0

I am monitoring my network and I would like to know how many mobile devices are there. I am already filtering probe requests and matching MAC adresses with OUI identifier. However I have few doubts about this procedure:

  1. Around 90% of MAC addresses captured do not match any OUI. Can we assume that mobile devices will always have a known OUI?

  2. Is there any list with known OUI belonging to mobile devices? I would like to filter our laptops and PCs.

  3. I know it depends on many factors, but what is the average frequency more or less in which the probe requests are send?

Thank you!

Improve this question
3
  • 1
    I have trouble believing 90% of your MAC addresses captured don't match any OUI. You may want to check your OUI lookup utility. You can always look it up at IEEE here: standards.ieee.org/develop/regauth/oui/oui.txt This is updated daily.
    – Smithers
    Commented Jan 5, 2015 at 23:16
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 11, 2017 at 2:33
  • Around 90% of MAC addresses captured do not match any OUI. The first thing you should do is filter the MAC addresses. Remove any locally-administered ones, and any multicast ones. That will ditch all those unknown ones. Examine the lowest two bits of the highest byte of the MAC to determine the MAC type.
    – Majenko
    Commented Mar 19, 2020 at 15:08

1 Answer 1

Reset to default
1

[rewriting your question without assumptions about the solution]

Q: "How do I find what OS/Device is connected to our wifi?"

  1. Don't use mac-addresses to determine endpoint operating systems; mac-addresses are easily spoofed, and vendors can change their wifi PHY ASIC supplier on a whim

  2. Use something like DHCP Fingerprinting, or better still, Cisco ISE (which does DHCP, HTTP, RADIUS EAP supplicant, and nmap fingerprinting, all in one appliance)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.