I had no idea about this; generally i thought it was done by OUI like the GP suggested - they have a small cached table of valid OUIs and warn on prefixes not in that subset. Thanks for sharing!