NetVendor: Turning Network Device Discovery Into Your First Line of Defense Against Cyber Threats

Updated October 5, 2026 · Formerly NetVendor

ShadowVendor turns exported MAC address lists, switch MAC tables and ARP tables into vendor inventories, interactive dashboards and reports that security teams can investigate. My open-source Python tool runs locally and supports formats from Cisco, HP/Aruba, Juniper, Extreme, Brocade and other equipment.

Start with the data you already have. ShadowVendor analyzes supplied files; it does not actively scan the network or prove that a device is safe. Its value is making vendor composition and changes easier to see.

Get ShadowVendor and its current documentation →
​

Why device visibility matters

Before a team can investigate unfamiliar equipment, review segmentation or plan an upgrade, it needs a useful inventory. ShadowVendor adds manufacturer information to observed MAC addresses and retains VLAN and port information where the input provides it. That gives analysts a starting point for questions such as: Which vendors appear in this segment? What has changed since the previous export? Which switch port should we investigate?

The results describe the supplied snapshot—not every device an organization owns. Repeatable collection from relevant network segments is part of the workflow.
​

How ShadowVendor works

1. Import. Save a MAC address list, a switch MAC address table or an ARP table as a file. ShadowVendor detects and parses supported formats.

2. Identify vendors. It normalizes addresses and checks a local OUI cache. An OUI is the manufacturer-assigned prefix of a MAC address. On a cache miss, normal operation can query external vendor services using the prefix, not the full MAC address.

3. Produce reports. Standard outputs include a device CSV, output/vendor_distribution.html and output/vendor_summary.txt. A port CSV is generated for MAC-table inputs; it is not a standard output for ARP tables or simple lists. VLAN and interface details depend on what the input contains.

4. Compare snapshots. Optional history archives store vendor summaries with run, site and change-ticket metadata. Drift analysis compares vendor counts and percentages over time.

5. Feed your monitoring workflow. Optional CSV and JSONL exports provide records for a security information and event management system (SIEM). Your ingestion pipeline and correlation rules turn these records into monitoring and alerts.

A practical first run

Follow the repository’s installation instructions, then try the included sample file before using a network export:

python3 ShadowVendor.py --offline tests/data/test-mac-table.txt
Review the device CSV and vendor summary in output/. The HTML dashboard visualizes vendor distribution. The current generated HTML references Plotly’s CDN, so viewing its charts in an air-gapped browser needs separate handling; offline analysis does not make that HTML report self-contained.

For your own saved export:

python3 ShadowVendor.py --offline my_switch.txt
Choose the right entry point. Use python3 ShadowVendor.py for advanced flags. The shadowvendor command and python3 -m shadowvendor are basic input-file wrappers. A separate shadowvendor.analyze_file Python API supports integration in scripts.
​

Security use cases

• Unfamiliar equipment: investigate new or unexpected vendor patterns alongside asset records, ownership and endpoint evidence. A consumer vendor or a Raspberry Pi is a lead, not proof of compromise.
• Segmentation review: use available VLAN and port mappings to identify devices worth checking. Inventory data does not verify firewall rules, routing policy or isolation by itself.
• IoT triage: narrow an investigation by vendor, then confirm the actual model, firmware and affected product range. An OUI match alone cannot establish vulnerability.
• Change and incident review: correlate shifts in vendor composition with approved changes and other security telemetry.
• Audit preparation: retain dated inventories as supporting evidence. Protect those exports with your own access controls and retention process; ordinary CSV and text reports are not immutable or cryptographically tamper-evident.

History and SIEM integration

This example analyzes an export, records vendor history and produces SIEM files:

python3 ShadowVendor.py --offline --history-dir history --analyze-drift --siem-export --site DC1 --environment prod --change-ticket CHG-12345 my_switch.txt
The SIEM files are output/siem/shadowvendor_siem.csv and output/siem/shadowvendor_siem.json. Despite its extension, the latter contains JSONL: one JSON object per line.

Records contain timestamp, site, environment, mac, vendor, device_name, vlan, interface, input_type and source_file. The timestamp is the export’s UTC time. A device name can be derived from its MAC address; it is not necessarily a discovered hostname. The current schema does not include first_seen or last_seen.

