across 4 sources |
| Cross-Validated | 78,179 |
Same OUI from multiple sources |
| IEEE Registry Total | 57,712 |
MA-L + MA-M + MA-S + IAB + CID |
| Device Categories | 24 |
Auto-classified |
| File Formats | 10 |
TXT to SQLite |
| Monthly New OUIs | ~326 |
IEEE assignments |
%%{init: {'theme':'dark', 'themeVariables': {'xyChart': {'backgroundColor':'#00000000','plotColorPalette':'#1E40AF','titleColor':'#1E40AF','xAxisLabelColor':'#ffffff','yAxisLabelColor':'#ffffff'}}}}%%
xychart-beta
title "OUI Count Growth (Last 4 Auto-Updates)"
x-axis ["2026-03-12", "2026-04-01", "2026-05-01", "2026-06-01"]
y-axis "Total OUIs" 87800 --> 89000
bar [87970, 88212, 88577, 88873]
line [87970, 88212, 88577, 88873]
+903 OUIs in ~12 weeks · IEEE assigns roughly 326 new vendors/month · Next refresh: first of next month
%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pie6':'#1E3A8A','pieTitleTextSize':'18px','pieLegendTextSize':'14px'}}}%%
pie showData
title Where Each OUI Comes From
"All 3 (IEEE+Wireshark+Nmap)" : 38512
"IEEE only" : 18045
"Wireshark only" : 18005
"Nmap only" : 13159
"IEEE+Wireshark" : 738
"IEEE+Nmap" : 414
38,512 OUIs (43%) are confirmed by all three primary sources. The remaining single-source entries fill gaps that no individual database would catch on its own. That's the point.
| SOURCE | ENTRIES | LICENSE | URL |
|---|---|---|---|
57,712 |
Public Domain | standards-oui.ieee.org | |
57,255 |
GPLv2 | wireshark.org | |
52,085 |
GPLv2 (mod.) | nmap-mac-prefixes | |
57,828 |
MIT | hdm/mac-tracker |
%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pieTitleTextSize':'18px','pieLegendTextSize':'14px'}}}%%
pie showData
title IEEE Registry Distribution (57,712 entries)
"MA-L (Large, ~16M each)" : 39481
"MA-S (Small, ~4K each)" : 7026
"MA-M (Medium, ~1M each)" : 6417
"IAB (Individual Block)" : 4575
"CID (Company ID)" : 213
| REGISTRY | ENTRIES | BLOCK SIZE | TYPICAL USE |
|---|---|---|---|
| MA-L | 39,481 |
24-bit (~16M MACs) | Large-scale manufacturers |
| MA-S | 7,026 |
36-bit (~4K MACs) | IoT, niche hardware |
| MA-M | 6,417 |
28-bit (~1M MACs) | Mid-volume vendors |
| IAB | 4,575 |
Individual | Legacy individual blocks |
| CID | 213 |
Company-only ID | Non-MAC company markers |
⚠ IEEE doesn't expose device category. Our classifier is a heuristic on company name + known-vendor lookups, so only 15,658 of 88,873 OUIs (17.6%) get a category. The remaining 73,215 stay
Unclassifiedrather than guessed.
%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pie6':'#1E3A8A','pie7':'#00D4FF','pie8':'#9FEF00','pie9':'#FF00FF','pie10':'#8B5CF6','pie11':'#FF6B6B','pie12':'#00FF88','pieTitleTextSize':'16px','pieLegendTextSize':'12px'}}}%%
pie showData
title Classified Device Types (15,658 of 88,873)
"Phone" : 6200
"Router" : 2326
"Computer" : 1615
"Smart Home" : 1352
"IoT" : 823
"Automotive" : 443
"Industrial" : 419
"Switch" : 373
"Storage" : 332
"Medical" : 317
"Camera" : 268
"Other (13 cats)" : 1190
Full device-type table (24 categories)
| CATEGORY | COUNT | CATEGORY | COUNT |
|---|---|---|---|
| Phone | 6,200 |
Media Player | 168 |
| Router | 2,326 |
Gaming | 165 |
| Computer | 1,615 |
VoIP | 143 |
| Smart Home | 1,352 |
Appliance | 140 |
| IoT | 823 |
Printer | 113 |
| Automotive | 443 |
Access Point | 59 |
| Industrial | 419 |
Server | 57 |
| Switch | 373 |
Wearable | 51 |
| Storage | 332 |
Audio | 35 |
| Medical | 317 |
Modem | 27 |
| Camera | 268 |
Thermostat | 23 |
| TV | 202 |
Tablet | 7 |
MAC Address: 3C:D9:2B:12:34:56
└─OUI─┘ └─Device─┘
OUI: 3C:D9:2B
Manufacturer: Hewlett Packard
Device Type: Computer
Country: US
Registry: MA-L
Sources: IEEE + Wireshark + Nmap
Why this matters:
- Identify rogue/unauthorized devices on your network
- Categorize WiFi APs by vendor while wardriving
- Discover IoT devices, cameras, printers across a subnet
- Detect MAC spoofing (compare OUI registry vs claimed vendor)
| FORMAT | SIZE | BEST FOR | DOWNLOAD |
|---|---|---|---|
| minimal | grep/awk, legacy tools |
master_oui.txt | |
| full | Spreadsheets, dataframes | master_oui.csv | |
| medium | Excel/Sheets (no quote issues) | master_oui.tsv | |
| pretty | APIs, human-readable | master_oui.json | |
| compact | Scripts, fast loading | master_oui.min.json | |
| enterprise | Java, XSLT | master_oui.xml | |
