I have a mac address, actually 4 similar mac addresses that I am attempting to determine the device type. The first 3 octets are 00-15-17 which when I looked up pointed to Intel Corporate. The 4th octet is c1. Would someone tell me where I can look this up to determine the device type? Or what the device type is please?
As you have figured out, the first 3 octets define the vendor who owns the block of MAC address.
The last 3 are the unique address. No encodeing of device type.
The PCI space does include device type encoding if you look under device manager / properties / Details / Device Instance ID PCI\VEN_8086&DEV_1096&SUBSYS_34768086&REV_01\6&748A419&0&01100010
(Window -- Sorry Linux and I don't get along.)
Sites like http://www.pcidatabase.com/ will let you enter the vendor (8086) and the device (1096) and tell yo uthat my NIC is a Intel PRO/1000 EB.
Doc_SilverCreek, Thanks for your response. I ought to have include a little more information in my question as the mac address is all I have to identify the devices. I have 4 of them showing on this network and I do not know where they are or what they are. That is why I am attempting to decipher the device type by the mac address. I have a small range of IP's distributed through a DHCP server, the balance are static IP's. I have shutdown the DHCP server and deleted the IP's issued, removed them from the DNS forward and reverse lookup zones, and yet I can ping the IP's with a valid response. If I turn DHCP back on, immediately the IP's are taken again. I am sure the lease wasn't up in the time that I had DHCP down as it is difficult to not have it up for a long time. It appears like I am chasing a ghost... I have setup a computer and used one of the DHCP addresses, deleted from the DHCP server to determine that ping did not respond. And that is the case, so I am making an assumption that a ping response is from an active device. nbtstat -A resolves to host not found. There is not a WINS server, it is a Microsoft AD environment. The way I determined the mac address was through arp -a. Any other thoughts would be appreciated.
The BMC NIC is always 1 address (2h) higher or lower than the mother board NIC so if you scan the network and find a known MAC one address off the unknown, you have your culprit.
I use Advance IP scanner (http://www.radmin.com/products/utilities/ipscanner.php) to sweep the network IP addresses and then do a arp -a to confirm my MAC's (for some reason this tool does not see my systems if they are in WinPE but arp -a does)
The result being I have a system (both dynamic in my case) one address apart
A8 is the motherboard OS NIC and AA is the BMC NIC
188.8.131.52 00-15-17-9e-1e-a8 dynamic 184.108.40.206 00-15-17-9e-1e-aa dynamic
220.127.116.11 00-15-17-9e-1e-a8 dynamic
18.104.22.168 00-15-17-9e-1e-aa dynamic