Home > Archive > Ethernet > July 2005 > trace laptop via hardware address
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
trace laptop via hardware address
|
|
| ScreamingMan 2005-07-27, 8:48 am |
| Hello,
Might be the wrong group, but...
Is is possible, without having preinstalled tracing software, and
knowing the hardware address of the ethernet card, to trace a laptop? In
other words, can one find the IP address that the laptop is accessing the
web through?
Thanks
remove "spam" when replying
| |
| Patrick Schaaf 2005-07-27, 8:48 am |
| "ScreamingMan" <akiss@spam.life.uiuc.edu> writes:
> Is is possible, without having preinstalled tracing software, and
>knowing the hardware address of the ethernet card, to trace a laptop? In
>other words, can one find the IP address that the laptop is accessing the
>web through?
On the router which connects to the LAN that the laptop is plugged
in, you can look at the ARP table to find this information (if the
laptop has been active recently). If you don't have access to that
router, you are pretty much out of luck, as the Ethernet "hardware address"
has local network significance only, and is usually not transported on
further hops.
Also note that it is trivial to make any node use a different
hardware address, by simple configuration.
best regards
Patrick
| |
| Robert Redelmeier 2005-07-27, 8:48 am |
| ScreamingMan <akiss@spam.life.uiuc.edu> wrote:
> Is is possible, without having preinstalled tracing software,
> and knowing the hardware address of the ethernet card,
> to trace a laptop? In other words, can one find the IP
> address that the laptop is accessing the web through?
If it's nearby (on the same ethernet), sure.
You need to get access to ARP tables and caches.
Ideally a RARP query.
Once it has been routed (IPv4), the MAC is lost.
Some implementations of IPv6 embed the MAC in the IP.
So you cannot trace that laptop far.
-- Robert
| |
| William P. N. Smith 2005-07-27, 4:50 pm |
| "ScreamingMan" <akiss@spam.life.uiuc.edu> wrote:
> Is is possible, without having preinstalled tracing software, and
>knowing the hardware address of the ethernet card, to trace a laptop? In
>other words, can one find the IP address that the laptop is accessing the
>web through?
No, the MAC address disappears at the first {router,cable or DSL
modem,switch,device} that the packets hit.
| |
| James Knott 2005-07-27, 4:50 pm |
| ScreamingMan wrote:
> Hello,
>
> Might be the wrong group, but...
>
> Is is possible, without having preinstalled tracing software, and
> knowing the hardware address of the ethernet card, to trace a laptop? In
> other words, can one find the IP address that the laptop is accessing the
> web through?
I'm not quite sure what you're asking for. If you have any communication
with another computer, it's MAC address will be in your arp cache, for a
period of time. You could run a script on your router, to scan the apr
cache for the desired MAC address. Beyond that, you'll have to use some
analyser app, such as ethereal at some point where the data passes. With
the old non-switched ethernet, you could do that from anywhere on the
network. Now, you'd likely have to do it at the router leading to the ISP
or with a switch that provides port monitoring. Also, once a packet passes
through a router, the original MAC is lost.
| |
| James Knott 2005-07-27, 4:50 pm |
| William P. N. Smith wrote:
> No, the MAC address disappears at the first {router,cable or DSL
> modem,switch,device} that the packets hit.
Not quite. Switches and other level two devices do not discard the MAC.
Routers do. DSL is bit different, in that you usually have two different
connections going over the line. One is the original ethernet connection
to the modem, which will contain the MAC. The other is the PPPoE or PPPoA
connection, which does not contain the MAC.
| |
| glen herrmannsfeldt 2005-07-28, 1:47 am |
| ScreamingMan wrote:
> Is is possible, without having preinstalled tracing software, and
> knowing the hardware address of the ethernet card, to trace a laptop? In
> other words, can one find the IP address that the laptop is accessing the
> web through?
If you mean a stolen machine, where you don't know which network it
might be connected to, no. The MAC address does not pass through a router.
Now, it might be that software that depends on a MAC key would have
the MAC address sent through when it is registered, and you might find
that it could be traced that way.
-- glen
| |
| ScreamingMan 2005-07-28, 4:49 pm |
| Thanks, yes it was (is) a stolen machine. On the plus side, time for a new
machine.
Thanks
"glen herrmannsfeldt" <gah@ugcs.caltech.edu> wrote in message
news:wOadnR1hoa31G3XfRVn-sA@comcast.com...
> ScreamingMan wrote:
>
>
> If you mean a stolen machine, where you don't know which network it
> might be connected to, no. The MAC address does not pass through a
> router.
>
> Now, it might be that software that depends on a MAC key would have
> the MAC address sent through when it is registered, and you might find
> that it could be traced that way.
>
> -- glen
>
|
|
|
|
|