All Apps and Add-ons

Can another MAC addr lookup source be used?

staten
Observer

I'm trying to use the "Add-On for MAC Lookup " and it errors with 'command="maclookup", : failed to use the netaddr module!'

For example, my Splunk search produces a table with 1 entry:
dest_hostname dest_nt_host dest_ip dest_mac dest_subnet_name
android-1fe665ec066a8cdd android-1fe665ec066a8cdd.home 10.1.1.99 dc:44:b6:99:f9:a5 Guest-Wifi

whereupon I invoke maclookup:
...
| table dest_hostname, dest_nt_host, dest_ip, dest_mac, dest_subnet_name
| maclookup field=dest_mac
...

resulting in:
command="maclookup", : failed to use the netaddr module!

No results found.

Enabling debug, I see the following in maclookup.log:
2018-11-26 15:39:55,142 INFO maclookup:139 - using mac to lookup : dc:44:b6:99:f9:a5
2018-11-26 15:39:55,142 INFO maclookup:141 - netaddr lookup: DC-44-B6-99-F9-A5 ...
2018-11-26 15:39:55,224 ERROR maclookup:154 - failed to use the netaddr module!

I've restarted splunkd on this system (RHEL 7.5) a few times, and even rebooted the server, but that hasn't made a difference.

It seems that this error is the result of an OEM vendor not being found in the netaddr lookup.
When I manually paste the MAC addr dc:44:b6:99:f9:a5 into https://www.macvendorlookup.com/ , the site returns:

Company: No Vendor Exists

When the table includes a different MAC addr, netaddr may give no error. For example, if the table includes:
dest_hostname dest_nt_host dest_ip dest_mac dest_subnet_name
ETs-Phone ETs-Phone.home 10.1.1.50 00:56:cd:95:16:62 Guest-Wifi

... maclookup gives no error.
When I manually paste the MAC addr 00:56:cd:95:16:62 into https://www.macvendorlookup.com/ , the site returns:
Company: Apple, Inc.

This leads me to the question of whether we can get this add-on to use a different site, such as https://www.wireshark.org/tools/oui-lookup.html

Thanks.

0 Karma

MuS
Legend

Hi staten,

Sorry for the late reply. Not at the moment, but I can add something like this in a later version.

Hope this helps ...

cheers, MuS

0 Karma

staten
Observer

Correction to my question: Can we enable this add-on to use a different lookup/source* for MAC OEM vendor data?

*replaced "site"

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...