Subversion Repositories uuid_mac_utils

<?php

/*

 * MAC (EUI-48 and EUI-64) utils for PHP

 * Copyright 2017 - 2023 Daniel Marschall, ViaThinkSoft

 * Version 2023-05-01

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

const IEEE_MAC_REGISTRY = __DIR__ . '/../web-data';

/**

 * Checks if a MAC, EUI, or IPv6-LinkLocal address is valid

 * @param string $mac MAC, EUI, or IPv6-LinkLocal Address

 * @return bool True if it is valid

 */

function mac_valid(string $mac): bool {

        $tmp = ipv6linklocal_to_mac48($mac);

        if ($tmp !== false) $mac = $tmp;

        $mac = str_replace(array('-', ':'), '', $mac);

        $mac = strtoupper($mac);

        if ((strlen($mac) != 12) && (strlen($mac) != 16)) return false;

        $mac = preg_replace('@[0-9A-F]@', '', $mac);

        return ($mac === '');

}

/**

 * Returns the amount of bits of a MAC or EUI

 * @param string $mac

 * @return false|int

 */

function eui_bits(string $mac) {

        if (!mac_valid($mac)) return false;

        $mac = mac_canonize($mac, '');

        return (int)(strlen($mac)*4);

}

/**

 * Canonizes a MAC, EUI, or IPv6-LinkLocal address

 * @param string $mac MAC, EUI, or IPv6-LinkLocal Address

 * @param string $delimiter Desired delimiter for inserting between each octet

 * @return string|false The canonized address (Note: IPv6-Linklocal becomes EUI-64)

 */

function mac_canonize(string $mac, string $delimiter="-") {

        if (!mac_valid($mac)) return false;

        $tmp = ipv6linklocal_to_mac48($mac);

        if ($tmp !== false) $mac = $tmp;

        $mac = strtoupper($mac);

        $mac = preg_replace('@[^0-9A-F]@', '', $mac);

        if ((strlen($mac) != 12) && (strlen($mac) != 16)) return false;

        $mac = preg_replace('@^(..)(..)(..)(..)(..)(..)(..)(..)$@', '\\1'.$delimiter.'\\2'.$delimiter.'\\3'.$delimiter.'\\4'.$delimiter.'\\5'.$delimiter.'\\6'.$delimiter.'\\7'.$delimiter.'\\8', $mac);

        return preg_replace('@^(..)(..)(..)(..)(..)(..)$@', '\\1'.$delimiter.'\\2'.$delimiter.'\\3'.$delimiter.'\\4'.$delimiter.'\\5'.$delimiter.'\\6', $mac);

}

/**

 * @param string $file

 * @param string $oui_name

 * @param string $mac

 * @return false|string

 */

function _lookup_ieee_registry(string $file, string $oui_name, string $mac) {

        $mac = mac_canonize($mac, '');

        if ($mac === false) return false;

        $begin = substr($mac, 0, 2).'-'.substr($mac, 2, 2).'-'.substr($mac, 4, 2);

        $f = file_get_contents($file);

        $f = str_replace("\r", '', $f);

        # We are using a positive-lookahead because entries like the MA-M references have a blank line between organization and address

        preg_match_all('@^\s*'.preg_quote($begin, '@').'\s+\(hex\)\s+(\S+)\s+(.*)\n\n\s*(?=[0-9A-F])@ismU', "$f\n\nA", $m, PREG_SET_ORDER);

        foreach ($m as $n) {

                preg_match('@(\S+)\s+\(base 16\)(.*)$@ism', $n[2], $m);

                if (preg_match('@(.+)-(.+)@ism', $m[1], $o)) {

                        $z = hexdec(substr($mac, 6, 6));

                        $beg = hexdec($o[1]);

                        $end = hexdec($o[2]);

                        if (($z < $beg) || ($z > $end)) continue;

                } else {

                        $beg = 0x000000;

                        $end = 0xFFFFFF;

                }

                $x = trim(preg_replace('@^\s+@im', '', $m[2]));

                # "PRIVATE" entries are only marked at the "(hex)" line, but not at the "(base16)" line

                if ($x == '') $x = trim($n[1]);

                $x = explode("\n", $x);

                $ra_len = strlen(dechex($end-$beg));

                $out = sprintf("%-32s 0x%s\n", "IEEE $oui_name part:", substr($mac, 0, 12-$ra_len));

                $out .= sprintf("%-32s 0x%s\n", "NIC specific part:", substr($mac, 12-$ra_len));

                $out .= sprintf("%-32s %s\n", "Registrant:", $x[0]);

                foreach ($x as $n => $y) {

                        if ($n == 0) continue;

                        else if ($n == 1) $out .= sprintf("%-32s %s\n", "Address of registrant:", $y);

                        else if ($n >= 2) $out .= sprintf("%-32s %s\n", "", $y);

                }

                // TODO: also print the date of last update of the OUI files

                return $out;

        }

        return false;

}

/**

 * Try to Decapsulate EUI-64 into MAC-48 or EUI-48

 * @param string $eui64

 * @return false|string If EUI-64 can be converted into EUI-48, returns EUI-48, otherwise returns EUI-64. On invalid input, return false.

