1

If I have got a list of MAC addresses, is there any possible way to differentiate MAC of an AP from that of a Client. I am asking whether there is any pattern of the characters in the MAC address by which we can identify it belongs to an Access Point?

  • 1
    Please explain what problem you're solving, why you are solving it, and try not to make assumptions about the solution. Also see this list of suggestions to potentially get better answers. Better question = better answers. – Mike Pennington Jan 8 '14 at 15:52
  • @MikePennington : I do not face any problem right now, but i was thinking is there anyway to identify mac address of AP from a client. For example we can identify the manufacturer of that network interface from the first 6 characters of mac address. Is there anyway like this to identify them? – Nithin Jose Jan 8 '14 at 16:00
  • 1
    the simplest way is to poll your APs with SNMP to get the macs. Then again, we know almost nothing about the context of the request, thus my first comment – Mike Pennington Jan 8 '14 at 16:04
  • 1
    @DDR you answered your own question. The OUI will tell you the manufacturer. From that you can deduce who id the station and who is the AP. Not perfect, but with a little practice you can get close. – Ron Trunk Jan 8 '14 at 16:47
  • Depending on your environment (and a slew of other factors) you may consider something like DHCP Snooping for IP/MAC source verification, as well as ingress/egress packet exfiltration between segments on your network. – jredd Jan 13 '14 at 1:08
3

Short answer: No.

Long answer: You can narrow down your list to a few candidates. The first 3 bytes of the MAC address is called the OUI (Organizationally Unique Identifier) and is assigned to manufacturers. You can look up the manufacturer of a MAC address by using a tool like http://www.wireshark.org/tools/oui-lookup.html

Based on the manufacturer, you can get a pretty good idea of who is who. If the manufacturer is "Cisco," odds are it's an AP. If the mfr is "Dell," it's probably a PC. This isn't perfect, but as you collect more data, you will able to be more certain of your results.

  • 3
    Note: Cisco makes wireless cards, and Dell makes APs. Using the OUI is a poor guess at best. APs are the radios sending beacons, but you can't tell that from a MAC table. – Ricky Beam Jan 8 '14 at 19:09
  • @RickyBeam It certainly isn't perfect, but it will get you 90% there. I admit that there is overlap, but Cisco's adapters aren't very common, and Dell's APs are made by Netgear. Also, if you capture many different transactions, you will see lots of different MACs all talking to a common MAC, namely the AP. – Ron Trunk Jan 8 '14 at 19:26
  • 1
    'given a list of macs' (read: no traffic to watch) the OUI will, indeed, be all you have, but I cannot overstate how much of colossal guess it really is. – Ricky Beam Jan 8 '14 at 19:31
  • I revised my answer based on your comments @RickyBeam – Ron Trunk Jan 8 '14 at 20:48
1

I use http://www.macvendorlookup.com/ on an almost daily basis to aid in forensics.

I.e. If you have a mac address you can them obtain the manufacturer to guess at what the machine is. Then you can use only that mac address to find out other information

MY-IDF-2960-241#sho mac address-table interface f0/25
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  48    0010.492b.dbcb    DYNAMIC     Fa0/25
 100    b8ca.3aa5.6f77    DYNAMIC     Fa0/25
Total Mac Addresses for this criterion: 2
MY-IDF-2960-241#

MY-MDF-4500X-1#sho arp | in 6f77
Internet  10.220.103.1            0   b8ca.3aa5.6f77  ARPA   Vlan100
MY-MDF-4500X-1#

C:\Users\superstar>ping -a 10.220.103.1
Pinging XXX-XXXX-WWK.supersecretdomainname.local [10.220.103.1] with 32 bytes
of data:
Reply from 10.220.103.1: bytes=32 time<1ms TTL=128
Reply from 10.220.103.1: bytes=32 time<1ms TTL=128
Reply from 10.220.103.1: bytes=32 time<1ms TTL=128
Reply from 10.220.103.1: bytes=32 time<1ms TTL=128

In the above example I took the mac address off of a port, found its IP via arp entries on my core switch, then found the hostname via a "ping -a" from my workstation. http://www.macvendorlookup.com/ lets us know that the mac was made by Dell so at this point we can

1) Logically locate the machine on the network
2) Physically locate the machine on premises
3) test further for open tcp ports to the host to guess what operating system is running

This may seem like a lengthy process but you can get quite fast at it and it definitely helps when you're mapping out the network of a new client.

P.S. If you look up the other mac address from my post, you can probably determine something else about the network I pull this output from.

0

Well, by simply looking at it? Not exactly.

There are obvious things you can do such as:
1. Look at the OUI (First 3 bytes of MAC) and see who owns it and just assume which is MORE LIKELY to be AP.
2. Look at a packet capture and see what information is going to/from the MAC.

Just remember that spoofing a MAC address is very easy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.