Using the Support Files
The information contained in the nmap support files is used differently depending on the selected scan type or option. Not all nmap support files will necessarily be referenced at the same time, but it is possible to create a complex scanning session that would utilize information in all of these support files.


nmap-mac-prefixes
The nmap-mac-prefixes file contains a list of the Organizationally Unique Identifiers (OUIs) assigned to 802-based LAN hardware adapters. Every Ethernet card has a media access control (MAC) address that is burned into the Read Only Memory (ROM) of the network adapter. Many adapter card drivers allow the MAC address to be changed, so this address shouldn't be considered a permanently fixed value. Many network administrators will change their MAC address to something more colorful, such as 11:22:33:44:55:66 or 00:00:BA:5E:BA:11. This allows the network administrator to easily find their MAC address in a report or log file.

MAC addresses are six bytes long, and are usually referenced in hexadecimal form. They are often written without the traditional "0x" reference that usually precedes hex values, and each byte is usually separated with a delimiter such as a hyphen (-) or a colon (:).

An example of a MAC address assigned to an Ethernet card is 00:11:43:43:A8:34. The first three bytes, 00:11:43, are assigned by the Institute of Electrical and Electronics Engineers (IEEE) to the manufacturer of the adapter card. A quick search of the nmap-mac-prefixes file shows that the OUI is assigned to Dell.

The last three bytes of this particular MAC address, 43:A8:34, are considered unique to the adapter card and shouldn't match any other adapter. Although these three bytes provide at least 16,777,215 combinations of unique MAC addresses, adapter card manufacturers have occasionally duplicated MAC addresses due to oversights in the manufacturing process.

The registered list of OUIs is administered and maintained by the IEEE. The OUIs are constantly updated, and a list is available from the IEEE web page.

http://standards.ieee.org/regauth/oui/index.shtml

Additional information on OUIs is available in the IEEE Frequently Asked Questions (FAQs).

http://standards.ieee.org/faqs/OUI.html

The nmap-mac-prefixes file is used to correlate and display manufacturer names in the nmap output instead of the raw hexadecimal bytes. This is an excerpt from the nmap-mac-prefixes file: 
-----

0000A3 Network Application Technology
0000A4 Acorn Computers Limited
0000A5 Compatible Systems
0000A6 Network General
0000A7 Network Computing Devices
0000A8 Stratus Computer

-----