/usr/sbin/dmassagevendor is in arpwatch 2.1a15-2.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 | #!/usr/bin/perl -w
# massagevendor.pl: v0.03 2002/03/07 KELEMEN Peter <fuji@debian.org>
# This program is part of the arpwatch Debian package.
# Compile Ethernet vendor code listings from different sources into internal
# format used by arpwatch(8).
# Ethernet vendor listings recognized:
# IEEE OUI: http://standards.ieee.org/regauth/oui/oui.txt
# CaveBear: http://map-ne.com/Ethernet/Ethernet.txt
use Getopt::Long;
use strict;
use vars qw($opt_output $opt_ieee $opt_cavebear $opt_firstword $opt_help $opt_version);
my $VERSION = q(0.03);
$opt_output = 'ethercodes.dat';
$opt_ieee = 'oui.txt';
$opt_cavebear = 'Ethernet.txt';
$opt_firstword = 0;
$opt_help = 0;
$opt_version = 0;
my $time = time();
GetOptions(qw(output=s ieee=s cavebear=s firstword help version));
version() if $opt_version;
usage() if $opt_help;
open(IEEE, '<' . $opt_ieee) || die "$opt_ieee: $!\n";
open(CAVEBEAR, '<' . $opt_cavebear) || die "$opt_cavebear: $!\n";
open(OUTPUT, '>' . $opt_output) || die "$opt_output: $!\n";
my ($prefix, $vendor);
my %ieee = ();
my %cavebear = ();
# Process IEEE OUI listing.
while (<IEEE>) {
next unless /^[[:xdigit:]]{2}-[[:xdigit:]]{2}-[[:xdigit:]]{2}\s/;
chomp;
($prefix, $vendor) = m/^([[:xdigit:]]{2}-[[:xdigit:]]{2}-[[:xdigit:]]{2})\s+\([^(]+\)\s+(.*)$/;
$prefix =~ s/-//g;
$ieee{mangle_prefix($prefix)} = mangle_vendor($vendor);
}
# Process CaveBear Ethernet vendor codes.
while (<CAVEBEAR>) {
next unless /^[0-9A-F]{6}\s/;
s/\r//g;
chomp;
($prefix, $vendor) = m/^([0-9A-F]{6})\s+(.*)$/;
$vendor =~ s/\s{2,}/ /g;
$vendor =~ s/([a-z])([A-Z])/$1 $2/g;
$cavebear{mangle_prefix($prefix)} = $vendor;
}
print STDERR scalar keys %ieee, " (IEEE), ", scalar keys %cavebear, " (CaveBear).\n";
# Attempt to merge.
my $equal = 0;
my $first_word = 0;
my $merged = 0;
my $c_only = 0;
foreach (sort keys %cavebear) {
if (exists $ieee{$_}) {
my ($i, $c);
# Treat as equal if sanitized vendor name equals.
$i = lc($ieee{$_});
$c = lc($cavebear{$_});
$i =~ s/\W//g;
$c =~ s/\W//g;
if ($i eq $c) {
++$equal;
next;
}
if ($opt_firstword) {
# Treat as equal if first word matches.
$i = lc($ieee{$_});
$c = lc($cavebear{$_});
$i =~ s/(\w+).*/$1/;
$c =~ s/(\w+).*/$1/;
if (0 and $i eq $c) {
$i =~ s/\W//g;
$c =~ s/\W//g;
if (length($c) >= length($i)) {
$ieee{$_} = $cavebear{$_};
}
++$first_word;
next;
}
}
# At this point we're helpless; simple heuristics could not
# determine if the two vendors were the same. Merge them.
# Always use vendor name from IEEE, add vendor name from
# CaveBear in brackets ([]).
$ieee{$_} .= " [" . $cavebear{$_} . ']';
$ieee{$_} =~ s/\t/; /g;
++$merged;
} else {
$ieee{$_} = $cavebear{$_};
++$c_only;
}
}
foreach (sort keys %ieee) {
print OUTPUT "$_\t$ieee{$_}\n";
}
close(OUTPUT);
close(IEEE);
close(CAVEBEAR);
$time = time()-$time;
print scalar keys %ieee, " total. (processed in $time seconds)\n";
print STDERR $equal, " equal, ", $first_word, " equal based on company name.\n";
print STDERR $merged, " merged, ", $c_only, " listed only by CaveBear.\n";
# Mangle prefix code. Wish there was some standard notation...
sub mangle_prefix {
my $prefix = lc(shift); # Lowercase.
# Extract XX:XX:XX MAC address prefix.
@_ = $prefix =~ m/^([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})$/;
map { s/^0//; } @_; # Strip leading zeros.
return join(':', @_);
}
# Mangle vendor name since the IEEE listing is really carelessly compiled.
# Heavy heuristics here, you've been warned.
sub mangle_vendor {
my $vendor = shift;
$vendor =~ s/^\W+//; # Strip leading garbage.
$vendor =~ s/\s{2,}/ /g; # Condense whitespace.
$vendor =~ s/ \W$//; # Strip trailing garbage.
$vendor =~ s/(\w{4,})/\u\L$1/g; # Capitalize words 4 or more chars.
# Heuristics to uc() abbreviations longer than 4 characters.
$vendor =~ s/^(Ecci|Ris(c|q)|Seel|Uunet)$/\U$1/g;
# Heuristics to lc() abbreviations shorter than 4 characters.
$vendor =~ s/\b(COM?|IN(C|T)|LTD|DIV|SYS|PUB|IND|PT(Y|E)|LAB|TEC|SEL|EON)\b/\u\L$1/g;
# Lowercase ordinary words.
$vendor =~ s/\b(BAY|THE|ZUR|END|ONE|SAN|SUN|NET|WAY|TOP|BOX)/\u\L$1/g;
$vendor =~ s/\b(BUG|BUS|PIG|TEN|LAW|NOT|SEA|LEE)\b/\u\L$1/g;
# Lowercase French words and abbreviations.
$vendor =~ s/\b(LA|LE|SOC|FA)\b/\u\L$1/g;
# Lowercase English, French, German and Spanish conjunctions.
$vendor =~ s/\b(AND|OF|TO|IN|FOR)\b/\L$1/g;
$vendor =~ s/\b(DES|UND|DE|DI|DU)\b/\L$1/g;
$vendor =~ s/\b((L|D)')/\L$1/g; # Lowercase French prefixes.
$vendor =~ s/('[A-Z])\b/\L$1/g; # Lowercase letters following an "'".
$vendor =~ s/\bGmbh\b/GmbH/g; # Treat GmbH specially.
return $vendor;
}
sub version {
print <<EOF
massagevendor $VERSION
Copyright (C) 2000-2001 KELEMEN Peter <fuji\@debian.org>
EOF
;
exit(0);
}
sub usage {
print <<EOF
Massage IEEE OUI listing and Cavebear Ethernet vendor database into arpwatch(8) format.
Usage: massagevendor [--ieee=<file>] [--cavebear=<file>] [--output=<file>] [--help] [--firstword]
Options:
--ieee=<file> Read IEEE OUI listing from this file [oui.txt]
--cavebear=<file> Read Cavebear Ethernet vendor info from here [Ethernet.txt]
--output=<file> Write massaged output to this file [ethercodes.dat]
--firstword Enable equality heuristics based on he first word of
a vendor's name. This might produce unwanted results.
--help You are reading this now.
EOF
;
exit(0);
}
|