conf.manufdb.* doesn't seem to work because Wireshark and some distros no longer ship the OUI database

[evverx]

Brief description

The "manuf" file was removed from the Wireshark repository in wireshark/wireshark@b4a421c and at least Fedora and Debian no longer ship it with Wireshark. Because of that conf.manufdb doesn't work even with Wireshark installed and the manufdb tests fail with

###(062)=[failed] Test manuf DB methods 

^[[34m^[[1m>>> ^[[0massert conf.manufdb._resolve_MAC("00:00:0F:01:02:03") == "Next:01:02:03"
Traceback (most recent call last):
  File "<input>", line 2, in <module>
AssertionError

It's possible to get it around by manually generating the "manuf" file and putting it in /usr/share/wireshark:

tshark -G manuf >/usr/share/wireshark/manuf

The Wireshark project periodically uploads it to https://www.wireshark.org/download/automated/data/manuf

Scapy version

0708e67

Python version

Python 3.12.2

Operating system

Fedora Rawhide

Additional environment information

wireshark-cli-4.2.2-2.fc40.x86_64

How to reproduce

It can be reproduced by running the "manufdb" tests on Fedora Rawhide (or Debian Testing) with the latest version of Wireshark installed:

python3 -m scapy.tools.UTscapy -t test/regression.uts -k manufdb

Actual result

###(062)=[failed] Test manuf DB methods 

^[[34m^[[1m>>> ^[[0massert conf.manufdb._resolve_MAC("00:00:0F:01:02:03") == "Next:01:02:03"
Traceback (most recent call last):
  File "<input>", line 2, in <module>
AssertionError

Expected result

No response

Related resources

No response

[wjholden]

I believe the manuf file is also no longer provided on Windows. You can manually install it with something like curl https://www.wireshark.org/download/automated/data/manuf -o 'C:\Program Files\Wireshark\manuf' to suppress the message WARNING: Wireshark is installed, but cannot read manuf !.

[lcnittl]

Related wireshark forum comment suggests to download the file (as suggested by @wjholden), or to create it with tshark -G manuf.

You can do so by

PS> cd "C:\Program Files\Wireshark"
PS> tshark -G manuf > manuf

[fossum]

Is the file needed to run? In Windows it'll log a warning which confuses my customers as the program runs just fine.

scapy/scapy/arch/windows/__init__.py

Line 213 in 0a2b2bc

log_loading.warning("Wireshark is installed, but cannot read manuf !") # noqa: E501

Can we lower the log level? Or warn when the file is actually needed?

[gpotter2]

This will be fixed in 2.6.0.

Having wireshark installed but no manuf file was very unexpected before it was recently removed, so the warning made a lot of sense.