Similar to a previous question, under certain circumstances the maclookup fails with an error message:
command="maclookup", : failed to use the netaddr module!
After a bit of digging (and a reference in a previous question) this appears to happen when a MAC address is not found in any lists online or offline.
| makeresults | eval src_mac="0A:58:0A:F4:01:01" | maclookup
| makeresults | eval src_mac="00:50:56:AB:64:11" | maclookup
In these instances, shouldn't the script return something like "Unknown Vendor"?
You could also address this issue, by adding something like the below on your local/props.conf to force unknown to vendor field, so your command [assuming depends on vendor] may work.
Thanks for the response - I'll try it out.
I suspect, though, that it's the actual python script that can't handle an 'unknown' response from macvendors.co
If you have a number of mac addresses to look up, the 1st one that 'fails' causes the entire search string to stop.