Refresh nmap's MAC vendor guesses (nmap-mac-prefixes)

Run nmap -sn 192.168.1.0/24 and every host nmap finds by ARP comes back with a vendor guess, printed straight from a bundled data file called nmap-mac-prefixes. It's used the same way during -O and -A scans whenever a target's MAC is visible. Like most bundled OUI files, it's frozen at whatever IEEE looked like when that nmap build shipped, and distro package updates for nmap aren't exactly frequent.

Finding the file

Nmap looks for its data files in a specific order: a directory passed via --datadir, a directory named by the NMAPDIR environment variable, the directory containing the nmap executable, and finally a compiled-in default. That default is typically one of these:

Option A: a personal copy, no sudo, survives upgrades

This is the one worth setting up once. Point nmap at your own data directory instead of overwriting the system one, so a package manager upgrade of nmap can't quietly revert your change:

mkdir -p ~/.nmap-data
cp -r /usr/share/nmap/* ~/.nmap-data/    # adjust the source path from the table above
curl -o ~/.nmap-data/nmap-mac-prefixes https://macadress.com/downloads/nmap-mac-prefixes.txt
nmap --datadir ~/.nmap-data -sn 192.168.1.0/24

Make it permanent by exporting NMAPDIR in your shell profile instead of typing --datadir every time:

echo 'export NMAPDIR="$HOME/.nmap-data"' >> ~/.zshrc

Option B: replace the system file directly

Simpler, but it needs root, and a package upgrade of nmap will overwrite it again:

sudo curl -o /usr/share/nmap/nmap-mac-prefixes https://macadress.com/downloads/nmap-mac-prefixes.txt

Either way, the format is exactly what nmap expects: a 6-digit hex OUI, a space, then the vendor name, one per line, 24-bit blocks only. The file has no room for a mask, so the same reasoning as our Cisco ISE guide applies: MA-M, MA-S, IAB, and CID blocks aren't representable in this format and are left out rather than guessed at.

Scanning a live network and want more than a vendor guess for one address, whether it looks like a randomized or private MAC, for instance? Paste it into the web lookup. Automating this against scan output at scale? The free JSON API takes a batch of addresses in one request.