 */

function eui64_to_eui48(string $eui64) {

        if (!mac_valid($eui64)) return false;

        $eui64 = mac_canonize($eui64, '');

        if (eui_bits($eui64) == 48) return mac_canonize($eui64);

        if (substr($eui64, 6, 4) == 'FFFF') {

                // EUI-64 to MAC-48

                return mac_canonize(substr($eui64, 0, 6).substr($eui64, 10, 6));

        } else if (substr($eui64, 6, 4) == 'FFFE') {

                if ((hexdec($eui64[1])&2) == 2) {

                        // Modified EUI-64 to MAC/EUI-48

                        $eui64[1] = dechex(hexdec($eui64[1])&253); // remove bit

                        return mac_canonize(substr($eui64, 0, 6).substr($eui64, 10, 6));

                } else {

                        // EUI-64 to EUI-48

                        return mac_canonize(substr($eui64, 0, 6).substr($eui64, 10, 6));

                }

        } else {

                return mac_canonize($eui64);

        }

}

/**

 * MAC-48 to EUI-64 Encapsulation

 * @param string $mac48 MAC-48 address

 * @return false|string EUI-64 address

 */

function mac48_to_eui64(string $mac48) {

        // Note: MAC-48 is used for network hardware; EUI-48 is used to identify other devices and software.

        //       MAC48-to-EUI64 Encapsulation uses 0xFFFF middle part

        if (!mac_valid($mac48)) return false;

        $mac48 = mac_canonize($mac48, '');

        if (eui_bits($mac48) == 64) return mac_canonize($mac48);

        $eui64 = substr($mac48, 0, 6).'FFFF'.substr($mac48, 6, 6);

        return mac_canonize($eui64);

}

/**

 * EUI-48 to EUI-64 Encapsulation

 * @param string $eui48 EUI-48 address

 * @return false|string EUI-64 address

 */

function eui48_to_eui64(string $eui48) {

        // Note: MAC-48 is used for network hardware; EUI-48 is used to identify other devices and software.

        //       EUI48-to-EUI64 Encapsulation uses 0xFFFF middle part

        if (!mac_valid($eui48)) return false;

        $eui48 = mac_canonize($eui48, '');

        if (eui_bits($eui48) == 64) return mac_canonize($eui48);

        $eui64 = substr($eui48, 0, 6).'FFFE'.substr($eui48, 6, 6);

        return mac_canonize($eui64);

}

/**

 * MAC/EUI-48 to Modified EUI-64 Encapsulation

 * @param string $eui48 MAC-48 or EUI-48 address

 * @return false|string Modified EUI-64 address

 */

function maceui48_to_modeui64(string $eui48) {

        // Note: MAC-48 is used for network hardware; EUI-48 is used to identify other devices and software.

        //       EUI48-to-ModifiedEUI64 Encapsulation uses 0xFFFE middle part (SIC! This was a mistake by IETF, since it should actually be 0xFFFF!)

        if (!mac_valid($eui48)) return false;

        $eui48 = mac_canonize($eui48, '');

        if (eui_bits($eui48) == 64) return mac_canonize($eui48);

        $eui64 = substr($eui48, 0, 6).'FFFE'.substr($eui48, 6, 6);

        $eui64[1] = dechex(hexdec($eui64[1]) | 2); // flip seventh bit

        return mac_canonize($eui64);

}

/**

 * Try to convert IPv6-LinkLocal address to MAC-48

 * @param string $ipv6 IPv6-LinkLocal address

 * @return false|string MAC-48 (or IPv6 if it was no LinkLocal address, or Modified EUI-64 if it decapsulation failed)

 */

function ipv6linklocal_to_mac48(string $ipv6) {

        // https://stackoverflow.com/questions/12095835/quick-way-of-expanding-ipv6-addresses-with-php (modified)

        $tmp = inet_pton($ipv6);

        if ($tmp === false) return false;

        $hex = unpack("H*hex", $tmp);

        $ipv6 = substr(preg_replace("/([A-f0-9]{4})/", "$1:", $hex['hex']), 0, -1);

        // Remove "fe80::" to convert IPv6 Link Local address back to EUI-64

        // see https://support.lenovo.com/de/de/solutions/ht509925-how-to-convert-a-mac-address-into-an-ipv6-link-local-address-eui-64

        $cnt = 0;

        $mac = preg_replace('@^fe80:0000:0000:0000:@i', '', $ipv6, -1, $cnt);

        if ($cnt == 0) return false;

        // Set LAA to UAA again

        $mac_uaa_64 = $mac;

        $mac_uaa_64[1] = dechex(hexdec($mac_uaa_64[1]) & 253);

