Allow the "manuf" file to contain well-known MAC addresses and address

ranges specified with a mask, as well as manufacturer OUIs.  Match the
address range values, as well as MAC addresses and manufacturer OUIs,
when translating MAC addresses to names.

Have "make-manuf" read a file containing the well-known addresses and
append it to the list of OUIs.

svn path=/trunk/; revision=6233

6 files changed, 791 insertions, 78 deletions

diff --git a/Makefile.am b/Makefile.am
index e5d89e4598..0bb70d8ec6 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,7 +1,7 @@
 # Makefile.am
 # Automake file for Ethereal
 #
-# $Id: Makefile.am,v 1.472 2002/09/07 10:04:41 jmayer Exp $
+# $Id: Makefile.am,v 1.473 2002/09/09 19:38:08 guy Exp $
 #
 # Ethereal - Network traffic analyzer
 # By Gerald Combs <gerald@ethereal.com>
@@ -1018,6 +1018,7 @@ EXTRA_DIST = \
 	text2pcap-scanner.l     \
 	text2pcap.c             \
 	text2pcap.h             \
+	wka.tmpl		\
 	x11-fields
 
 if SETUID_INSTALL
diff --git a/epan/resolv.c b/epan/resolv.c
index 495c23229f..1ca6638d10 100644
--- a/epan/resolv.c
+++ b/epan/resolv.c
@@ -1,7 +1,7 @@
 /* resolv.c
  * Routines for network object lookup
  *
- * $Id: resolv.c,v 1.25 2002/08/28 20:40:45 jmayer Exp $
+ * $Id: resolv.c,v 1.26 2002/09/09 19:38:11 guy Exp $
  *
  * Laurent Deniel <deniel@worldnet.fr>
  *
@@ -28,6 +28,7 @@
 # include "config.h"
 #endif
 
+#include <ctype.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -152,11 +153,14 @@ static hashname_t 	*tcp_port_table[HASHPORTSIZE];
 static hashname_t       *sctp_port_table[HASHPORTSIZE];
 static hashether_t 	*eth_table[HASHETHSIZE];
 static hashmanuf_t 	*manuf_table[HASHMANUFSIZE];
+static hashether_t 	*(*wka_table[48])[HASHETHSIZE];
 static hashipxnet_t 	*ipxnet_table[HASHIPXNETSIZE];
 
 static int 		eth_resolution_initialized = 0;
 static int 		ipxnet_resolution_initialized = 0;
 
+static hashether_t *add_eth_name(const guint8 *addr, const guchar *name);
+
 /*
  * Flag controlling what names to resolve.
  */
@@ -432,7 +436,110 @@ static int fgetline(char **buf, int *size, FILE *fp)
  */
 
 
-static int parse_ether_line(char *line, ether_t *eth, int six_bytes)
+/*
+ * If "manuf_file" is FALSE, parse a 6-byte MAC address.
+ * If "manuf_file" is TRUE, parse an up-to-6-byte sequence with an optional
+ * mask.
+ */
+static gboolean
+parse_ether_address(const char *cp, ether_t *eth, unsigned int *mask,
+                    gboolean manuf_file)
+{
+  int i;
+  unsigned long num;
+  char *p;
+  char sep = '\0';
+
+  for (i = 0; i < 6; i++) {
+    /* Get a hex number, 1 or 2 digits, no sign characters allowed. */
+    if (!isxdigit((unsigned char)*cp))
+      return FALSE;
+    num = strtoul(cp, &p, 16);
+    if (p == cp)
+      return FALSE;	/* failed */
+    if (num > 0xFF)
+      return FALSE;	/* not a valid octet */
+    eth->addr[i] = num;
+    cp = p;		/* skip past the number */
+
+    /* OK, what character terminated the octet? */
+    if (*cp == '/') {
+      /* "/" - this has a mask. */
+      if (!manuf_file) {
+      	/* Entries with masks are allowed only in the "manuf" files. */
+	return FALSE;
+      }
+      cp++;	/* skip past the '/' to get to the mask */
+      if (!isdigit((unsigned char)*cp))
+	return FALSE;	/* no sign allowed */
+      num = strtoul(cp, &p, 10);
+      if (p == cp)
+	return FALSE;	/* failed */
+      cp = p;	/* skip past the number */
+      if (*cp != '\0' && !isspace((unsigned char)*cp))
+	return FALSE;	/* bogus terminator */
+      if (num == 0 || num >= 48)
+	return FALSE;	/* bogus mask */
+      /* Mask out the bits not covered by the mask */
+      *mask = num;
+      for (i = 0; num >= 8; i++, num -= 8)
+	;	/* skip octets entirely covered by the mask */
+      /* Mask out the first masked octet */
+      eth->addr[i] &= (0xFF << (8 - num));
+      i++;
+      /* Mask out completely-masked-out octets */
+      for (; i < 6; i++)
+	eth->addr[i] = 0;
+      return TRUE;
+    }
+    if (*cp == '\0') {
+      /* We're at the end of the address, and there's no mask. */
+      if (i == 2) {
+	/* We got 3 bytes, so this is a manufacturer ID. */
+	if (!manuf_file) {
+	  /* Manufacturer IDs are only allowed in the "manuf"
+	     files. */
+	  return FALSE;
+	}
+	/* Indicate that this is a manufacturer ID (0 is not allowed
+	   as a mask). */
+	*mask = 0;
+	return TRUE;
+      }
+
+      if (i == 5) {
+	/* We got 6 bytes, so this is a MAC address.
+	   If we're reading one of the "manuf" files, indicate that
+	   this is a MAC address (48 is not allowed as a mask). */
+	if (manuf_file)
+	  *mask = 48;
+	return TRUE;
+      }
+
+      /* We didn't get 3 or 6 bytes, and there's no mask; this is
+         illegal. */
+      return FALSE;
+    } else {
+      if (sep == '\0') {
+	/* We don't know the separator used in this number; it can either
+	   be ':', '-', or '.'. */
+	if (*cp != ':' && *cp != '-' && *cp != '.')
+	  return FALSE;
+	sep = *cp;	/* subsequent separators must be the same */
+      } else {
+          /* It has to be the same as the first separator */
+          if (*cp != sep)
+            return FALSE;
+      }
+    }
+    cp++;
+  }
+
+  return TRUE;
+}
+
+static int parse_ether_line(char *line, ether_t *eth, unsigned int *mask,
+			    gboolean manuf_file)
 {
   /*
    *  See man ethers(4) for ethers file format
@@ -442,7 +549,6 @@ static int parse_ether_line(char *line, ether_t *eth, int six_bytes)
    */
 
   gchar *cp;
-  int a0, a1, a2, a3, a4, a5;
 
   if ((cp = strchr(line, '#')))
     *cp = '\0';
@@ -450,38 +556,12 @@ static int parse_ether_line(char *line, ether_t *eth, int six_bytes)
   if ((cp = strtok(line, " \t\n")) == NULL)
     return -1;
 
