An OUI lookup tool.

This Lua script adds a new GUI Menu to Wireshark that allows the user to lookup OUIs and other MAC address prefixes. It uses the locally installed manuf file, if present, or the locally generated oui.txt file for these lookups. If you're looking for the online OUI Lookup Tool, visit: https://www.wireshark.org/tools/oui-lookup.html.

OUIs and MAC address searches may be colon-, hyphen-, or period-separated, of contain no separators at all. Searches can also include arbitrary text as well as Lua patterns.

Installation - place in plugins directory - see Lua Support in Wireshark

ouilookup.lua

Examples:

• 0000.0c
• 08:00:20
• 00-04-EE-CC-CC-CC
• 00d9.d110.21f9
• 01-23-45-67-89-AB-CD-EF
• missouri

For help with Lua patterns, refer to https://www.lua.org/manual/5.4/manual.html#6.4.1

This OUI lookup tool can also be run from the command-line using tshark. For example:

• Windows: tshark.exe -X lua_script:path\to\ouilookup.lua -X lua_script1:path\to\ouilookup.txt -c 0 2> nul

• *nix: tshark -X lua_script:path/to/ouilookup.lua -X lua_script1:path/to/ouilookup.txt -c 0 2> /dev/null

  ... where ouilookup.txt is an arbitrary filename containing the OUI search criteria.