Configure collection, scheduling, ingestion and rules in your operational environment. ShadowVendor’s exports support those systems; the tool does not automatically configure a SIEM, quarantine devices or provide continuous monitoring on its own. Read the integration guide.
​

Privacy and limits

Local processing: input files and full MAC addresses are processed on your machine. Default cache misses may send OUI prefixes to external lookup APIs. --offline disables those lookups; uncached vendors appear as Unknown. This describes the analysis process, separately from the dashboard’s CDN dependency.

Attribution is not identity: MAC addresses may be spoofed, randomized or locally administered. A vendor label does not establish the exact device, its owner, its trustworthiness or its security state.

Coverage follows collection: absent, powered-down or unobserved equipment may not appear. Gather appropriate edge-switch and segment data, and compare results with endpoint, asset and network-management systems.

Use complementary controls: authenticated inventories, endpoint detection, packet analysis, active discovery and network access control answer questions that vendor-prefix analysis cannot. ShadowVendor is an inventory and analysis aid, not an EDR, vulnerability scanner or enforcement system.
​

The Quantum Shield connection

Device visibility can support post-quantum migration planning by identifying infrastructure that needs further assessment. A vendor inventory is not a cryptographic inventory: it does not identify deployed algorithms, certificates, firmware support or quantum readiness. Combine its findings with those assessments before making migration decisions.

The same boundary applies to the Cerberus framework: ShadowVendor can supply contextual inventory evidence, but does not itself detect quantum attacks, implement an AI council or detect harvest-now-decrypt-later activity.
​

Next step

Run the sample, inspect the output and establish a repeatable collection process. Add history or SIEM exports when you have a clear use for comparisons and alerts. The goal is a better-supported investigation—not automatic trust in a vendor label.
​

About the Author

Stewart Alexander is an experienced cybersecurity strategist focusing on AI-powered threat detection and quantum-resistant defenses. He provides practical insights and expert guidance to protect digital assets against emerging cyber threats. His work on the Quantum Shield Initiative explores the intersection of quantum computing, artificial intelligence, and cybersecurity strategy for the coming decade.

