Ok guys and gals, bear with me here. I'm not new to the whole security deal, but I am new to home brewed tools and methods. I was sitting here thinking the other night about remote OS detection and the like. How much easier it is (from either side of the fence) to know almost certainly what is at the other end. I decided to put together a little script that would (kinda) do this.

Take a list of hosts, be it from a file, or an active pipe from stdin and strip down the garbage out of the hostnames to the pure MAC address. Then run the results against a database of known vendors. I got something put together that gets me this far:

nmap -sL 24.*.*.*/24 | sed -e 's/garbage//g' | sed -e 's/.more.garbage.net//g' | sed -e 's/ not scanned//g' >> /tmp/macandip

that leaves me with something like this

080046a34ebf (24.*.*.*)
0040f4282e91 (24.*.*.*)

how in the f**K do I get the colons in there, or whatever. I'm tired, and my pot of coffee has run dry.

I'm a noob, all I need help with is the text manipulaiton and I'll have it. I know that theres shortcuts, etc, that I'm missing here, I'm just trying to get a little shove towards what to do next. I'll post the full deal when I get it done, if ever. Thanks for any help, rants, comments, etc...

Jonesy