Deduce vendor from mDNS services for privacy MACs

Modern devices increasingly use randomized ("Private WiFi Address") MACs,
which are locally administered and have no real OUI, so the MAC-prefix
vendor lookup returns nothing. Such devices still advertise distinctive
mDNS service types, which we now use to deduce their vendor.

- Extend the mDNS parser to also capture PTR service types alongside
  A-record hostnames.
- Add a service-type -> vendor mapping (data/mdns-service-vendor.json) and
  a service_vendor_finder, using canonical vendor names so device-type
  resolution still chains.
- Add utils::network::is_locally_administered to detect randomized MACs.
- In the mDNS scanner, fall back to service-based deduction only when the
  OUI lookup is empty and the MAC is locally administered.
- Group the three finders under a new data module.
- Preserve a known vendor (and its derived device_type) when a later
  sighting cannot deduce one, and suppress the spurious "vendor changed"
  notification in that case.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
rzuasti
2026-05-29 13:56:39 -04:00
co-authored by Claude Opus 4.7
parent 7fb457ca4a
commit 98a23aa7fd
12 changed files with 308 additions and 32 deletions
+13
View File
@@ -0,0 +1,13 @@
{
"_apple-mobdev2._tcp.local": "Apple, Inc.",
"_companion-link._tcp.local": "Apple, Inc.",
"_sleep-proxy._udp.local": "Apple, Inc.",
"_airport._tcp.local": "Apple, Inc.",
"_googlecast._tcp.local": "Google, Inc.",
"_googlezone._tcp.local": "Google, Inc.",
"_sonos._tcp.local": "Sonos, Inc.",
"_amzn-wplay._tcp.local": "Amazon Technologies Inc.",
"_amzn-alexa._tcp.local": "Amazon Technologies Inc.",
"_samsungmsf._tcp.local": "Samsung Electronics Co.,Ltd",
"_roku-rcp._tcp.local": "Roku, Inc."
}