        $mac_uaa_48 = eui64_to_eui48($mac_uaa_64);

        if (eui_bits($mac_uaa_48) == 48) {

                return $mac_uaa_48; // Output MAC-48 (UAA)

        } else {

                return $mac; // Failed decapsulation; output Modified EUI-64 instead

        }

}

/**

 * Converts MAC-48 or EUI-48 to IPv6-LinkLocal (based on Modified EUI-64)

 * @param string $mac

 * @return false|string

 */

function maceui_to_ipv6linklocal(string $mac) {

        if (!mac_valid($mac)) return false;

        if (eui_bits($mac) == 48) {

                $mac = maceui48_to_modeui64($mac);

        }

        $mac = mac_canonize($mac, '');

        $mac = str_pad($mac, 16, '0', STR_PAD_LEFT);

        return strtolower('fe80::'.substr($mac,0, 4).':'.substr($mac,4, 4).':'.substr($mac,8, 4).':'.substr($mac,12, 4));

}

/**

 * Prints information about an IPv6-LinkLocal address, MAC, or EUI.

 * @param string $mac IPv6-LinkLocal address, MAC, or EUI

 * @return void

 * @throws Exception

 */

function decode_mac(string $mac) {

        // Amazing website about MAC addresses: https://mac-address.alldatafeeds.com/faq#how-to-recognise-mac-address-application

        echo sprintf("%-32s %s\n", "Input:", $mac);

        // Format MAC for machine readability

        $mac = mac_canonize($mac, '');

        $type = '';

        $tmp = ipv6linklocal_to_mac48($mac);

        if ($tmp !== false) {

                $mac = $tmp;

                $type = 'IPv6-Link-Local';

        }

        if (!mac_valid($mac)) throw new Exception("Invalid MAC address");

        if ($tmp === false) {

                if (eui_bits($mac) == 48) {

                        $type = 'MAC-48 (network hardware) or EUI-48 (other devices and software)';

                } else if (eui_bits($mac) == 64) {

                        if (substr($mac,6,4) == 'FFFE') {

                                if ((hexdec($mac[1])&2) == 2) {

                                        $type = 'EUI-64 (MAC/EUI-48 to Modified EUI-64 Encapsulation)';

                                } else {

                                        $type = 'EUI-64 (EUI-48 to EUI-64 Encapsulation)';

                                }

                        } else if (substr($mac,6,4) == 'FFFF') {

                                $type = 'EUI-64 (MAC-48 to EUI-64 Encapsulation)';

                        } else {

                                $type = 'EUI-64 (Regular)';

                        }

                } else {

                        assert(false); /** @phpstan-ignore-line */

                }

        }

        echo sprintf("%-32s %s\n", "Type:", $type);

        echo "\n";

        // Show various representations

        $eui48 = eui64_to_eui48($mac);

        echo sprintf("%-32s %s\n", "EUI-48:", (eui_bits($eui48) != 48) ? 'Not available' : $eui48);

        if (eui_bits($mac) == 48) {

                $eui64 = mac48_to_eui64($mac);

                echo sprintf("%-32s %s\n", "EUI-64:", ((eui_bits($eui64) != 64) ? 'Not available' : $eui64).' (MAC-48 to EUI-64 Encapsulation)');

                $eui64 = eui48_to_eui64($mac);

                echo sprintf("%-32s %s\n", "", ((eui_bits($eui64) != 64) ? 'Not available' : $eui64).' (EUI-48 to EUI-64 Encapsulation)');

                $eui64 = maceui48_to_modeui64($mac);

                echo sprintf("%-32s %s\n", "", ((eui_bits($eui64) != 64) ? 'Not available' : $eui64).' (MAC/EUI-48 to Modified EUI-64 Encapsulation)');

                $ipv6 = maceui_to_ipv6linklocal($mac);

                echo sprintf("%-32s %s\n", "IPv6 link local address:", $ipv6);

        } else {

                $eui64 = mac_canonize($mac);

                echo sprintf("%-32s %s\n", "EUI-64:", $eui64);

        }

        // Vergabestelle

        $ul = hexdec($mac[1]) & 2; // Bit #LSB+1 of Byte 1

        $ul_ = ($ul == 0) ? '[0] Universally Administered Address (UAA)' : '[1] Locally Administered Address (LAA)';

        echo sprintf("%-32s %s\n", "Administration type (U/L flag):", $ul_);

        // Empfaengergruppe

        $ig = hexdec($mac[1]) & 1; // Bit #LSB+0 of Byte 1

        $ig_ = ($ig == 0) ? '[0] Individual (Unicast)' : '[1] Group (Multicast)';

        echo sprintf("%-32s %s\n", "Transmission type (I/G flag):", $ig_);

        // Query IEEE registries

        // TODO: gilt OUI nur bei Individual UAA? For LAA, should we convert to UAA and then query the registry?

        if (count(glob(IEEE_MAC_REGISTRY.DIRECTORY_SEPARATOR.'*.txt')) > 0) {

                if (

                        # The IEEE Registration Authority distinguishes between IABs and OUI-36 values. Both are 36-bit values which may be used to generate EUI-48 values, but IABs may not be used to generate EUI-64 values.[6]

                        # Note: The Individual Address Block (IAB) is an inactive registry activity, which has been replaced by the MA-S registry product as of January 1, 2014.

