macadress

Guide ยท Wireshark & tshark

Update Wireshark's vendor lookups: the manuf file

The vendor name next to every MAC address in Wireshark's packet list comes from one text file, bundled at install time and never touched again until your next upgrade.

Open Wireshark, look at any packet's Ethernet layer, and you'll see something like Cisco_1a:2b:3c instead of a bare MAC address. That resolution comes from a single file, commonly called manuf, that ships with Wireshark and tshark. It's generated once when that Wireshark version is built and doesn't update itself: the vendor of an OUI IEEE assigned last month simply won't resolve until you either upgrade Wireshark or replace the file yourself.

Where the file lives

Wireshark looks in two places, in this order: a personal configuration directory that overrides the bundled copy, and the install directory itself. Replacing the personal copy is the one worth doing, since it survives Wireshark upgrades and doesn't need administrator privileges.

OSPersonal config (recommended)
macOS~/Library/Application Support/Wireshark/manuf
Linux~/.config/wireshark/manuf
Windows%APPDATA%\Wireshark\manuf

Not sure that's right for your install? Wireshark will tell you: open Help > About Wireshark and check the Folders tab for the exact "Personal configuration" path on your machine.

Replacing it

  1. Download the current file from macadress.com/downloads (direct link: manuf.txt).
  2. Rename it to manuf, no extension, and place it in your personal configuration directory from the table above (create the folder if it doesn't exist yet).
  3. Restart Wireshark, or the next tshark run, so it re-reads the file.
  4. Confirm it worked: open a capture, check a packet's Ethernet layer for a resolved vendor name, or open Edit > Preferences > Name Resolution and make sure MAC name resolution is enabled.

tshark reads the same personal configuration directory as the GUI, so there's nothing extra to do for command-line captures.

What's different from Wireshark's own file

Wireshark's official manuf file pairs each OUI with two names: a short, hand-picked abbreviation (Cisco) and IEEE's full registered organization name (Cisco Systems, Inc). That abbreviation is curated by the Wireshark project by hand and isn't part of IEEE's public data, so our file uses the full registered name in both fields instead: you'll see CISCO SYSTEMS, INC. where Wireshark's own file would show Cisco. Longer, but unambiguous, and it's the same tradeoff every third-party OUI file makes.

The format itself matches Wireshark's spec, including how it represents blocks narrower than a /24: a /28 block prints as a full 6-byte prefix with a /28 suffix (for example D07AB50000/28) rather than being dropped, so nothing from the smaller MA-M, MA-S, IAB, or CID allocations gets lost the way it would in a strict 24-bit format.

Already have a capture, an arp -a dump, or a log file with MAC addresses in it and just want the vendors, once, without touching your Wireshark install? Paste it into the extract tool instead. Scripting vendor resolution into something else entirely? The free JSON API covers that.

More guides

Cisco ISE ISE's profiler leans on the MAC vendor to fingerprint endpoints. When the Feed Service can't reach Cisco, or its cache just hasn't kept up with IEEE, here's how to load a current OUI file by hand. Nmap Every "MAC Address: ... (Vendor Name)" line nmap prints during a scan comes from nmap-mac-prefixes, a file that only updates when nmap itself does. CSV Six columns, one row per registered block, every OUI size IEEE assigns, not just the 24-bit ones. No account, no rate limit, just a file. JSON The same data as the CSV, as one JSON array, for anything that would rather Marshal than split on commas.