| indexed | Ready-to-query DB | master_oui.db | |
| script | Postgres/MySQL/D1 import | import-to-d1.sql | |
| text | Kismet wireless IDS | kismet_manuf.txt | |
| compressed | Kismet drop-in install | kismet_manuf.txt.gz |
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.txt
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.csv
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.json
https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.db| FIELD | TYPE | EXAMPLE |
|---|---|---|
oui |
string | 3C:D9:2B |
manufacturer |
string | Hewlett Packard |
short_name |
string | HP |
registry |
enum | MA-L, MA-M, MA-S, IAB, CID |
device_type |
enum | Router, Phone, Camera, IoT, ... |
address |
string | 11445 Compaq Center Dr, Houston TX US |
country |
iso2 | US, CN, DE, JP |
registered_date |
date | 2012-05-15 |
sources |
array | ["IEEE","Wireshark","Nmap"] |
import json
with open('LISTS/master_oui.min.json') as f:
db = json.load(f)
def lookup(mac):
oui = mac[:8].upper()
return db.get(oui, {'manufacturer': 'Unknown'})
print(lookup('00:00:0C:12:34:56'))
# {'manufacturer': 'Cisco Systems, Inc', 'device_type': 'Router', 'country': 'US'}const db = require('./LISTS/master_oui.json');
const lookup = mac => db[mac.substring(0,8).toUpperCase()] || { manufacturer: 'Unknown' };
console.log(lookup('00:00:0C:12:34:56'));sqlite3 LISTS/master_oui.db "SELECT * FROM oui_registry WHERE oui = '00:00:0C'"
sqlite3 LISTS/master_oui.db "SELECT device_type, COUNT(*) FROM oui_registry GROUP BY device_type ORDER BY 2 DESC"grep "3CD92B" LISTS/master_oui.txt
grep -i "apple" LISTS/master_oui.txt | headcurl -s https://raw.githubusercontent.com/Ringmast4r/OUI-Master-Database/master/LISTS/master_oui.txt | grep -i "00000C"Cross-platform Node.js CLI in CLI TOOL/ — works on Windows / Linux / macOS.
cd "CLI TOOL"
node oui-lookup.js --interactive # Continuous lookup REPL
node oui-lookup.js 00:00:0C:12:34:56 # Single lookup
node oui-lookup.js --search cisco # Search by manufacturer
node oui-lookup.js --wifi # Scan nearby WiFi + show vendors
node oui-lookup.js --bluetooth # Scan BT devices + show vendors
node oui-lookup.js --arp # Local ARP table with vendors
node oui-lookup.js --stats # Database statistics| FEATURE | WIN | LINUX | MAC |
|---|---|---|---|
| WiFi Scan | netsh wlan |
nmcli |
airport |
| Bluetooth | PowerShell | bluetoothctl |
system_profiler |
| ARP Table | arp -a |
arp -a |
arp -a |
git clone https://github.com/Ringmast4r/OUI-Master-Database.git
cd OUI-Master-Database
npm install
bash download-sources.sh # Pulls IEEE + Wireshark + Nmap + HDM
node merge-oui-databases.js # Merges into LISTS/master_oui.*Windows: double-click update-database.bat.
The repo auto-updates on a monthly cron via GitHub Actions:
.github/workflows/update.yml -> runs at 02:00 UTC on the 1st of each month
Why monthly and not weekly? IEEE assigns ~300-400 OUIs/month. Polling more often just generates churn for marginal freshness on a slow-moving registry.
To self-host updates:
0 0 1 * * cd /path/to/OUI-Master-Database && bash download-sources.sh && node merge-oui-databases.js%%{init: {'theme':'dark', 'themeVariables': {'pie1':'#1E40AF','pie2':'#3B82F6','pie3':'#60A5FA','pie4':'#93C5FD','pie5':'#FFD700','pie6':'#9FEF00','pieTitleTextSize':'16px','pieLegendTextSize':'12px'}}}%%
pie showData
title Who Uses This (and How)
"Wardriving / WiFi mapping" : 30
"Network forensics & IR" : 22
"IoT / asset discovery" : 18
"Threat intel pipelines" : 12
"Educational / classroom" : 10
"Spoofing detection" : 8
Combining four authoritative sources, with respect for each license:
- IEEE Registration Authority · public domain · standards-oui.ieee.org
- Wireshark Manufacturer DB · GPLv2 · wireshark.org
- Nmap MAC Prefixes · modified GPLv2 · nmap.org
- HDM Mac-Tracker · MIT · hdm/mac-tracker
This project is MIT — use commercially, modify, redistribute, embed in proprietary tools.
Issues and PRs welcome. Most-wanted contributions:
- Better device-type heuristics (we're at 17.6% classified; let's get to 30%+)
- Country-code derivation from address strings
- Additional authoritative sources beyond the current four
- API wrapper libraries (Go, Rust, Ruby)
Last updated: 2026-06-01 · Total OUIs: 88,873 · Maintained by @Ringmast4r