                        ($x = _lookup_ieee_registry(IEEE_MAC_REGISTRY . DIRECTORY_SEPARATOR . 'iab.txt', 'IAB', $mac)) ||

                        ($x = _lookup_ieee_registry(IEEE_MAC_REGISTRY . DIRECTORY_SEPARATOR . 'oui36.txt', 'OUI-36 (MA-S)', $mac)) ||

                        ($x = _lookup_ieee_registry(IEEE_MAC_REGISTRY . DIRECTORY_SEPARATOR . 'mam.txt', 'OUI-28 (MA-M)', $mac)) ||

                        ($x = _lookup_ieee_registry(IEEE_MAC_REGISTRY . DIRECTORY_SEPARATOR . 'oui.txt', 'OUI-24 (MA-L)', $mac))

                ) {

                        echo $x;

                }

        }

        $vm = '';

        // === FAQ "Detection rules which don't have their dedicated page yet" ===

        // https://wiki.xenproject.org/wiki/Xen_Networking

        // https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx

        // https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms

        if (mac_between($mac, '00:16:3E:00:00:00', '00:16:3E:FF:FF:FF')) $vm = "Red Hat Xen, XenSource, Novell Xen";

        // http://techgenix.com/mac-address-pool-duplication-hyper-v/

        // https://docs.microsoft.com/en-us/system-center/vmm/network-mac?view=sc-vmm-1807

        // https://blogs.technet.microsoft.com/gbanin/2014/08/27/how-to-solve-mac-address-conflict-on-hyper-v/

        if (mac_between($mac, '00:1D:D8:B7:1C:00', '00:1D:D8:F4:1F:FF')) $vm = "Microsoft SCVMM (System Center Virtual Machine Manager)";

        // https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx

        // https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms/

        // https://blogs.technet.microsoft.com/medv/2011/01/24/how-to-manage-vm-mac-addresses-with-the-globalimagedata-xml-file-in-med-v-v1/

        if (mac_between($mac, '00:03:FF:00:00:00', '00:03:FF:FF:FF:FF')) $vm = "Microsoft Virtual PC / Virtual Server";

        // https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx

        if (mac_between($mac, '00:18:51:00:00:00', '00:18:51:FF:FF:FF')) $vm = "SWsoft";

        // https://macaddress.io/statistics/company/17619

        if (mac_between($mac, '58:9C:FC:00:00:00', '58:9C:FC:FF:FF:FF')) $vm = "bhyve by FreebsdF";

        // https://macaddress.io/statistics/company/17388

        if (mac_between($mac, '50:6B:8D:00:00:00', '50:6B:8D:FF:FF:FF')) $vm = "Nutanix AHV";

        // https://www.centos.org/forums/viewtopic.php?t=26739

        if (mac_between($mac, '54:52:00:00:00:00', '54:52:FF:FF:FF:FF')) $vm = "KVM (proxmox)";

        // Self tested (alldatafeeds.com)

        if (mac_between($mac, '96:00:00:00:00:00', '96:00:FF:FF:FF:FF')) $vm = "Hetzner vServer (based on KVM and libvirt)";

        // === FAQ "How to recognise a VMware's virtual machine by its MAC address?" ===

        if (mac_between($mac, '00:50:56:00:00:00', '00:50:56:FF:FF:FF')) $vm = "VMware vSphere, VMware Workstation, VMware ESX Server";

        if (mac_between($mac, '00:50:56:80:00:00', '00:50:56:BF:FF:FF')) $vm = "VMware vSphere managed by vCenter Server";

        if (mac_between($mac, '00:0C:29:00:00:00', '00:0C:29:FF:FF:FF')) $vm = "VMWare Standalone VMware vSphere, VMware Workstation, VMware Horizon";

        if (mac_between($mac, '00:05:69:00:00:00', '00:05:69:FF:FF:FF')) $vm = "VMware ESX, VMware GSX Server";

        if (mac_between($mac, '00:1C:14:00:00:00', '00:1C:14:FF:FF:FF')) $vm = "VMWare";

        // === FAQ "machine by its MAC address?" ===

        if (mac_between($mac, '00:1C:42:00:00:00', '00:1C:42:FF:FF:FF')) $vm = "Parallels Virtual Machine";

        // === FAQ "How to recognise a Docker container by its MAC address?" ===

        if (mac_between($mac, '02:42:00:00:00:00', '02:42:FF:FF:FF:FF')) $vm = "Docker container";

        // === FAQ =How to recognise a Microsoft Hyper-V's virtual machine by its MAC address?" ===

        if (mac_between($mac, '00:15:5D:00:00:00', '00:15:5D:FF:FF:FF')) $vm = "Microsoft Hyper-V";

