I'm working on replicating some research wherein users were profiled based on the SSIDs they asked for when sending out 802.11 probe requests. I only captured probe requests, so information from clients rather than APs.
Each probe request contains the sender's MAC address, as well as the SSID they're looking for. I gathered about 200,000 probes from around the city where I live, and over 70% of the probes I gathered had a MAC address that wasn't listed in the IEEE OUI database.
About half of those MAC addresses had the self-assigned bit set, which I would expect for iOS8 devices sending probe requests, but I don't think I would expect that proportion of devices to be iPhones, given their market share relative to Android.
The statistics I have from that data set are 9% Apple, 36% invalid OUI without the self-assigned bit set, 34% invalid with the self-assigned bit set, and 20% valid vendors other than Apple.
Plausibly, the 43% of users either self-assigned or specifically Apple could be iOS users, taking into account the number of unique MAC addresses being higher if a new one is being randomly generated for each probe request.
However, I'm still not sure why there would be such a large proportion of invalid OUIs.
I can't find any sources on widespread adoption of randomised MAC addresses in any OS; someone suggested that several "small name" vendors might be generating invalid/random MACs to prevent having to buy their own OUI, but I wouldn't have thought they would be such a high proportion.
So, in conclusion: 70% of MAC addresses sampled had an invalid OUI when sending probe requests, and only around half of those had the "self-assigned" bit set, hence leaving about half who are invalid for no reason I can find; does anyone know why this might be?