-  if (six_bytes) {
-    if (sscanf(cp, "%x:%x:%x:%x:%x:%x", &a0, &a1, &a2, &a3, &a4, &a5) != 6) {
-      if (sscanf(cp, "%x-%x-%x-%x-%x-%x", &a0, &a1, &a2, &a3, &a4, &a5) != 6) {
-        if (sscanf(cp, "%x.%x.%x.%x.%x.%x", &a0, &a1, &a2, &a3, &a4, &a5) != 6)
-	  return -1;
-      }
-    }
-  } else {
-    if (sscanf(cp, "%x:%x:%x", &a0, &a1, &a2) != 3) {
-      if (sscanf(cp, "%x-%x-%x", &a0, &a1, &a2) != 3) {
-        if (sscanf(cp, "%x.%x.%x", &a0, &a1, &a2) != 3)
-	return -1;
-      }
-    }
-  }
+  if (!parse_ether_address(cp, eth, mask, manuf_file))
+    return -1;
 
   if ((cp = strtok(NULL, " \t\n")) == NULL)
     return -1;
 
-  eth->addr[0] = a0;
-  eth->addr[1] = a1;
-  eth->addr[2] = a2;
-  if (six_bytes) {
-    eth->addr[3] = a3;
-    eth->addr[4] = a4;
-    eth->addr[5] = a5;
-  } else {
-    eth->addr[3] = 0;
-    eth->addr[4] = 0;
-    eth->addr[5] = 0;
-  }
-
   strncpy(eth->name, cp, MAXNAMELEN);
   eth->name[MAXNAMELEN-1] = '\0';
 
@@ -507,7 +587,7 @@ static void end_ethent(void)
   }
 }
 
-static ether_t *get_ethent(int six_bytes)
+static ether_t *get_ethent(unsigned int *mask, gboolean manuf_file)
 {
 
   static ether_t eth;
@@ -518,7 +598,7 @@ static ether_t *get_ethent(int six_bytes)
     return NULL;
 
   while (fgetline(&buf, &size, eth_p) >= 0) {
-    if (parse_ether_line(buf, &eth, six_bytes) == 0) {
+    if (parse_ether_line(buf, &eth, mask, manuf_file) == 0) {
       return &eth;
     }
   }
@@ -533,7 +613,7 @@ static ether_t *get_ethbyname(const guchar *name)
 
   set_ethent(g_ethers_path);
 
-  while ((eth = get_ethent(1)) && strncmp(name, eth->name, MAXNAMELEN) != 0)
+  while ((eth = get_ethent(NULL, FALSE)) && strncmp(name, eth->name, MAXNAMELEN) != 0)
     ;
 
   if (eth == NULL) {
@@ -541,7 +621,7 @@ static ether_t *get_ethbyname(const guchar *name)
 
     set_ethent(g_pethers_path);
 
-    while ((eth = get_ethent(1)) && strncmp(name, eth->name, MAXNAMELEN) != 0)
+    while ((eth = get_ethent(NULL, FALSE)) && strncmp(name, eth->name, MAXNAMELEN) != 0)
       ;
 
     end_ethent();
@@ -558,7 +638,7 @@ static ether_t *get_ethbyaddr(const guint8 *addr)
 
   set_ethent(g_ethers_path);
 
-  while ((eth = get_ethent(1)) && memcmp(addr, eth->addr, 6) != 0)
+  while ((eth = get_ethent(NULL, FALSE)) && memcmp(addr, eth->addr, 6) != 0)
     ;
 
   if (eth == NULL) {
@@ -566,7 +646,7 @@ static ether_t *get_ethbyaddr(const guint8 *addr)
 
     set_ethent(g_pethers_path);
 
-    while ((eth = get_ethent(1)) && memcmp(addr, eth->addr, 6) != 0)
+    while ((eth = get_ethent(NULL, FALSE)) && memcmp(addr, eth->addr, 6) != 0)
       ;
 
     end_ethent();
@@ -576,32 +656,117 @@ static ether_t *get_ethbyaddr(const guint8 *addr)
 
 } /* get_ethbyaddr */
 
-static void add_manuf_name(guint8 *addr, guchar *name)
+static int hash_eth_wka(const guint8 *addr, unsigned int mask)
+{
+  if (mask <= 8) {
+    /* All but the topmost byte is masked out */
+    return (addr[0] & (0xFF << (8 - mask))) & (HASHETHSIZE - 1);
+  }
+  mask -= 8;
+  if (mask <= 8) {
+    /* All but the topmost 2 bytes are masked out */
+    return ((addr[0] << 8) | (addr[1] & (0xFF << (8 - mask)))) &
+            (HASHETHSIZE - 1);
+  }
+  mask -= 8;
+  if (mask <= 8) {
+    /* All but the topmost 3 bytes are masked out */
+    return ((addr[0] << 16) | (addr[1] << 8) | (addr[2] & (0xFF << (8 - mask))))
+     & (HASHETHSIZE - 1);
+  }
+  mask -= 8;
+  if (mask <= 8) {
+    /* All but the topmost 4 bytes are masked out */
+    return ((((addr[0] << 8) | addr[1]) ^
+             ((addr[2] << 8) | (addr[3] & (0xFF << (8 - mask)))))) &
+	 (HASHETHSIZE - 1);
+  }
+  mask -= 8;
+  if (mask <= 8) {
+    /* All but the topmost 5 bytes are masked out */
+    return ((((addr[1] << 8) | addr[2]) ^
+             ((addr[3] << 8) | (addr[4] & (0xFF << (8 - mask)))))) &
+	 (HASHETHSIZE - 1);
+  }
+  mask -= 8;
+  /* No bytes are fully masked out */
+  return ((((addr[1] << 8) | addr[2]) ^
+           ((addr[3] << 8) | (addr[4] & (0xFF << (8 - mask)))))) &
+            (HASHETHSIZE - 1);
+}
+
+static void add_manuf_name(guint8 *addr, unsigned int mask, guchar *name)
 {
   int hash_idx;
   hashmanuf_t *tp;
+  hashether_t *(*wka_tp)[HASHETHSIZE], *etp;
 
-  hash_idx = HASH_ETH_MANUF(addr);
+  if (mask == 48) {
+    /* This is a well-known MAC address; just add this to the Ethernet
+       hash table */
+    add_eth_name(addr, name);
+    return;
+  }
 
-  tp = manuf_table[hash_idx];
+  if (mask == 0) {
+    /* This is a manufacturer ID; add it to the manufacturer ID hash table */
 
