PI keeps a record of a client connected on port X on switch Y on a certain day, but for some reason it doesn't have the actual MAC address). I uess it can be some automatically generated MAC used as a placeholder in the absence of real data (e.g. The Wireshark OUI lookup says it’s a Lantastic device: On IANA page it shows the MAC addresses belong to a reserved range: The OUI (FF-FF-00) does not exist in the IEEE file: They’re almost all disassociated (no IP assigned), and on the same switch port there is often another (active) client having regular MAC and IP addresses If an organization does not expect to use a complete block of an OUI (3 octets), then the OUI can be shared among different companies (MA-M and MA-S).The wired client view of Prime Infrastructure lists clients by MAC addresses, and a big number of listed MAC addresses (filter -> All) follow the pattern: ff:ff:00:00:xx:xx (e.g ff:ff:00:00:2b:81). The NIC portion is then assigned by that company. So the OUI is registered with the IEEE and defines which organization/company 'owns' that block of MAC addresses. The second half (last 3 octets) is the Network Interface Contoller (NIC) specific. The first half (the first 3 octets) are called the Organizationally Unique Identifier (OUI). Basically, a MAC address can be divided into 2 parts. Please see the link above for a full list of registered OUI's with the IEEE. If the L/G-bit is is 1, the address is locally administered. If the bit is 0, the address is universally administered and registered at the IEEE Registration Authority: Yes, as long as the L/G-bit within the MAC address = 0.

Can Wireshark automatically extract the Network Interface Card vendor from the MAC address alone?.

Wireshark oui mac