Sources
[1] Guidance on digital forensics and protective monitoring ... https://www.ic3.gov/CSA/2025/250204.pdf
[2] Enhanced Visibility and Hardening Guidance for ... https://www.ic3.gov/CSA/2024/241203.pdf
[3] MAC Address Lookup | MAC/OUI/IAB/IEEE Vendor Search https://dnschecker.org/mac-lookup.php
[4] 2025 Report Exposes Widespread Device Security Risks https://www.paloaltonetworks.com/blog/network-security/2025-report-exposes-widespread-device-security-risks/
[5] Leveraging MAC Address Logic for IoT Classification | Cato Networks https://www.catonetworks.com/blog/leveraging-mac-address-logic-for-iot-classification/
[6] How to use Wireshark OUI lookup for network security - TechTarget https://www.techtarget.com/searchsecurity/tutorial/How-to-use-Wireshark-OUI-lookup-for-network-security
[7] MAC Address Lookup - MAC/OUI Vendor Search https://macaddresslookup.io
[8] GitHub - StewAlexander-com/NetVendor: □ MAC address analyzer and visualization tool - What manufacturers / vendors / devices are lurking on your network? NetVendor is a Python tool that analyzes MAC/ARP data to visualize and track the distribution of devices on a network for enhanced network security. https://github.com/StewAlexander-com/NetVendor
[9] Step 1: Asset Discovery and Prioritization - Palo Alto Networks https://docs.paloaltonetworks.com/best-practices/zero-trust-best-practices/zero-trust-best-practices/the-five-step-methodology/step-1-asset-discovery-and-prioritization
[10] Use Case A: Discovery and Identification of IDs, Assets, and Data ... https://pages.nist.gov/zero-trust-architecture/VolumeD/UseCaseA.html
[11] A 2025 Guide to Shadow IT Discovery - Nudge Security https://www.nudgesecurity.com/post/shadow-it-discovery
[12] How to identify unknown devices on your network: A complete guide https://blog.paessler.com/how-to-identify-unknown-devices-on-your-network-a-complete-guide
[13] Network device identification - Motadata https://www.motadata.com/it-glossary/network-device-identification/
[14] Indicators of Compromise Associated with LockBit 2.0 ... https://www.ic3.gov/CSA/2022/220204.pdf
[15] Hands-On Pointers for VLAN-Based Security | FedTech Magazine https://fedtechmagazine.com/article/2011/05/hands-pointers-vlan-based-security
[16] [pdf] VLAN Best Practices - TEquipment https://assets.tequipment.net/assets/1/26/Documents/WhitePaper-VLANBestPractices.pdf
[17] Home Internet Connected Devices Facilitate Criminal Activity https://www.ic3.gov/PSA/2025/PSA250605
[18] Common Internet of Things Devices May Expose ... https://www.ic3.gov/PSA/2017/PSA171017
[19] HiatusRAT Actors Targeting Web Cameras and DVRs https://www.ic3.gov/CSA/2024/241216.pdf
[20] Device Hardening Tactics for 2025 IoT Cybersecurity - Asimily https://asimily.com/blog/defend-your-iot-with-device-hardening-tactics-for-a-secure-2025/
[21] How Network Monitoring Detects Insider Threats and Compromised ... https://www.exabeam.com/blog/security-operations-center/insider-threats-and-compromised-devices-how-network-monitoring-uncovers-security-blind-spots/
[22] Mitigating Cyber Threats with Limited Resources https://www.ic3.gov/CSA/2024/240514.pdf
[23] Insider Threat Detection Software To Prevent Data Loss - Teramind https://www.teramind.co/solutions/insider-threat-detection/
[24] Asset Inventory Guidance for Owners and Operators https://www.ic3.gov/CSA/2025/250813.pdf
[25] The Quantum Shield Initiative - Stew Alexander https://www.stewalexander.com/quantum-shield-initiative
[26] Zero Trust Security: Key Principles and How to Implement Them https://www.cynet.com/zero-trust/zero-trust-security/
[27] Device Identity: The Foundation for Zero Trust Network Access https://www.lansweeper.com/blog/cybersecurity/device-identity-for-zero-trust-network-access/
[28] 12 Network Security Solutions to Know in 2025 - Faddom https://faddom.com/12-network-security-solutions-to-know-in-2025/
[29] 2023 Top Routinely Exploited Vulnerabilities https://www.ic3.gov/CSA/2024/241112.pdf
[30] 8 Network Monitoring Tools to Know in 2025 - Exabeam https://www.exabeam.com/explainers/network-security/8-network-monitoring-tools-to-know-in-2025/
