AP MAC OUI Address
The AP MAC OUI Address refers to the
Organizationally Unique Identifier (OUI), which comprises the first 3 bytes (24 bits)
of a
MAC address. This prefix is globally assigned by the IEEE to identify hardware
vendors.
In the context of wireless intrusion detection and rogue AP classification, the OUI helps in -
- Identifying the manufacturer of an access point.
- Distinguishing authorized APs from unauthorized or potentially rogue devices.
- Creating rules or filters to detect APs from specific vendors based on their MAC address prefix.
- Improving detection accuracy when signature-based or behavior-based classification is limited.
The OUI format is typically represented as six hexadecimal digits, grouped in pairs.
In SmartZone, OUI values can be matched within signature-based rules by scanning the frame header of incoming traffic and comparing it against known MAC address prefixes.