-  if( tp == NULL ) {
-    tp = manuf_table[hash_idx] = (hashmanuf_t *)g_malloc(sizeof(hashmanuf_t));
+    hash_idx = HASH_ETH_MANUF(addr);
+
+    tp = manuf_table[hash_idx];
+
+    if( tp == NULL ) {
+      tp = manuf_table[hash_idx] = (hashmanuf_t *)g_malloc(sizeof(hashmanuf_t));
+    } else {
+      while(1) {
+	if (tp->next == NULL) {
+	  tp->next = (hashmanuf_t *)g_malloc(sizeof(hashmanuf_t));
+	  tp = tp->next;
+	  break;
+	}
+	tp = tp->next;
+      }
+    }
+
+    memcpy(tp->addr, addr, sizeof(tp->addr));
+    strncpy(tp->name, name, MAXMANUFLEN);
+    tp->name[MAXMANUFLEN-1] = '\0';
+    tp->next = NULL;
+    return;
+  }
+
+  /* This is a range of well-known addresses; add it to the appropriate
+     well-known-address table, creating that table if necessary. */
+  wka_tp = wka_table[mask];
+  if (wka_tp == NULL)
+    wka_tp = wka_table[mask] = g_malloc(sizeof *wka_table[mask]);
+
+  hash_idx = hash_eth_wka(addr, mask);
+
+  etp = (*wka_tp)[hash_idx];
+
+  if( etp == NULL ) {
+    etp = (*wka_tp)[hash_idx] = (hashether_t *)g_malloc(sizeof(hashether_t));
   } else {
     while(1) {
-      if (tp->next == NULL) {
-	tp->next = (hashmanuf_t *)g_malloc(sizeof(hashmanuf_t));
-	tp = tp->next;
+      if (memcmp(etp->addr, addr, sizeof(etp->addr)) == 0) {
+	/* address already known */
+	return;
+      }
+      if (etp->next == NULL) {
+	etp->next = (hashether_t *)g_malloc(sizeof(hashether_t));
+	etp = etp->next;
 	break;
       }
-      tp = tp->next;
+      etp = etp->next;
     }
   }
 
-  memcpy(tp->addr, addr, sizeof(tp->addr));
-  strncpy(tp->name, name, MAXMANUFLEN);
-  tp->name[MAXMANUFLEN-1] = '\0';
-  tp->next = NULL;
+  memcpy(etp->addr, addr, sizeof(etp->addr));
+  strncpy(etp->name, name, MAXNAMELEN);
+  etp->name[MAXNAMELEN-1] = '\0';
+  etp->next = NULL;
+  etp->is_dummy_entry = FALSE;
 
 } /* add_manuf_name */
 
@@ -625,10 +790,52 @@ static hashmanuf_t *manuf_name_lookup(const guint8 *addr)
 
 } /* manuf_name_lookup */
 
+static hashether_t *wka_name_lookup(const guint8 *addr, unsigned int mask)
+{
+  int hash_idx;
+  hashether_t *(*wka_tp)[HASHETHSIZE];
+  hashether_t *tp;
+  guint8 masked_addr[6];
+  unsigned int num;
+  int i;
+
+  wka_tp = wka_table[mask];
+  if (wka_tp == NULL) {
+    /* There are no entries in the table for that mask value, as there is
+       no table for that mask value. */
+    return NULL;
+  }
+
+  /* Get the part of the address covered by the mask. */
+  for (i = 0, num = mask; num >= 8; i++, num -= 8)
+    masked_addr[i] = addr[i];	/* copy octets entirely covered by the mask */
+  /* Mask out the first masked octet */
+  masked_addr[i] = addr[i] & (0xFF << (8 - num));
+  i++;
+  /* Zero out completely-masked-out octets */
+  for (; i < 6; i++)
+    masked_addr[i] = 0;
+
+  hash_idx = hash_eth_wka(masked_addr, mask);
+
+  tp = (*wka_tp)[hash_idx];
+
+  while(tp != NULL) {
+    if (memcmp(tp->addr, masked_addr, sizeof(tp->addr)) == 0) {
+      return tp;
+    }
+    tp = tp->next;
+  }
+
+  return NULL;
+
+} /* wka_name_lookup */
+
 static void initialize_ethers(void)
 {
   ether_t *eth;
   char *manuf_path;
+  unsigned int mask;
 
   /* Compute the pathname of the ethers file. */
   if (g_ethers_path == NULL) {
@@ -655,8 +862,8 @@ static void initialize_ethers(void)
   /* Read it and initialize the hash table */
   set_ethent(manuf_path);
 
-  while ((eth = get_ethent(0))) {
-    add_manuf_name(eth->addr, eth->name);
+  while ((eth = get_ethent(&mask, TRUE))) {
+    add_manuf_name(eth->addr, mask, eth->name);
   }
 
   end_ethent();
@@ -712,6 +919,8 @@ static guchar *eth_name_lookup(const guint8 *addr)
   hashmanuf_t *manufp;
   hashether_t *tp;
   ether_t *eth;
+  hashether_t *etp;
+  unsigned int mask;
 
   hash_idx = HASH_ETH_ADDRESS(addr);
 
@@ -739,14 +948,103 @@ static guchar *eth_name_lookup(const guint8 *addr)
   tp->next = NULL;
 
   if ( (eth = get_ethbyaddr(addr)) == NULL) {
-    /* unknown name */
+    /* Unknown name.  Try looking for it in the well-known-address
+       tables for well-known address ranges smaller than 2^24. */
+    mask = 7;
+    for (;;) {
+      /* Only the topmost 5 bytes participate fully */
+      if ((etp = wka_name_lookup(addr, mask+40)) != NULL) {
+	sprintf(tp->name, "%s_%02x",
+	      etp->name, addr[5] & (0xFF >> mask));
+	tp->is_dummy_entry = TRUE;
+	return (tp->name);
+      }
+      if (mask == 0)
+        break;
+      mask--;
+    }
+
+    mask = 7;
+    for (;;) {
+      /* Only the topmost 4 bytes participate fully */
+      if ((etp = wka_name_lookup(addr, mask+32)) != NULL) {
+	sprintf(tp->name, "%s_%02x:%02x",
+	      etp->name, addr[4] & (0xFF >> mask), addr[5]);
+	tp->is_dummy_entry = TRUE;
+	return (tp->name);
+      }
+      if (mask == 0)
+        break;
+      mask--;
+    }
 
-    if ((manufp = manuf_name_lookup(addr)) == NULL)
-      sprintf(tp->name, "%s", ether_to_str((guint8 *)addr));
-    else
+    mask = 7;
+    for (;;) {
+      /* Only the topmost 3 bytes participate fully */
+      if ((etp = wka_name_lookup(addr, mask+24)) != NULL) {
+	sprintf(tp->name, "%s_%02x:%02x:%02x",
+	      etp->name, addr[3] & (0xFF >> mask), addr[4], addr[5]);
+	tp->is_dummy_entry = TRUE;
+	return (tp->name);
+      }
+      if (mask == 0)
+        break;
+      mask--;
+    }
+
+    /* Now try looking in the manufacturer table. */
+    if ((manufp = manuf_name_lookup(addr)) != NULL) {
       sprintf(tp->name, "%s_%02x:%02x:%02x",
 	      manufp->name, addr[3], addr[4], addr[5]);
+      tp->is_dummy_entry = TRUE;
+      return (tp->name);
+    }
+
+    /* Now try looking for it in the well-known-address
+       tables for well-known address ranges larger than 2^24. */
+    mask = 7;
+    for (;;) {
+      /* Only the topmost 2 bytes participate fully */
+      if ((etp = wka_name_lookup(addr, mask+16)) != NULL) {
+	sprintf(tp->name, "%s_%02x:%02x:%02x:%02x",
+	      etp->name, addr[2] & (0xFF >> mask), addr[3], addr[4],
+	      addr[5]);
+	tp->is_dummy_entry = TRUE;
+	return (tp->name);
+      }
+      if (mask == 0)
+        break;
+      mask--;
+    }
+
+    mask = 7;
+    for (;;) {
+      /* Only the topmost byte participates fully */
+      if ((etp = wka_name_lookup(addr, mask+8)) != NULL) {
+	sprintf(tp->name, "%s_%02x:%02x:%02x:%02x:%02x",
+	      etp->name, addr[1] & (0xFF >> mask), addr[2], addr[3],
+	      addr[4], addr[5]);
+	tp->is_dummy_entry = TRUE;
+	return (tp->name);
+      }
+      if (mask == 0)
+        break;
+      mask--;
+    }
+
+    for (mask = 7; mask > 0; mask--) {
+      /* Not even the topmost byte participates fully */
+      if ((etp = wka_name_lookup(addr, mask)) != NULL) {
+	sprintf(tp->name, "%s_%02x:%02x:%02x:%02x:%02x:%02x",
+	      etp->name, addr[0] & (0xFF >> mask), addr[1], addr[2],
+	      addr[3], addr[4], addr[5]);
+	tp->is_dummy_entry = TRUE;
+	return (tp->name);
+      }
+    }
 