[31] Of MAC Addresses and OUI: A Subtle, but Useful, Recon Resource https://www.secureideas.com/blog/of-mac-addresses-and-oui-a-subtle-but-useful-recon-resource
[32] How to Identify Devices on a Network - IT Glossary | SolarWinds https://www.solarwinds.com/resources/it-glossary/network-device-identification
[33] Network device discovery and vulnerability management https://learn.microsoft.com/en-us/defender-endpoint/network-devices
[34] Identifying and Mitigating Living Off the Land Techniques https://www.ic3.gov/CSA/2024/240207-2.pdf
[35] Best practices for event logging and threat detection https://www.ic3.gov/CSA/2024/240822.pdf
[36] Modern Approaches to Network Access Security https://www.ic3.gov/CSA/2024/240618.pdf
[37] Fast Flux: A National Security Threat https://www.ic3.gov/CSA/2025/250403.pdf
[38] Identification and Disruption of QakBot Infrastructure https://www.ic3.gov/CSA/2023/230830.pdf
[39] Principles of operational technology cyber security https://www.ic3.gov/CSA/2024/241001-quick_reference_guide.pdf
[40] MAC Address to Vendor API with Python (macvendorlookup.com) https://www.youtube.com/watch?v=htoDMdVzJGw
[41] 5 Best MAC Address Lookup Tools for Network Admins https://topsoftwarecompanies.co/technology/5-best-mac-address-lookup-tools-for-network-admins
[42] MAC Address Lookup - MAC OUI IAB IEEE Vendor Search https://aruljohn.com/mac.pl
[43] MACVendors.com: Home | MAC Vendor Lookup Tool & API https://macvendors.com
[44] [doc] Cyber Security Requirements for Vendors - NUPIC.com https://www.nupic.com/NUPIC/GetFile.aspx?ID=67&tbl=HOME_HOT_TOPICS_DOCS&idFN=id&fileFN=file_name
[45] OUI Lookup Tool - Wireshark https://www.wireshark.org/tools/oui-lookup.html
[46] StewAlexander-com/NetVendor 简介 - GitHub中文社区 https://www.github-zh.com/projects/434393900-netvendor
[47] Detect & Identify Network Devices | IT Security for MSPs - N-able https://www.n-able.com/blog/identify-network-devices-and-how-to-securely-manage-them
[48] standards - oui . ieee https://standards-oui.ieee.org
[49] MAC Address Lookup Tool - AskApache https://www.askapache.com/online-tools/mac-lookup/
[50] How do you reliably identify network devices vs endpoints and pull ... https://www.reddit.com/r/cybersecurity/comments/1na2s7m/how_do_you_reliably_identify_network_devices_vs/
[51] Countering Chinese State-Sponsored Actors Compromise ... https://www.ic3.gov/CSA/2025/250827.pdf
[52] #StopRansomware Guide https://www.ic3.gov/CSA/2023/230523.pdf
[53] Guide to Securing Remote Access Software https://www.ic3.gov/CSA/2023/230606.pdf
[54] 2021 Trends Show Increased Globalized Threat of ... https://www.ic3.gov/CSA/2022/220209.pdf
[55] Mitigating Log4Shell and Other Log4j-Related Vulnerabilities https://www.ic3.gov/CSA/2021/211222.pdf
[56] Creating and maintaining a definitive view of your ... https://www.ic3.gov/CSA/2025/250929.pdf
[57] #StopRansomware: Royal Ransomware Update https://www.ic3.gov/CSA/2023/231113.pdf
[58] LockBit https://www.ic3.gov/CSA/2023/230614.pdf
[59] Threat Actors Deploy LummaC2 Malware to Exfiltrate ... https://www.ic3.gov/CSA/2025/250521-2.pdf
[60] Russian State-Sponsored Cyber Actors Target Cleared ... https://www.ic3.gov/CSA/2022/220217.pdf
[61] People's Republic of China cyber threat activity https://www.ic3.gov/CSA/2025/250620.pdf
[62] 2022 Top Routinely Exploited Vulnerabilities https://www.ic3.gov/CSA/2023/230803.pdf
[63] Iran-based Cyber Actors Enabling Ransomware Attacks on ... https://www.ic3.gov/CSA/2024/240828.pdf
[64] How to Implement Zero Trust: A Step-by-Step Guide - Apono https://www.apono.io/blog/how-to-implement-zero-trust/
[65] Endpoint security monitoring: What to know in 2025 | ConnectWise https://www.connectwise.com/blog/endpoint-security-monitoring
[66] Best Practices for vlans? : r/homelab - Reddit https://www.reddit.com/r/homelab/comments/v8gbut/best_practices_for_vlans/
[67] Network Monitoring Management: Ultimate Guide 2025 - Concertium https://concertium.com/network-monitoring-management-guide-2025/