        // === FAQ "How to recognise an Oracle Virtual machine by its MAC address?" ===

        if (mac_between($mac, '08:00:27:00:00:00', '08:00:27:FF:FF:FF')) $vm = "Oracle VirtualBox 5.2"; // Pcs Systemtechnik GmbH

        if (mac_between($mac, '52:54:00:00:00:00', '52:54:00:FF:FF:FF')) $vm = "Oracle VirtualBox 5.2 + Vagrant"; // 52:54:00 (Exact MAC: 52:54:00:C9:C7:04)

        if (mac_between($mac, '00:21:F6:00:00:00', '00:21:F6:FF:FF:FF')) $vm = "Oracle VirtualBox 3.3";

        if (mac_between($mac, '00:14:4F:00:00:00', '00:14:4F:FF:FF:FF')) $vm = "Oracle VM Server for SPARC";

        if (mac_between($mac, '00:0F:4B:00:00:00', '00:0F:4B:FF:FF:FF')) $vm = "Oracle Virtual Iron 4";

        if ($vm) {

                echo sprintf("%-32s %s\n", "Special use:", "Virtual machine $vm");

        }

        $app = '';

        // === FAQ "Other MAC address applications"

        // http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt

        // https://tools.ietf.org/html/rfc1060

        if (mac_between($mac, '03:00:00:01:00:00', '03:00:40:00:00:00')) $app = 'User-defined (per 802 spec), EtherType is 0x0802';

        if (mac_equals($mac, '01:00:1D:00:00:00')) $app = 'Cabletron PC-OV PC discover (on demand), EtherType is 0x0802';

        if (mac_equals($mac, '01:00:1D:42:00:00')) $app = 'Cabletron PC-OV Bridge discover (on demand), EtherType is 0x0802';

        if (mac_equals($mac, '01:00:1D:52:00:00')) $app = 'Cabletron PC-OV MMAC discover (on demand), EtherType is 0x0802';

        if (mac_between($mac, '01:00:3C:00:00:00' , '01:00:3C:FF:FF:FF')) $app = 'Auspex Systems (Serverguard)';

        if (mac_equals($mac, '01:00:10:00:00:20')) $app = 'Hughes Lan Systems Terminal Server S/W download, EtherType is 0x0802';

        if (mac_equals($mac, '01:00:10:FF:FF:20')) $app = 'Hughes Lan Systems Terminal Server S/W request, EtherType is 0x0802';

        if (mac_equals($mac, '01:00:81:00:00:00')) $app = 'Synoptics Network Management';

        if (mac_equals($mac, '01:00:81:00:00:02')) $app = 'Synoptics Network Management';

        if (mac_equals($mac, '01:00:81:00:01:00')) $app = 'Bay Networks (Synoptics) autodiscovery, EtherType is 0x0802 SNAP type is 0x01A2';

        if (mac_equals($mac, '01:00:81:00:01:01')) $app = 'Bay Networks (Synoptics) autodiscovery, EtherType is 0x0802 SNAP type is 0x01A1';

        if (mac_between($mac, '01:20:25:00:00:00', '01:20:25:7F:FF:FF')) $app = 'Control Technology Inc\'s Industrial Ctrl Proto., EtherType is 0x873A';

        if (mac_equals($mac, '01:80:24:00:00:00')) $app = 'Kalpana Etherswitch every 60 seconds, EtherType is 0x0802';

        if (mac_equals($mac, '01:DD:00:FF:FF:FF')) $app = 'Ungermann-Bass boot-me requests, EtherType is 0x7002';

        if (mac_equals($mac, '01:DD:01:00:00:00')) $app = 'Ungermann-Bass Spanning Tree, EtherType is 0x7005';

        if (mac_equals($mac, '03:00:00:00:00:10')) $app = 'OS/2 1.3 EE + Communications Manager, EtherType is 0x80D5';

        if (mac_equals($mac, '03:00:00:00:00:40')) $app = 'OS/2 1.3 EE + Communications Manager, EtherType is 0x80D5';

        if (mac_equals($mac, '03:00:00:00:01:00')) $app = 'OSI All-IS Multicast, EtherType is 0x0802';

        if (mac_equals($mac, '03:00:00:00:02:00')) $app = 'OSI All-ES Multicast, EtherType is 0x0802';

        if (mac_equals($mac, '03:00:00:80:00:00')) $app = 'Discovery Client, EtherType is 0x0802';

        if (mac_equals($mac, '03:00:FF:FF:FF:FF')) $app = 'All Stations address, EtherType is 0x0802';

        if (mac_between($mac, '09:00:0D:00:00:00', '09:00:0D:FF:FF:FF')) $app = 'ICL Oslan Multicast, EtherType is 0x0802';

        if (mac_equals($mac, '09:00:0D:02:00:00')) $app = 'ICL Oslan Service discover only on boot';

        if (mac_equals($mac, '09:00:0D:02:0A:3C')) $app = 'ICL Oslan Service discover only on boot';

