OS Identification : OUI

##
# (C) Tenable, Inc.
##

include("compat.inc");

if (description)
{
  script_id(102821);
  script_version("2.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/06/23");

  script_name(english:"OS Identification : OUI");

  script_set_attribute(attribute:"synopsis", value:
"It is possible to identify the remote operating system based on the
response from the MAC address OUI.");
  script_set_attribute(attribute:"description", value:
"This plugin attempts to identify the operating system by examining the MAC address OUI.");
  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_publication_date", value:"2017/08/29");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"asset_inventory", value:"True");
  script_set_attribute(attribute:"os_identification", value:"True");
  script_set_attribute(attribute:"hardware_inventory", value:"True");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"General");

  script_copyright(english:"This script is Copyright (C) 2017-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ethernet_manufacturer.nasl");
  script_require_keys("Host/ethernet_manufacturer/Enumerated");
  exit(0);
}

get_kb_item_or_exit("Host/ethernet_manufacturer/Enumerated");

# Get KB list and count per manufacturer
var manufacturers = get_kb_list_or_exit("Host/ethernet_manufacturer/macs/*");

# since there may be multiple interfaces made by different manufacturers...
var results = make_array();
var maker;
foreach maker (manufacturers)
{
  results[maker]++;
}

# ...Find the most common
var high_count = 0;
var m, high_maker = NULL;

foreach m (alpha_sort(keys(results)))
{
  if (results[m] > high_count)
  {
    high_count = results[m];
    high_maker = m;
  }
}

var report = "Ethernet interfaces associated with " + high_maker;

# List of manufacturers to check
var white_list = make_list(
  "Nest Labs Inc.",
  "NetApp",
  "Nintendo",
  "Sony Computer Entertainment",
  "Sony Interactive Entertainment Inc.",
  'Reolink Innovation Limited'
);

# Set the default confidence
var eth_conf = 90;

# Lower confidence for some vendors
if (high_maker >< 'Reolink Innovation Limited')
  eth_conf = 80;

# Check if the most common manufacturer is in the whitelist
var vendor, maker_disclaimer;

foreach vendor (white_list)
{
  if (vendor >< high_maker)
  {
    maker_disclaimer = "an operating system associated with " + high_maker;

    replace_kb_item(name:"Host/OS/Ethernet", value:maker_disclaimer);
    replace_kb_item(name:"Host/OS/Ethernet/Confidence", value:eth_conf);
    replace_kb_item(name:"Host/OS/Ethernet/Type", value:"embedded");

    security_note(port: 0, extra: '\n'+report);
    exit(0);
  }
}