Mac-adress list of manufacturers only for access points

[kulinski]

hello,

i'm going to look for forbidden access points at the ports of huge network. is there any document that can show me whether a mac adress is an access point or not ?

[melisei]

Hi there,

The first half of the MAC will give you the producer of that particular card (company ID). Just by looking at the MAC you cannot say it is an AP or not. To find the manufacturer from the mac use this link:

http://standards.ieee.org/regauth/oui/index.shtml

ME

[kulinski]

yes,

these are the facts i already know.

i cannot believe that the producers do not say, ok

the first half is our firm and in the seconf half we make sections....

for example

from mac "a" to "c" it is a switch

from mac "d" to "k" it is a router

from mac "l" to "p" it is a access point and so on.

don't you believe ?

[melisei]

I'm sure there's something like that available to the producer but I've never seen one (I work for a producer myself).

ME

[kulinski]

that will be a problem for me and an lot of work.

i normally didn't want to look for all the ports that have more than one mac address in the table.

you know, some users don't care about security when bringing an access point to your net.

[dewman03]

If you want to do rogue access point detection then you have a few options:

1. Scan suspected ranges for port 80 servers as almost every access point has web-based configuration.

2. Cisco has provided a list of vendor mac address who make Access Points.

This list is found in their

"SAFE: Wireless LAN Security in Depth - version 2"

whitepaper

Check the link

"http://www.cisco.com/en/US/products/hw/wireless/ps430/products_white_paper09186a008009c8b3.shtml"

The list is at the very bottom of the whitepaper

"Table C-7 MAC OUIs Used by Access Point Vendors"

"Table C-7 provides a partial list of MAC OUIs used by access point vendors. This table was obtained from the aptools site at aptools.sourceforge.net."

[kulinski]

thanks a lot,

i'll have a look at my network