+    /* No match whatsoever. */
+    sprintf(tp->name, "%s", ether_to_str((guint8 *)addr));
     tp->is_dummy_entry = TRUE;
 
   } else {
diff --git a/make-manuf b/make-manuf
index 120b32b3de..a9df3ec7f5 100755
--- a/make-manuf
+++ b/make-manuf
@@ -1,6 +1,6 @@
 #!/usr/bin/perl -w
 #
-# $Id: make-manuf,v 1.6 2002/08/03 23:09:24 jmayer Exp $
+# $Id: make-manuf,v 1.7 2002/09/09 19:38:09 guy Exp $
 #
 # Make-manuf - Creates a file containing ethernet OUIs and their
 # company IDs.  It merges the databases at
@@ -21,6 +21,7 @@ if( $@ ) {
 }
 
 $template = "manuf.tmpl";
+$wkatmpl  = "wka.tmpl";
 $outfile  = "manuf";
 $inheader = 1;
 $ieee_url = "http://standards.ieee.org/regauth/oui/oui_public.txt";
@@ -60,6 +61,9 @@ $ieee_list = $result->content;
 open (TMPL, "< $template") || 
   die "Couldn't open template file for reading ($template)\n";
 
+open (WKATMPL, "< $wkatmpl") || 
+  die "Couldn't open well-known address template file for reading ($wkatmpl)\n";
+
 open (OUT, "> $outfile") ||
   die "Couldn't open output file for writing ($outfile)\n";
 
@@ -114,6 +118,20 @@ foreach $oui (sort(keys %oui_list)) {
   print(OUT "$oui\t$oui_list{$oui}\n");
 }
 
+#
+# Write out a blank line separating the OUIs from the well-known
+# addresses, and then read the well-known address template file
+# and write it to the manuf file.
+#
+# XXX - it'd be nice to get this from the Cavebear file, but inferring
+# the address mask from entries in that file involves some work.
+#
+print(OUT "\n");
+while ($line = <WKATMPL>) {
+  chomp($line);
+  print(OUT "$line\n");
+}
+
 $total_added = $tmpl_added + $cb_added + $ieee_added;
 print <<"Fin"
 Original entries : $tmpl_added
diff --git a/manuf b/manuf
index 43e8ba5afc..e92341d5f2 100644
--- a/manuf
+++ b/manuf
@@ -1,7 +1,7 @@
 # 
-# /etc/manuf - Ethernet vendor codes 
+# /etc/manuf - Ethernet vendor codes, and well-known MAC addresses
 #
-# $Id: manuf,v 1.18 2002/08/03 23:09:24 jmayer Exp $
+# $Id: manuf,v 1.19 2002/09/09 19:38:09 guy Exp $
 #
 # Laurent Deniel <deniel@worldnet.fr>
 #
@@ -39,10 +39,12 @@
 # In the event of data set collisions the Ethereal entries have been given
 # precedence, followed by Michael Patton's, followed by the IEEE.
 #
-#
-#
 # This file is in the same format as ethers(4) except that vendor names
-# are truncated to eight characters when used with Ethereal.
+# are truncated to eight characters when used with Ethereal, and
+# that well-known MAC addresses need not have a full 6 octets and may
+# have a netmask following them specifying how many bits of the address
+# are relevant (the other bits are wildcards).  Also, either ":", "-",
+# or "." can be used to separate the octets.
 #
 