        if (mac_equals($mac, '09:00:0D:02:0A:38')) $app = 'ICL Oslan Service discover only on boot';

        if (mac_equals($mac, '09:00:0D:02:0A:39')) $app = 'ICL Oslan Service discover only on boot';

        if (mac_equals($mac, '09:00:0D:02:FF:FF')) $app = 'ICL Oslan Service discover only on boot';

        if (mac_equals($mac, '09:00:0D:09:00:00')) $app = 'ICL Oslan Service discover as required';

        if (mac_equals($mac, '09:00:1E:00:00:00')) $app = 'Apollo DOMAIN, EtherType is 0x8019';

        if (mac_equals($mac, '09:00:02:04:00:01')) $app = 'Vitalink printer messages, EtherType is 0x8080';

        if (mac_equals($mac, '09:00:02:04:00:02')) $app = 'Vitalink bridge management, EtherType is 0x8080';

        if (mac_equals($mac, '09:00:4C:00:00:0F')) $app = 'BICC Remote bridge adaptive routing (e.g. to Retix), EtherType is 0x0802';

        if (mac_equals($mac, '09:00:4E:00:00:02')) $app = 'Novell IPX, EtherType is 0x8137';

        if (mac_equals($mac, '09:00:6A:00:01:00')) $app = 'TOP NetBIOS';

        if (mac_equals($mac, '09:00:7C:01:00:01')) $app = 'Vitalink DLS Multicast';

        if (mac_equals($mac, '09:00:7C:01:00:03')) $app = 'Vitalink DLS Inlink';

        if (mac_equals($mac, '09:00:7C:01:00:04')) $app = 'Vitalink DLS and non DLS Multicast';

        if (mac_equals($mac, '09:00:7C:02:00:05')) $app = 'Vitalink diagnostics, EtherType is 0x8080';

        if (mac_equals($mac, '09:00:7C:05:00:01')) $app = 'Vitalink gateway, EtherType is 0x8080';

        if (mac_equals($mac, '09:00:7C:05:00:02')) $app = 'Vitalink Network Validation Message';

        if (mac_equals($mac, '09:00:09:00:00:01')) $app = 'HP Probe, EtherType is 0x8005 or 0x0802';

        if (mac_equals($mac, '09:00:09:00:00:04')) $app = 'HP DTC, EtherType is 0x8005';

        if (mac_equals($mac, '09:00:26:01:00:01')) $app = 'Vitalink TransLAN bridge management, EtherType is 0x8038';

        if (mac_equals($mac, '09:00:39:00:70:00')) $app = 'Spider Systems Bridge';

        if (mac_between($mac, '09:00:56:00:00:00', '09:00:56:FE:FF:FF')) $app = 'Stanford reserved';

        if (mac_between($mac, '09:00:56:FF:00:00', '09:00:56:FF:FF:FF')) $app = 'Stanford V Kernel, version 6.0, EtherType is 0x805C';

        if (mac_equals($mac, '09:00:77:00:00:00')) $app = 'Retix Bridge Local Management System, EtherType is 0x0802';

        if (mac_equals($mac, '09:00:77:00:00:01')) $app = 'Retix spanning tree bridges, EtherType is 0x0802';

        if (mac_equals($mac, '09:00:77:00:00:02')) $app = 'Retix Bridge Adaptive routing, EtherType is 0x0802';

        if (mac_equals($mac, '09:00:87:80:FF:FF')) $app = 'Xyplex Terminal Servers, EtherType is 0x0889';

        if (mac_equals($mac, '09:00:87:90:FF:FF')) $app = 'Xyplex Terminal Servers, EtherType is 0x0889';

        if (mac_between($mac, '44:38:39:FF:00:00', '44:38:39:FF:FF:FF')) $app = 'Multi-Chassis Link Aggregation (Cumulus Linux)';

        if (mac_equals($mac, 'FF:FF:00:40:00:01')) $app = 'LANtastic, EtherType is 0x81D6';

        if (mac_equals($mac, 'FF:FF:00:60:00:04')) $app = 'LANtastic, EtherType is 0x81D6';

        if (mac_equals($mac, 'FF:FF:01:E0:00:04')) $app = 'LANtastic';

        // === FAQ "The "CF" series MAC addresses" ===

        // https://www.iana.org/assignments/ppp-numbers/ppp-numbers.xhtml

        // https://tools.ietf.org/html/rfc2153

        // https://tools.ietf.org/html/rfc7042#section-2.3.2

        if (mac_between($mac, 'CF:00:00:00:00:00', 'CF:00:00:FF:FF:FF')) $app = 'Reserved';

        if (mac_equals($mac, 'CF:00:00:00:00:00')) $app = 'Used for Ethernet loopback tests';

        // === FAQ "How to recognise a Broadcast MAC address application?" ===

        if (mac_equals($mac, 'FF:FF:FF:FF:FF:FF')) echo sprintf("%-32s %s\n", "Special use:", "Broadcast messaging");