[68] Back to Basics: Solving Zero Trust Through Asset Discovery - Claroty https://claroty.com/resources/datasheets/back-to-basics-solving-zero-trust-through-asset-discovery
[69] VLANs: Effective Network Segmentation for Security - eSecurity Planet https://www.esecurityplanet.com/networks/what-is-a-vlan/
[70] The Zero Trust Transformation: From Application Discovery… https://www.appgate.com/blog/the-zero-trust-transformation-from-application-discovery-to-enforcing-the-right-access-policies
[71] Best practices for native VLAN configuration - The Meraki Community https://community.meraki.com/t5/Security-SD-WAN/Best-practices-for-native-VLAN-configuration/m-p/48230
[72] How is AI Changing Network Monitoring and Security in 2025? https://learningnetwork.cisco.com/s/question/0D5Kd0000CBLrZrKQL/how-is-ai-changing-network-monitoring-and-security-in-2025- [73] VLAN Best Practices - Hewlett Packard Enterprise Community https://community.hpe.com/t5/switches-hubs-and-modems/vlan-best-practices/td-p/4699585
[74] Trend Micro Named a Leader in Network Analysis and Visibility https://newsroom.trendmicro.com/2025-10-15-Trend-Micro-Named-a-Leader-in-Network-Analysis-and-Visibility
[75] Increase in Insider Threat Cases Highlight Significant Risks ... https://www.ic3.gov/PSA/2014/PSA140923.pdf
[76] Cybercrime | Federal Bureau of Investigation https://www.fbi.gov/investigate/cyber
[77] Joint Cybersecurity Information AI Data Security https://www.ic3.gov/CSA/2025/250522.pdf
[78] 2024 U.S. Federal Elections: The Insider Threat https://www.ic3.gov/CSA/2024/240628.pdf
[79] People's Republic of China State-Sponsored Cyber Actor ... https://www.ic3.gov/CSA/2023/230524.pdf
[80] Ongoing Cyber Threats to U.S. Water and Wastewater ... https://www.ic3.gov/CSA/2021/211014.pdf
[81] PRC State-Sponsored Cyber Activity: Actions for Critical ... https://www.ic3.gov/CSA/2024/240321.pdf
[82] Potential for Malicious Cyber Activities to Disrupt the 2020 ... https://www.ic3.gov/CSA/2021/210719.pdf
[83] Simplifying IoT Segmentation for Enterprises - Elisity https://www.elisity.com/simplifying-iot-segmentation-for-enterprises
[84] Shadow IT: The Haunting Inside Your Network - BitSight Technologies https://www.bitsight.com/blog/shadow-it
[85] Network Segmentation: Why It's a Must-Have for Cybersecurity in 2025 https://www.cybermaxx.com/resources/network-segmentation-why-its-a-must-have-for-cybersecurity-in-2025/
[86] SaaS Discovery Tool | Reveal Shadow IT & Shadow AI | Auvik https://www.auvik.com/saas-management/saas-discovery/
[87] Insider Threat Toolkit - CDSE https://www.cdse.edu/Training/Toolkits/Insider-Threat-Toolkit/
[88] How to Detect and Manage Shadow IT in 5 Steps - Grip Security https://www.grip.security/blog/5-steps-to-detect-and-control-shadow-it
[89] Data on Insider Threats Reveal Hidden Risk Patterns - Dark Reading https://www.darkreading.com/insider-threats/inside-the-data-on-insider-threats-what-1000-real-cases-reveal-about-hidden-risk
[90] 2025 Trends in IoT Device Identity and Access Management (IAM) https://deviceauthority.com/2025-trends-in-iot-device-identity-and-access-management-iam/
[91] Shadow IT Discovery - HarfangLab https://harfanglab.io/attack-surface-management/shadow-it-discovery/
[92] Seeking Recommendations for SIEM Software for Insider Threat ... https://www.reddit.com/r/AskNetsec/comments/1fiout5/seeking_recommendations_for_siem_software_for/
[93] Is IoT Finally Secure? What 2025 Taught Us About Cyber Risk in ... https://iotbreakthrough.com/is-iot-finally-secure-what-2025-taught-us-about-cyber-risk-in-connected-devices/
[94] Shadow IT SaaS analytics - Cloudflare Zero Trust https://developers.cloudflare.com/cloudflare-one/insights/analytics/shadow-it-discovery/
[95] Insider Threat Detection | Real-Time AI Monitoring - Seceon https://seceon.com/insider-threat-detection/
[96] Announcing The Forrester Wave™: IoT Security Solutions, Q3 2025 https://www.forrester.com/blogs/announcing-the-forrester-wave-iot-security-solutions-q3-2025/
[97] Shadow IT Discovery and App Blocking - Cisco Umbrella https://umbrella.cisco.com/solutions/shadow-it-app-discovery