 00:00:00	00:00:00	# Officially Xerox, but 0:0:0:0:0:0 is more common
@@ -185,7 +187,7 @@
 00:00:89	Cayman
 00:00:8A	DATAHOUSE INFORMATION SYSTEMS
 00:00:8B	INFOTRON
-00:00:8C	ALLOY COMPUTER PRODUCTS, INC.
+00:00:8C	Alloy Computer Products (Australia) Pty Ltd
 00:00:8D	VERDIX CORPORATION
 00:00:8E	SOLBOURNE COMPUTER, INC.
 00:00:8F	RAYTHEON COMPANY
@@ -250,7 +252,7 @@
 00:00:CA	APPLITEK
 00:00:CB	COMPU-SHACK ELECTRONIC GMBH
 00:00:CC	DENSAN CO., LTD.
-00:00:CD	Centrecom Systems, Ltd.
+00:00:CD	Allied Telesyn Research Ltd.
 00:00:CE	MEGADATA CORP.
 00:00:CF	HAYES MICROCOMPUTER PRODUCTS
 00:00:D0	DEVELCON ELECTRONICS LTD.
@@ -908,7 +910,7 @@
 00:03:5C	Saint Song Corp.
 00:03:5D	Bosung Hi-Net Co., Ltd.
 00:03:5E	Metropolitan Area Networks, Inc.
-00:03:5F	Schuehle Mess - und. Kontrollsysteme
+00:03:5F	Prueftechnik Condition Monitoring GmbH & Co. KG
 00:03:60	PAC Interactive Technology, Inc.
 00:03:61	Widcomm, Inc.
 00:03:62	Vodtel Communications, Inc.
@@ -1395,7 +1397,7 @@
 00:05:43	IQ Wireless GmbH
 00:05:44	Valley Technologies, Inc.
 00:05:45	Internet Photonics
-00:05:46	KDD Network Systems Co., Ltd.
+00:05:46	K-Solutions Inc.
 00:05:47	Starent Networks
 00:05:48	Disco Corporation
 00:05:49	Salira Optical Network Systems
@@ -1743,7 +1745,7 @@
 00:06:9F	Kuokoa Networks
 00:06:A0	Mx Imaging
 00:06:A1	Celsian Technologies, Inc.
-00:06:A2	Transilica, Inc.
+00:06:A2	Microtune, Inc.
 00:06:A3	Bitran Corporation
 00:06:A4	INNOWELL Corp.
 00:06:A5	PINON Corp.
@@ -2790,7 +2792,7 @@
 00:0A:DD	InSciTek Microsystems, Inc.
 00:0A:DE	Happy Communication Co., Ltd.
 00:0A:DF	Gennum Corporation
-00:0A:E0	Fujitsu Software Technologies Corp
+00:0A:E0	Fujitsu Softek
 00:0A:E1	EG Technology
 00:0A:E2	Binatone Electronics International, Ltd
 00:0A:E3	YANG MEI TECHNOLOGY CO., LTD
@@ -2801,6 +2803,91 @@
 00:0A:E8	Cathay Roxus Information Technology Co. LTD
 00:0A:E9	AirVast Technology Inc.
 00:0A:EA	ADAM ELEKTRONIK LTD.STI.
+00:0A:EB	Shenzhen Tp-link Technology Co; Ltd.
+00:0A:EC	Koatsu Gas Kogyo Co., Ltd.
+00:0A:ED	HARTING Vending G.m.b.H. & CO KG
+00:0A:EE	GCD Hard- & Software GmbH
+00:0A:EF	OTRUM ASA
+00:0A:F0	SHIN-OH ELECTRONICS CO., LTD. R&D
+00:0A:F1	Clarity Design, Inc.
+00:0A:F2	NeoAxiom Corp.
+00:0A:F3	Cisco Systems
+00:0A:F4	Cisco Systems
+00:0A:F5	Airgo Networks, Inc.
+00:0A:F6	Computer Process Controls
+00:0A:F7	Broadcom Corp.
+00:0A:F8	American Telecare Inc.
+00:0A:F9	PRIVATE
+00:0A:FA	Traverse Technologies Australia
+00:0A:FB	Ambri Limited
+00:0A:FC	Core Tec Communications, LLC
+00:0A:FD	VIking Electronic Services
+00:0A:FE	NovaPal Ltd
+00:0A:FF	Kilchherr Elektronik AG
+00:0B:00	FUJIAN START COMPUTER EQUIPMENT CO.,LTD
+00:0B:01	DAIICHI ELECTRONICS CO., LTD.
+00:0B:02	Dallmeier electronic
+00:0B:03	Taekwang Industrial Co., Ltd
+00:0B:04	Volktek Corporation
+00:0B:05	Pacific Broadband Networks
+00:0B:06	Motorola BCS
+00:0B:07	Voxpath Networks
+00:0B:08	Pillar Data Systems
+00:0B:09	Ifoundry Systems Singapore
+00:0B:0A	dBm Optics
+00:0B:0B	Corrent Corporation
+00:0B:0C	Agile Systems Inc.
+00:0B:0D	Air2U, Inc.
+00:0B:0E	Trapeze Networks
+00:0B:0F	Nyquist Industrial Control BV
+00:0B:10	11wave Technonlogy Co.,Ltd
+00:0B:11	HIMEJI ABC TRADING CO.,LTD.
+00:0B:12	PRIVATE
+00:0B:13	ZETRON INC
+00:0B:14	ViewSonic Corporation
+00:0B:15	Platypus Technology
+00:0B:16	Communication Machinery Corporation
+00:0B:17	MKS Instruments
+00:0B:18	PRIVATE
+00:0B:19	Vernier Networks, Inc.
+00:0B:1A	Teltone Corporation
+00:0B:1B	Systronix, Inc.
+00:0B:1C	PRIVATE
+00:0B:1D	LayerZero Power Systems, Inc.
+00:0B:1E	KAPPA opto-electronics GmbH
+00:0B:1F	I CON Computer Co.
+00:0B:20	Hirata corporation
+00:0B:21	G-Star Communications Inc.
+00:0B:22	Environmental Systems and Services
+00:0B:23	Efficient Networks, Inc.
+00:0B:24	AirLogic
+00:0B:25	Aeluros
+00:0B:26	Wetek Corporation
+00:0B:27	Scion Corporation
+00:0B:28	Quatech Inc.
+00:0B:29	LG Industrial Systems Co.,Ltd.
+00:0B:2A	HOWTEL Co., Ltd.
+00:0B:2B	HOSTNET CORPORATION
+00:0B:2C	Eiki Industrial Co. Ltd.
+00:0B:2D	Danfoss Inc.
+00:0B:2E	Cal-Comp Electronics (Thailand) Public Company Limited Taipe
+00:0B:2F	bplan GmbH
+00:0B:30	Beijing Gongye Science & Technology Co.,Ltd
+00:0B:31	Yantai ZhiYang Scientific and technology industry CO., LTD
+00:0B:32	VORMETRIC, INC.
+00:0B:33	Vivato
+00:0B:34	ShangHai Broadband Technologies CO.LTD
+00:0B:35	Quad Bit System co., Ltd.
+00:0B:36	Productivity Systems, Inc.
+00:0B:37	MANUFACTURE DES MONTRES ROLEX SA
+00:0B:38	Knuerr AG
+00:0B:39	Keisoku Giken Co.,Ltd.
