North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: wireless traffic

  • From: Dave O'Shea
  • Date: Fri Nov 09 21:13:52 2001

Way Back When, I think that IEEE was the party that handed out prefixes
to be used as MAC addresses. I know several people have compiled lists
at one time or another.

There's a neat little app for palm OS handhelds called Ethertools*, that
had a reasonably comprehensive list of the well-known ones.

(*Of course similarly formatted MAC addresses are present on other
multi-access mediums as well. I recall pulling out a lot of hair
figuring out how 3Com ended up with what looked like two MAC's on every
token-ring card. Turned out to be the same address, but token ring was
small-endian vs. big-endian. Or vice versa.)

-----Original Message-----
From: Steven M. Bellovin [mailto:[email protected]]
Sent: Friday, November 09, 2001 10:29 AM
To: Andrew Brown
Cc: [email protected]; Art Houle; [email protected]
Subject: Re: wireless traffic 

In message <[email protected]>, Andrew Brown
>>> Does anybody know where I can locate a list of MAC address prefixes
>>> belong specifically to wireless NIC cards?  I am looking for a
method of
>>> discovering what devices on my network are wireless devices.
>>Power down the wireless hub and see who calls? ;)
>>Seriously though - your wireless hub/transmitter may have a queryable
>>arp table that will tell you what's not using the wire....
>i've used/seen cards with these prefixes:
> 00:e0:29 - smc
> 00:02:2d - orinoco/wavelan cards (lucent/agere)

I'm sending this via a Lucent card with prefix 0:60:1d.  A glance at my 
ARP table for a wireless-only segment shows 0:4:dd, 0:3:6b, 8:0:20, 
0:0:c, 0:c0:b7, 0:d0:b7, 8:0:6a, and more.

		--Steve Bellovin,
		Full text of "Firewalls" book now at