| Author |
Message |
ScreamingMan
Guest
|
 Posted:
Wed Jul 27, 2005 4:20 pm Post subject:
trace laptop via hardware address |
|
|
Hello,
Might be the wrong group, but...
Is is possible, without having preinstalled tracing software, and
knowing the hardware address of the ethernet card, to trace a laptop? In
other words, can one find the IP address that the laptop is accessing the
web through?
Thanks
remove "spam" when replying |
|
| Back to top |
|
 |
Guest
|
| Posted:
Wed Jul 27, 2005 4:20 pm Post subject:
Re: trace laptop via hardware address |
|
|
"ScreamingMan" <akiss@spam.life.uiuc.edu> wrote:
| Quote: | Is is possible, without having preinstalled tracing software, and
knowing the hardware address of the ethernet card, to trace a laptop? In
other words, can one find the IP address that the laptop is accessing the
web through?
|
No, the MAC address disappears at the first {router,cable or DSL
modem,switch,device} that the packets hit. |
|
| Back to top |
|
|
Robert Redelmeier
Guest
|
| Posted:
Wed Jul 27, 2005 4:20 pm Post subject:
Re: trace laptop via hardware address |
|
|
ScreamingMan <akiss@spam.life.uiuc.edu> wrote:
| Quote: | Is is possible, without having preinstalled tracing software,
and knowing the hardware address of the ethernet card,
to trace a laptop? In other words, can one find the IP
address that the laptop is accessing the web through?
|
If it's nearby (on the same ethernet), sure.
You need to get access to ARP tables and caches.
Ideally a RARP query.
Once it has been routed (IPv4), the MAC is lost.
Some implementations of IPv6 embed the MAC in the IP.
So you cannot trace that laptop far.
-- Robert |
|
| Back to top |
|
|
Patrick Schaaf
Guest
|
| Posted:
Wed Jul 27, 2005 4:20 pm Post subject:
Re: trace laptop via hardware address |
|
|
"ScreamingMan" <akiss@spam.life.uiuc.edu> writes:
| Quote: | Is is possible, without having preinstalled tracing software, and
knowing the hardware address of the ethernet card, to trace a laptop? In
other words, can one find the IP address that the laptop is accessing the
web through?
|
On the router which connects to the LAN that the laptop is plugged
in, you can look at the ARP table to find this information (if the
laptop has been active recently). If you don't have access to that
router, you are pretty much out of luck, as the Ethernet "hardware address"
has local network significance only, and is usually not transported on
further hops.
Also note that it is trivial to make any node use a different
hardware address, by simple configuration.
best regards
Patrick |
|
| Back to top |
|
|
James Knott
Guest
|
| Posted:
Wed Jul 27, 2005 9:36 pm Post subject:
Re: trace laptop via hardware address |
|
|
ScreamingMan wrote:
| Quote: | Hello,
Might be the wrong group, but...
Is is possible, without having preinstalled tracing software, and
knowing the hardware address of the ethernet card, to trace a laptop? In
other words, can one find the IP address that the laptop is accessing the
web through?
|
I'm not quite sure what you're asking for. If you have any communication
with another computer, it's MAC address will be in your arp cache, for a
period of time. You could run a script on your router, to scan the apr
cache for the desired MAC address. Beyond that, you'll have to use some
analyser app, such as ethereal at some point where the data passes. With
the old non-switched ethernet, you could do that from anywhere on the
network. Now, you'd likely have to do it at the router leading to the ISP
or with a switch that provides port monitoring. Also, once a packet passes
through a router, the original MAC is lost. |
|
| Back to top |
|
|
James Knott
Guest
|
| Posted:
Wed Jul 27, 2005 9:40 pm Post subject:
Re: trace laptop via hardware address |
|
|
William P. N. Smith wrote:
| Quote: | No, the MAC address disappears at the first {router,cable or DSL
modem,switch,device} that the packets hit.
|
Not quite. Switches and other level two devices do not discard the MAC.
Routers do. DSL is bit different, in that you usually have two different
connections going over the line. One is the original ethernet connection
to the modem, which will contain the MAC. The other is the PPPoE or PPPoA
connection, which does not contain the MAC. |
|
| Back to top |
|
|
glen herrmannsfeldt
Guest
|
| Posted:
Thu Jul 28, 2005 8:20 am Post subject:
Re: trace laptop via hardware address |
|
|
ScreamingMan wrote:
| Quote: | Is is possible, without having preinstalled tracing software, and
knowing the hardware address of the ethernet card, to trace a laptop? In
other words, can one find the IP address that the laptop is accessing the
web through?
|
If you mean a stolen machine, where you don't know which network it
might be connected to, no. The MAC address does not pass through a router.
Now, it might be that software that depends on a MAC key would have
the MAC address sent through when it is registered, and you might find
that it could be traced that way.
-- glen |
|
| Back to top |
|
|
ScreamingMan
Guest
|
| Posted:
Thu Jul 28, 2005 4:20 pm Post subject:
Re: trace laptop via hardware address |
|
|
Thanks, yes it was (is) a stolen machine. On the plus side, time for a new
machine.
Thanks
"glen herrmannsfeldt" <gah@ugcs.caltech.edu> wrote in message
news:wOadnR1hoa31G3XfRVn-sA@comcast.com...
| Quote: | ScreamingMan wrote:
Is is possible, without having preinstalled tracing software, and
knowing the hardware address of the ethernet card, to trace a laptop? In
other words, can one find the IP address that the laptop is accessing the
web through?
If you mean a stolen machine, where you don't know which network it
might be connected to, no. The MAC address does not pass through a
router.
Now, it might be that software that depends on a MAC key would have
the MAC address sent through when it is registered, and you might find
that it could be traced that way.
-- glen
|
|
|
| Back to top |
|
|
|
|
|
|
FAQ
Memberlist
Register
Profile
Log in to check your private messages
Log in