+00:0B:3A	Fortel DTV, Inc.
+00:0B:3B	devolo AG
+00:0B:3C	Cygnal Integrated Products, Inc.
+00:0B:3D	CONTAL OK Ltd.
+00:0B:3E	BittWare, Inc
+00:0B:3F	Anthology Solutions Inc.
 00:10:00	CABLE TELEVISION LABORATIES, INC.
 00:10:01	MCK COMMUNICATIONS
 00:10:02	ACTIA
@@ -3684,7 +3771,7 @@
 00:40:6F	SYNC RESEARCH INC.
 00:40:70	INTERWARE CO., LTD.
 00:40:71	ATM COMPUTER GMBH
-00:40:72	APPLIED INNOVATION, INC.
+00:40:72	Applied Innovation Inc.
 00:40:73	BASS ASSOCIATES
 00:40:74	CABLE AND WIRELESS
 00:40:75	M-TRADE (UK) LTD
@@ -4177,7 +4264,7 @@
 00:60:68	EICON TECHNOLOGY CORPORATION
 00:60:69	BROCADE COMMUNICATIONS SYSTEMS, Inc.
 00:60:6A	MITSUBISHI WIRELESS COMMUNICATIONS. INC.
-00:60:6B	AICHI ELECTRONICS CO., LTD.
+00:60:6B	Synclayer Inc.
 00:60:6C	ARESCOM
 00:60:6D	DIGITAL EQUIPMENT CORP.
 00:60:6E	DAVICOM SEMICONDUCTOR, INC.
@@ -4191,7 +4278,7 @@
 00:60:76	SCHLUMBERGER TECHNOLOGIES RETAIL PETROLEUM SYSTEMS
 00:60:77	PRISA NETWORKS
 00:60:78	POWER MEASUREMENT LTD.
-00:60:79	WAVEPHORE NETWORKS, INC.
+00:60:79	Mainstream Data, Inc.
 00:60:7A	DVS GmbH
 00:60:7B	FORE SYSTEMS, INC.
 00:60:7C	WaveAccess, Ltd.
@@ -4697,7 +4784,7 @@
 00:90:6E	PRAXON, INC.
 00:90:6F	Cisco
 00:90:70	NEO NETWORKS, INC.
-00:90:71	BADGER TECHNOLOGY, INC.
+00:90:71	Applied Innovation Inc.
 00:90:72	SIMRAD AS
 00:90:73	GAIO TECHNOLOGY
 00:90:74	ARGON NETWORKS, INC.
@@ -6124,3 +6211,157 @@ AC:DE:48	PRIVATE
 C0:00:00	Western Digital (may be reversed 00 00 C0?)
 E2:0C:0F	Kingston Technologies
 EC:10:00	Enance Source Co., Ltd.	PC clones(?)
+
+#
+# Well-known addresses.
+#
+# $Id: manuf,v 1.19 2002/09/09 19:38:09 guy Exp $
+#
+# Ethereal - Network traffic analyzer
+# By Gerald Combs <gerald@ethereal.com>
+# Copyright 1998 Gerald Combs
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+#
+# The data below has been assembled from the following sources:
+#
+# Michael Patton's "Ethernet Codes Master Page" available from:
+# <http://www.cavebear.com/CaveBear/Ethernet/>
+# <ftp://ftp.cavebear.com/pub/Ethernet.txt>
+#
+00-00-0C-07-AC/40	All-HSRP-routers
+00-00-5E-00-01/40	IETF-VRRP-virtual-router-VRID
+01-00-0C-CC-CC-CC	CDP/VTP
+01-00-0C-DD-DD-DD	CGMP
+01-00-10-00-00-20	Hughes-Lan-Systems-Terminal-Server-S/W-download
+01-00-10-FF-FF-20	Hughes-Lan-Systems-Terminal-Server-S/W-request
+01-00-1D-00-00-00	Cabletron-PC-OV-PC-discover-(on-demand)
+01-00-1D-42-00-00	Cabletron-PC-OV-Bridge-discover-(on-demand)
+01-00-1D-52-00-00	Cabletron-PC-OV-MMAC-discover-(on-demand)
+01-00-3C		Auspex-Systems-(Serverguard)
+01-00-5E-00-00-12	IETF-VRRP
+01-00-81-00-00-00	Synoptics-Network-Management
+01-00-81-00-00-02	Synoptics-Network-Management
+01-00-81-00-01-00	Bay-Networks-(Synoptics)-autodiscovery
+01-00-81-00-01-01	Bay-Networks-(Synoptics)-autodiscovery
+01-20-25/25		Control-Technology-Inc's-Industrial-Ctrl-Proto.
+01-80-24-00-00-00	Kalpana-Etherswitch-every-60-seconds
+01-80-C2-00-00-00/44	Spanning-tree-(for-bridges)
+01-80-C2-00-00-10	Bridge-Management
+01-80-C2-00-00-11	Load-Server
+01-80-C2-00-00-12	Loadable-Device
+01-80-C2-00-00-14	ISIS-all-level-1-IS's
+01-80-C2-00-00-15	ISIS-all-level-2-IS's
+01-80-C2-00-01-00	FDDI-RMT-Directed-Beacon
+01-80-C2-00-01-10	FDDI-status-report-frame
+01-DD-00-FF-FF-FF	Ungermann-Bass-boot-me-requests
+01-DD-01-00-00-00	Ungermann-Bass-Spanning-Tree
+
+#       [ The following block of addresses (03-...) are used by various ]
+#       [ standards.  Some (marked [TR?]) are suspected of only being   ]
+#       [ used on Token Ring for group addresses of Token Ring specific ]
+#       [ functions, reference ISO 8802-5:1995 aka. IEEE 802.5:1995 for ]
+#       [ some info.  These in the Ethernet order for this list.  On    ]
+#       [ Token Ring they appear reversed.  They should never appear on ]
+#       [ Ethernet.  Others, not so marked, are normal reports (may be  ]
+#       [ seen on either).
+03-00-00-00-00-01	NETBIOS-# [TR?]
+03-00-00-00-00-02	Locate-Directory-Server # [TR?]
+03-00-00-00-00-04	Synchronous-Bandwidth-Manager-# [TR?]
+03-00-00-00-00-08	Configuration-Report-Server-# [TR?]
+03-00-00-00-00-10	Ring-Error-Monitor-# [TR?]
+03-00-00-00-00-10	(OS/2-1.3-EE+Communications-Manager)
+03-00-00-00-00-20	Network-Server-Heartbeat-# [TR?]
+03-00-00-00-00-40	(OS/2-1.3-EE+Communications-Manager)
+03-00-00-00-00-80	Active-Monitor # [TR?]
+03-00-00-00-01-00	OSI-All-IS-Token-Ring-Multicast
+03-00-00-00-02-00	OSI-All-ES-Token-Ring-Multicast
+03-00-00-00-04-00	LAN-Manager # [TR?]
+03-00-00-00-08-00	Ring-Wiring-Concentrator # [TR?]
