As you have figured out, the first 3 octets define the vendor who owns the block of MAC address.
The last 3 are the unique address. No encodeing of device type.
The PCI space does include device type encoding if you look under device manager / properties / Details / Device Instance ID PCI\VEN_8086&DEV_1096&SUBSYS_34768086&REV_01\6&748A419&0&01100010
(Window -- Sorry Linux and I don't get along.)
Sites like http://www.pcidatabase.com/ will let you enter the vendor (8086) and the device (1096) and tell yo uthat my NIC is a Intel PRO/1000 EB.
Doc_SilverCreek, Thanks for your response. I ought to have include a little more information in my question as the mac address is all I have to identify the devices. I have 4 of them showing on this network and I do not know where they are or what they are. That is why I am attempting to decipher the device type by the mac address. I have a small range of IP's distributed through a DHCP server, the balance are static IP's. I have shutdown the DHCP server and deleted the IP's issued, removed them from the DNS forward and reverse lookup zones, and yet I can ping the IP's with a valid response. If I turn DHCP back on, immediately the IP's are taken again. I am sure the lease wasn't up in the time that I had DHCP down as it is difficult to not have it up for a long time. It appears like I am chasing a ghost... I have setup a computer and used one of the DHCP addresses, deleted from the DHCP server to determine that ping did not respond. And that is the case, so I am making an assumption that a ping response is from an active device. nbtstat -A resolves to host not found. There is not a WINS server, it is a Microsoft AD environment. The way I determined the mac address was through arp -a. Any other thoughts would be appreciated.
One possibility I can think of is some Intel Servers support dual MAC address per physical port for direct access to the server BMC. One MAC connects to the main OS controlled NIC, the second just has access to the BMC for network management.
By default, the BMC NIC is usually off, but .....
The BMC NIC is always 1 address (2h) higher or lower than the mother board NIC so if you scan the network and find a known MAC one address off the unknown, you have your culprit.
I use Advance IP scanner (http://www.radmin.com/products/utilities/ipscanner.php) to sweep the network IP addresses and then do a arp -a to confirm my MAC's (for some reason this tool does not see my systems if they are in WinPE but arp -a does)
The result being I have a system (both dynamic in my case) one address apart
A8 is the motherboard OS NIC and AA is the BMC NIC
220.127.116.11 00-15-17-9e-1e-a8 dynamic
18.104.22.168 00-15-17-9e-1e-aa dynamic