        // === FAQ "How to recognise a Virtual Router ID by MAC address?" ===

        // https://tools.ietf.org/html/rfc7042#section-5.1

        // https://tools.ietf.org/html/rfc5798

        if (mac_between($mac, '00:00:5E:00:01:00', '00:00:5E:00:01:FF')) $app = 'IPv4 Virtual Router Redundancy Protocol  (VRRP)';

        if (mac_between($mac, '00:00:5E:00:02:00', '00:00:5E:00:02:FF')) $app = 'IPv6 Virtual Router Redundancy Protocol';

        // === FAQ "How to recognise an IP frame by MAC address?" ===

        // https://tools.ietf.org/html/rfc1060

        // https://en.wikipedia.org/wiki/Multicast_address#cite_note-15

        // https://tools.ietf.org/html/rfc2464

        // https://www.iana.org/go/rfc1112

        // http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt

        if (mac_between($mac, '01:00:5E:00:00:00', '01:00:5E:7F:FF:FF')) $app = 'IPv4 Multicast (EtherType is 0x0800)';

        if (mac_between($mac, '33:33:00:00:00:00', '33:33:FF:FF:FF:FF')) $app = 'IPv6 Multicast. IPv6 neighbor discovery (EtherType is 0x86DD)'; // TODO: Dabei werden die untersten 32 Bit der IPv6-Multicast-Adresse in die MAC-Adresse eingebettet.

        if (mac_between($mac, '00:00:5E:00:52:13', '00:00:5E:00:52:13')) $app = 'Proxy Mobile IPv6';

        if (mac_between($mac, '00:00:5E:FE:C0:00:02:00', '00:00:5E:FE:C0:00:02:FF')) $app = 'IPv4 derived documentation';

        if (mac_between($mac, '00:00:5E:FE:C6:33:64:00', '00:00:5E:FE:C6:33:64:FF')) $app = 'IPv4 derived documentation';

        if (mac_between($mac, '00:00:5E:FE:CB:00:71:00', '00:00:5E:FE:CB:00:71:FF')) $app = 'IPv4 derived documentation';

        if (mac_equals($mac, '00:00:5E:FE:EA:C0:00:02')) $app = 'IPv4 multicast derived documentation';

        if (mac_equals($mac, '00:00:5E:FE:EA:C6:33:64')) $app = 'IPv4 multicast derived documentation';

        if (mac_equals($mac, '00:00:5E:FE:EA:CB:00:71')) $app = 'IPv4 multicast derived documentation';

        if (mac_between($mac, '01:00:5E:FE:C0:00:02:00', '01:00:5E:FE:C0:00:02:FF')) $app = 'IPv4 derived documentation';

        if (mac_between($mac, '01:00:5E:FE:C6:33:64:00', '01:00:5E:FE:C6:33:64:FF')) $app = 'IPv4 derived documentation';

        if (mac_between($mac, '01:00:5E:FE:CB:00:71:00', '01:00:5E:FE:CB:00:71:FF')) $app = 'IPv4 derived documentation';

        if (mac_equals($mac, '01:00:5E:FE:EA:C0:00:02')) $app = 'IPv4 multicast derived documentation';

        if (mac_equals($mac, '01:00:5E:FE:EA:C6:33:64')) $app = 'IPv4 multicast derived documentation';

        if (mac_equals($mac, '01:00:5E:FE:EA:CB:00:71')) $app = 'IPv4 multicast derived documentation';

        if (mac_between($mac, '01:80:C2:00:00:20', '01:80:C2:00:00:2F')) $app = 'Reserved for use by Multiple Registration Protocol (MRP) applications';

        if (mac_between($mac, '02:00:5E:FE:00:00:00:00', '02:00:5E:FE:FF:FF:FF:FF')) $app = 'IPv4 Addr Holders';

        if (mac_equals($mac, '03:00:00:20:00:00')) $app = 'IP multicast address';

        if (mac_equals($mac, 'C0:00:00:04:00:00')) $app = 'IP multicast address';

        if (mac_between($mac, '03:00:5E:FE:00:00:00:00', '03:00:5E:FE:FF:FF:FF:FF')) $app = 'IPv4 Addr Holders';

        // === FAQ "How to recognise a MPLS multicast frame by MAC address?" ===

        // http://www.iana.org/go/rfc5332

        // http://www.iana.org/go/rfc7213

        if (mac_between($mac, '01:00:5E:80:00:00', '01:00:5E:8F:FF:FF')) $app = 'MPLS multicast (EtherType is 0x8847 or 0x8848)';

        if (mac_equals($mac, '01:00:5E:90:00:00')) $app = 'MPLS-TP p2p';

        // === FAQ "How to recognise a Bidirectional Forwarding Detection (BFD) on Link Aggregation Group (LAG) interfaces by MAC address?" ===

