use first-3 octets to identify unknowns