+03-00-00-00-10-00	LAN-Gateway # [TR?]
+03-00-00-00-20-00	Ring-Authorization-Server # [TR?]
+03-00-00-00-40-00	IMPL-Server # [TR?]
+03-00-00-00-80-00	Bridge # [TR?]
+03-00-00-20-00-00	IP-Token-Ring-Multicast (RFC1469)
+03-00-00-80-00-00	Discovery-Client
+03-00-FF-FF-FF-FF	All-Stations-Address
+09-00-07-00-00-00/40	AppleTalk-Zone-multicast-addresses
+			# only goes through 09-00-07-00-00-FC?
+09-00-07-FF-FF-FF	AppleTalk-broadcast-address
+09-00-09-00-00-01	HP-Probe
+09-00-09-00-00-04	HP-DTC
+09-00-0D-00-00-00/24	ICL-Oslan-Multicast
+09-00-0D-02-00-00	ICL-Oslan-Service-discover-only-on-boot
+09-00-0D-02-0A-38	ICL-Oslan-Service-discover-only-on-boot
+09-00-0D-02-0A-39	ICL-Oslan-Service-discover-only-on-boot
+09-00-0D-02-0A-3C	ICL-Oslan-Service-discover-only-on-boot
+09-00-0D-02-FF-FF	ICL-Oslan-Service-discover-only-on-boot
+09-00-0D-09-00-00	ICL-Oslan-Service-discover-as-required
+09-00-1E-00-00-00	Apollo-DOMAIN
+09-00-2B-00-00-00	DEC-MUMPS?
+09-00-2B-00-00-01	DEC-DSM/DDP
+09-00-2B-00-00-02	DEC-VAXELN?
+09-00-2B-00-00-03	DEC-Lanbridge-Traffic-Monitor-(LTM)
+09-00-2B-00-00-04	DEC-MAP-(or-OSI?)-End-System-Hello?
+09-00-2B-00-00-05	DEC-MAP-(or-OSI?)-Intermediate-System-Hello?
+09-00-2B-00-00-06	DEC-CSMA/CD-Encryption?
+09-00-2B-00-00-07	DEC-NetBios-Emulator?
+09-00-2B-00-00-0F	DEC-Local-Area-Transport-(LAT)
+09-00-2B-00-00-10/44	DEC-Experimental
+09-00-2B-01-00-00	DEC-LanBridge-Copy-packets-(All-bridges)
+09-00-2B-01-00-01	DEC-LanBridge-Hello-packets-(All-local-bridges)
+09-00-2B-02-00-00	DEC-DNA-Level-2-Routing-Layer-routers?
+09-00-2B-02-01-00	DEC-DNA-Naming-Service-Advertisement?
+09-00-2B-02-01-01	DEC-DNA-Naming-Service-Solicitation?
+09-00-2B-02-01-09	DEC-Availability-Manager-for-Distributed-Systems-DECamds
+09-00-2B-02-01-02	DEC-Distributed-Time-Service
+09-00-2B-03-00-00/32	DEC-default-filtering-by-bridges?
+09-00-2B-04-00-00	DEC-Local-Area-System-Transport-(LAST)?
+09-00-2B-23-00-00	DEC-Argonaut-Console?
+09-00-4C-00-00-00	BICC-802.1-management
+09-00-4C-00-00-02	BICC-802.1-management
+09-00-4C-00-00-06	BICC-Local-bridge-STA-802.1(D)-Rev6
+09-00-4C-00-00-0C	BICC-Remote-bridge-STA-802.1(D)-Rev8
+09-00-4C-00-00-0F	BICC-Remote-bridge-ADAPTIVE-ROUTING
+09-00-56-FF-00-00/32	Stanford-V-Kernel,-version-6.0
+09-00-6A-00-01-00	TOP-NetBIOS.
+09-00-77-00-00-00	Retix-Bridge-Local-Management-System
+09-00-77-00-00-01	Retix-spanning-tree-bridges
+09-00-77-00-00-02	Retix-Bridge-Adaptive-routing
+09-00-7C-01-00-01	Vitalink-DLS-Multicast
+09-00-7C-01-00-03	Vitalink-DLS-Inlink
+09-00-7C-01-00-04	Vitalink-DLS-and-non-DLS-Multicast
+09-00-7C-02-00-05	Vitalink-diagnostics
+09-00-7C-05-00-01	Vitalink-gateway?
+09-00-7C-05-00-02	Vitalink-Network-Validation-Message
+09-00-87-80-FF-FF	Xyplex-Terminal-Servers
+09-00-87-90-FF-FF	Xyplex-Terminal-Servers
+0D-1E-15-BA-DD-06	HP
+33-33-00-00-00-00/16	IPv6-Neighbor-Discovery
+AA-00-03-00-00-00/32	DEC-UNA	
+AA-00-03-01-00-00/32	DEC-PROM-AA
+AA-00-03-03-00-00/32	DEC-NI20
+AB-00-00-01-00-00	DEC-MOP-Dump/Load-Assistance
+AB-00-00-02-00-00	DEC-MOP-Remote-Console
+AB-00-00-03-00-00	DECNET-Phase-IV-end-node-Hello-packets
+AB-00-00-04-00-00	DECNET-Phase-IV-Router-Hello-packets
+AB-00-03-00-00-00	DEC-Local-Area-Transport-(LAT)-old
+AB-00-04-01-00-00/32	DEC-Local-Area-VAX-Cluster-groups-SCA
+CF-00-00-00-00-00	Ethernet-Configuration-Test-protocol-(Loopback)
+FF-FF-00-60-00-04	Lantastic
+FF-FF-00-40-00-01	Lantastic
+FF-FF-01-E0-00-04	Lantastic
+
+FF-FF-FF-FF-FF-FF	Broadcast
diff --git a/manuf.tmpl b/manuf.tmpl
index a22664d0d8..0ef96d1972 100644
--- a/manuf.tmpl
+++ b/manuf.tmpl
@@ -1,7 +1,7 @@
 # 
-# /etc/manuf - Ethernet vendor codes 
+# /etc/manuf - Ethernet vendor codes, and well-known MAC addresses
 #
-# $Id: manuf.tmpl,v 1.6 2002/08/03 00:50:22 jmayer Exp $
+# $Id: manuf.tmpl,v 1.7 2002/09/09 19:38:09 guy Exp $
 #
 # Laurent Deniel <deniel@worldnet.fr>
 #
@@ -39,10 +39,12 @@
 # In the event of data set collisions the Ethereal entries have been given
 # precedence, followed by Michael Patton's, followed by the IEEE.
 #
-#
-#
 # This file is in the same format as ethers(4) except that vendor names
-# are truncated to eight characters when used with Ethereal.
+# are truncated to eight characters when used with Ethereal, and
+# that well-known MAC addresses need not have a full 6 octets and may
+# have a netmask following them specifying how many bits of the address
+# are relevant (the other bits are wildcards).  Also, either ":", "-",
+# or "." can be used to separate the octets.
 #
 