        // http://www.iana.org/go/rfc7130

        if (mac_equals($mac, '01:00:5E:90:00:01')) $app = 'Bidirectional Forwarding Detection (BFD) on Link Aggregation Group (LAG) interfaces';

        // === FAQ "How to recognise Token Ring specific functions by MAC address?" ===

        // https://tools.ietf.org/html/rfc1060

        // https://tools.ietf.org/html/rfc1469

        // https://standards.ieee.org/products-services/regauth/grpmac/public.html

        // https://tools.ietf.org/html/rfc2470

        // http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt

        if (mac_equals($mac, '03:00:00:00:00:01')) $app = 'NetBIOS (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:00:02')) $app = 'Locate - Directory Server (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:00:04')) $app = 'Synchronous Bandwidth Manager (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:00:08')) $app = 'Configuration Report Server (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:00:10')) $app = 'Ring Error Monitor (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:00:20')) $app = 'Network Server Heartbeat (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:00:40')) $app = 'Ring Parameter Monitor (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:00:80')) $app = 'Active Monitor (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:04:00')) $app = 'LAN Manager (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:08:00')) $app = 'Ring Wiring Concentrator (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:10:00')) $app = 'LAN Gateway (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:20:00')) $app = 'Ring Authorization Server (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:40:00')) $app = 'IMPL Server (Token Ring)';

        if (mac_equals($mac, '03:00:00:00:80:00')) $app = 'Bridge (Token Ring)';

        if (mac_equals($mac, '03:00:00:20:00:00')) $app = 'Single Token-Ring functional address';

        if (mac_equals($mac, '03:00:00:00:00:08')) $app = 'Configuration Report Server (CRS) MAC Group address';

        if (mac_equals($mac, '03:00:00:00:00:10')) $app = 'Ring Error Monitor (REM) MAC Group address';

        if (mac_equals($mac, '03:00:00:00:00:40')) $app = 'Ring Parameter Server (RPS) MAC group address';

        if (mac_equals($mac, '03:00:00:00:01:00')) $app = 'All Intermediate System Network Entities address';

        if (mac_equals($mac, '03:00:00:00:02:00')) $app = 'All End System Network Entities address, and Lobe Media Test (LMT) MAC group address';

        if (mac_equals($mac, '03:00:00:00:04:00')) $app = 'Generic address for all Manager Stations';

        if (mac_equals($mac, '03:00:00:00:08:00')) $app = 'All CONs SNARES address';

        if (mac_equals($mac, '03:00:00:00:10:00')) $app = 'All CONs End System address';

        if (mac_equals($mac, '03:00:00:00:20:00')) $app = 'Loadable Device Generic address';

        if (mac_equals($mac, '03:00:00:00:40:00')) $app = 'Load Server Generic address';

        if (mac_equals($mac, '03:00:00:40:00:00')) $app = 'Generic address for all Agent Stations';

        if (mac_equals($mac, 'C0:00:00:04:00:00')) $app = 'Single Token-Ring functional address';

        if (mac_equals($mac, '03:00:80:00:00:00')) $app = 'IPv6 multicast over Token Ring: all-Nodes (FF01::1 and FF02::1) and solicited node (FF02:0:0:0:0:1:FFXX:XXXX) addresses';

        if (mac_equals($mac, '03:00:40:00:00:00')) $app = 'IPv6 multicast over Token Ring: all-Routers addresses (FF0X::2)';

        if (mac_equals($mac, '03:00:00:80:00:00')) $app = 'IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 000';

        if (mac_equals($mac, '03:00:00:40:00:00')) $app = 'IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 001';

        if (mac_equals($mac, '03:00:00:20:00:00')) $app = 'IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 010';

        if (mac_equals($mac, '03:00:00:10:00:00')) $app = 'IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 011';

        if (mac_equals($mac, '03:00:00:08:00:00')) $app = 'IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 100';

        if (mac_equals($mac, '03:00:00:04:00:00')) $app = 'IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 101';

        if (mac_equals($mac, '03:00:00:02:00:00')) $app = 'IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 110';

        if (mac_equals($mac, '03:00:00:01:00:00')) $app = 'IPv6 multicast over Token Ring: any other multicast address with three least significant bits = 111';

        // === FAQ "How to recognise an AppleTalk protocols by MAC address?" ===

        // https://tools.ietf.org/html/rfc1060

        // http://www.cavebear.com/archive/cavebear/Ethernet/Ethernet.txt

        if (mac_between($mac, '09:00:07:00:00:00', '09:00:07:00:00:FC')) $app = 'AppleTalk zone multicast addresses (EtherType is 0x0802)';

        if (mac_equals($mac, '09:00:07:FF:FF:FF')) $app = 'AppleTalk broadcast address (EtherType is 0x0802)';

        // === FAQ "How to recognise a TRILL protocols by MAC address?" ===

        // http://www.iana.org/go/rfc7455

        // https://tools.ietf.org/html/draft-ietf-trill-oam-framework-04

        // https://standards.ieee.org/products-services/regauth/grpmac/public.html