Wireshark and Wireshark OUI Looktup tool do not seem to recognize locally administrated OUIs. According to https://en.wikipedia.org/wiki/MAC_address the first 3 octets/first-half of a MAC-48/EUI-48 Address, correspond to the OUI (e.g.: MAC = 06:00:00:xx:xx:xx, OUI = 06:00:00), and the 2nd least significant bit of its first octet is used to differentiate "Universally" and "Locally" administered addresses). In other words, if we convert 06 (Hex) to 00000110 (Binary), we can see that the U/L bit is set to one, which means that it a locally administered address. Given this if we disable that bit, we get the matching "Universally Administered Address" 00000100 (Binary), 04 (Hex) -> "04:00:00", hence my question: Shouldn't "04:00:00" and "06:00:00" resolve on the OUI Lookup tool to the same organization?
"Universal vs. local[edit] Addresses can either be universally administered addresses or locally administered addresses. A universally administered address is uniquely assigned to a device by its manufacturer. The first three octets (in transmission order) identify the organization that issued the identifier and are known as the Organizationally Unique Identifier (OUI).[4] The remainder of the address (three octets for MAC-48 and EUI-48 or five for EUI-64) are assigned by that organization in nearly any manner they please, subject to the constraint of uniqueness. A locally administered address is assigned to a device by a network administrator, overriding the burned-in address. Universally administered and locally administered addresses are distinguished by setting the second-least-significant bit of the first octet of the address. This bit is also referred to as the U/L bit, short for Universal/Local, which identifies how the address is administered. If the bit is 0, the address is universally administered. If it is 1, the address is locally administered. In the example address 06-00-00-00-00-00 the first octet is 06 (hex), the binary form of which is 00000110, where the second-least-significant bit is 1. Therefore, it is a locally administered address.[7] Consequently, this bit is 0 in all OUIs." asked 01 Mar '17, 06:13  jrmfreitas |
One Answer:
Consequently, this bit is 0 in all OUIs. I think that's the point. If it's 1, then the first 3 octets no longer represent an OUI. Locally administered addresses can be set to anything by anyone, so you can't infer anything about what the OUI would be if the bit had been set to 0. I'm sure there's another more authoritative source, but from http://www.thefullwiki.org/Locally_Administered_Address#Address_details: "A locally administered address is assigned to a device by a network administrator, overriding the burned-in address. Locally administered addresses do not contain OUIs." answered 01 Mar '17, 09:23  cmaynard ♦♦ |
Here is a document from the IEEE Registration Authority:
http://standards.ieee.org/develop/regauth/tut/eui.pdf
Page 4, paragraph 1 states: A CID has the X bit equal to one and consequently that places any address with the CID as its first three octets in the local address space (U/L = 1). Local addresses are not globally unique, but a network administrator is responsible for assuring that any local addresses assigned are unique within the span of use. (Uniqueness of local addresses typically does not need to extend beyond a router.)
Thanks for providing the authoritative source! :)
Thanks for sharing this documentation, your feedback does make sense :)