 00:00:00	00:00:00	# Officially Xerox, but 0:0:0:0:0:0 is more common
diff --git a/wka.tmpl b/wka.tmpl
new file mode 100644
index 0000000000..259ff75ec4
--- /dev/null
+++ b/wka.tmpl
@@ -0,0 +1,153 @@
+#
+# Well-known addresses.
+#
+# $Id: wka.tmpl,v 1.1 2002/09/09 19:38:09 guy Exp $
+#
+# Ethereal - Network traffic analyzer
+# By Gerald Combs <gerald@ethereal.com>
+# Copyright 1998 Gerald Combs
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+#
+# The data below has been assembled from the following sources:
+#
+# Michael Patton's "Ethernet Codes Master Page" available from:
+# <http://www.cavebear.com/CaveBear/Ethernet/>
+# <ftp://ftp.cavebear.com/pub/Ethernet.txt>
+#
+00-00-0C-07-AC/40	All-HSRP-routers
+00-00-5E-00-01/40	IETF-VRRP-virtual-router-VRID
+01-00-0C-CC-CC-CC	CDP/VTP
+01-00-0C-DD-DD-DD	CGMP
+01-00-10-00-00-20	Hughes-Lan-Systems-Terminal-Server-S/W-download
+01-00-10-FF-FF-20	Hughes-Lan-Systems-Terminal-Server-S/W-request
+01-00-1D-00-00-00	Cabletron-PC-OV-PC-discover-(on-demand)
+01-00-1D-42-00-00	Cabletron-PC-OV-Bridge-discover-(on-demand)
+01-00-1D-52-00-00	Cabletron-PC-OV-MMAC-discover-(on-demand)
+01-00-3C		Auspex-Systems-(Serverguard)
+01-00-5E-00-00-12	IETF-VRRP
+01-00-81-00-00-00	Synoptics-Network-Management
+01-00-81-00-00-02	Synoptics-Network-Management
+01-00-81-00-01-00	Bay-Networks-(Synoptics)-autodiscovery
+01-00-81-00-01-01	Bay-Networks-(Synoptics)-autodiscovery
+01-20-25/25		Control-Technology-Inc's-Industrial-Ctrl-Proto.
+01-80-24-00-00-00	Kalpana-Etherswitch-every-60-seconds
+01-80-C2-00-00-00/44	Spanning-tree-(for-bridges)
+01-80-C2-00-00-10	Bridge-Management
+01-80-C2-00-00-11	Load-Server
+01-80-C2-00-00-12	Loadable-Device
+01-80-C2-00-00-14	ISIS-all-level-1-IS's
+01-80-C2-00-00-15	ISIS-all-level-2-IS's
+01-80-C2-00-01-00	FDDI-RMT-Directed-Beacon
+01-80-C2-00-01-10	FDDI-status-report-frame
+01-DD-00-FF-FF-FF	Ungermann-Bass-boot-me-requests
+01-DD-01-00-00-00	Ungermann-Bass-Spanning-Tree
+
+#       [ The following block of addresses (03-...) are used by various ]
+#       [ standards.  Some (marked [TR?]) are suspected of only being   ]
+#       [ used on Token Ring for group addresses of Token Ring specific ]
+#       [ functions, reference ISO 8802-5:1995 aka. IEEE 802.5:1995 for ]
+#       [ some info.  These in the Ethernet order for this list.  On    ]
+#       [ Token Ring they appear reversed.  They should never appear on ]
+#       [ Ethernet.  Others, not so marked, are normal reports (may be  ]
+#       [ seen on either).
+03-00-00-00-00-01	NETBIOS-# [TR?]
+03-00-00-00-00-02	Locate-Directory-Server # [TR?]
+03-00-00-00-00-04	Synchronous-Bandwidth-Manager-# [TR?]
+03-00-00-00-00-08	Configuration-Report-Server-# [TR?]
+03-00-00-00-00-10	Ring-Error-Monitor-# [TR?]
+03-00-00-00-00-10	(OS/2-1.3-EE+Communications-Manager)
+03-00-00-00-00-20	Network-Server-Heartbeat-# [TR?]
+03-00-00-00-00-40	(OS/2-1.3-EE+Communications-Manager)
+03-00-00-00-00-80	Active-Monitor # [TR?]
+03-00-00-00-01-00	OSI-All-IS-Token-Ring-Multicast
+03-00-00-00-02-00	OSI-All-ES-Token-Ring-Multicast
+03-00-00-00-04-00	LAN-Manager # [TR?]
+03-00-00-00-08-00	Ring-Wiring-Concentrator # [TR?]
+03-00-00-00-10-00	LAN-Gateway # [TR?]
+03-00-00-00-20-00	Ring-Authorization-Server # [TR?]
+03-00-00-00-40-00	IMPL-Server # [TR?]
+03-00-00-00-80-00	Bridge # [TR?]
+03-00-00-20-00-00	IP-Token-Ring-Multicast (RFC1469)
+03-00-00-80-00-00	Discovery-Client
+03-00-FF-FF-FF-FF	All-Stations-Address
+09-00-07-00-00-00/40	AppleTalk-Zone-multicast-addresses
+			# only goes through 09-00-07-00-00-FC?
+09-00-07-FF-FF-FF	AppleTalk-broadcast-address
+09-00-09-00-00-01	HP-Probe
+09-00-09-00-00-04	HP-DTC
+09-00-0D-00-00-00/24	ICL-Oslan-Multicast
+09-00-0D-02-00-00	ICL-Oslan-Service-discover-only-on-boot
+09-00-0D-02-0A-38	ICL-Oslan-Service-discover-only-on-boot
+09-00-0D-02-0A-39	ICL-Oslan-Service-discover-only-on-boot
+09-00-0D-02-0A-3C	ICL-Oslan-Service-discover-only-on-boot
+09-00-0D-02-FF-FF	ICL-Oslan-Service-discover-only-on-boot
+09-00-0D-09-00-00	ICL-Oslan-Service-discover-as-required
+09-00-1E-00-00-00	Apollo-DOMAIN
+09-00-2B-00-00-00	DEC-MUMPS?
+09-00-2B-00-00-01	DEC-DSM/DDP
+09-00-2B-00-00-02	DEC-VAXELN?
+09-00-2B-00-00-03	DEC-Lanbridge-Traffic-Monitor-(LTM)
+09-00-2B-00-00-04	DEC-MAP-(or-OSI?)-End-System-Hello?
+09-00-2B-00-00-05	DEC-MAP-(or-OSI?)-Intermediate-System-Hello?
+09-00-2B-00-00-06	DEC-CSMA/CD-Encryption?
+09-00-2B-00-00-07	DEC-NetBios-Emulator?
+09-00-2B-00-00-0F	DEC-Local-Area-Transport-(LAT)
+09-00-2B-00-00-10/44	DEC-Experimental
+09-00-2B-01-00-00	DEC-LanBridge-Copy-packets-(All-bridges)
+09-00-2B-01-00-01	DEC-LanBridge-Hello-packets-(All-local-bridges)
+09-00-2B-02-00-00	DEC-DNA-Level-2-Routing-Layer-routers?
+09-00-2B-02-01-00	DEC-DNA-Naming-Service-Advertisement?
+09-00-2B-02-01-01	DEC-DNA-Naming-Service-Solicitation?
+09-00-2B-02-01-09	DEC-Availability-Manager-for-Distributed-Systems-DECamds
+09-00-2B-02-01-02	DEC-Distributed-Time-Service
+09-00-2B-03-00-00/32	DEC-default-filtering-by-bridges?
+09-00-2B-04-00-00	DEC-Local-Area-System-Transport-(LAST)?
+09-00-2B-23-00-00	DEC-Argonaut-Console?
+09-00-4C-00-00-00	BICC-802.1-management
+09-00-4C-00-00-02	BICC-802.1-management
+09-00-4C-00-00-06	BICC-Local-bridge-STA-802.1(D)-Rev6
+09-00-4C-00-00-0C	BICC-Remote-bridge-STA-802.1(D)-Rev8
+09-00-4C-00-00-0F	BICC-Remote-bridge-ADAPTIVE-ROUTING
+09-00-56-FF-00-00/32	Stanford-V-Kernel,-version-6.0
+09-00-6A-00-01-00	TOP-NetBIOS.
+09-00-77-00-00-00	Retix-Bridge-Local-Management-System
+09-00-77-00-00-01	Retix-spanning-tree-bridges
+09-00-77-00-00-02	Retix-Bridge-Adaptive-routing
+09-00-7C-01-00-01	Vitalink-DLS-Multicast
+09-00-7C-01-00-03	Vitalink-DLS-Inlink
+09-00-7C-01-00-04	Vitalink-DLS-and-non-DLS-Multicast
+09-00-7C-02-00-05	Vitalink-diagnostics
+09-00-7C-05-00-01	Vitalink-gateway?
+09-00-7C-05-00-02	Vitalink-Network-Validation-Message
+09-00-87-80-FF-FF	Xyplex-Terminal-Servers
+09-00-87-90-FF-FF	Xyplex-Terminal-Servers
+0D-1E-15-BA-DD-06	HP
+33-33-00-00-00-00/16	IPv6-Neighbor-Discovery
+AA-00-03-00-00-00/32	DEC-UNA	
+AA-00-03-01-00-00/32	DEC-PROM-AA
+AA-00-03-03-00-00/32	DEC-NI20
+AB-00-00-01-00-00	DEC-MOP-Dump/Load-Assistance
+AB-00-00-02-00-00	DEC-MOP-Remote-Console
+AB-00-00-03-00-00	DECNET-Phase-IV-end-node-Hello-packets
+AB-00-00-04-00-00	DECNET-Phase-IV-Router-Hello-packets
+AB-00-03-00-00-00	DEC-Local-Area-Transport-(LAT)-old
+AB-00-04-01-00-00/32	DEC-Local-Area-VAX-Cluster-groups-SCA
+CF-00-00-00-00-00	Ethernet-Configuration-Test-protocol-(Loopback)
+FF-FF-00-60-00-04	Lantastic
+FF-FF-00-40-00-01	Lantastic
+FF-FF-01-E0-00-04	Lantastic
+
+FF-FF-FF-FF-FF-FF	Broadcast