trace laptop via hardware address

Hello,

Might be the wrong group, but...

Is is possible, without having preinstalled tracing software, and knowing the hardware address of the ethernet card, to trace a laptop? In other words, can one find the IP address that the laptop is accessing the web through?

Thanks

remove "spam" when replying

Reply to
ScreamingMan
Loading thread data ...

No, the MAC address disappears at the first {router,cable or DSL modem,switch,device} that the packets hit.

Reply to
William P. N. Smith

I'm not quite sure what you're asking for. If you have any communication with another computer, it's MAC address will be in your arp cache, for a period of time. You could run a script on your router, to scan the apr cache for the desired MAC address. Beyond that, you'll have to use some analyser app, such as ethereal at some point where the data passes. With the old non-switched ethernet, you could do that from anywhere on the network. Now, you'd likely have to do it at the router leading to the ISP or with a switch that provides port monitoring. Also, once a packet passes through a router, the original MAC is lost.

Reply to
James Knott

Not quite. Switches and other level two devices do not discard the MAC. Routers do. DSL is bit different, in that you usually have two different connections going over the line. One is the original ethernet connection to the modem, which will contain the MAC. The other is the PPPoE or PPPoA connection, which does not contain the MAC.

Reply to
James Knott

On the router which connects to the LAN that the laptop is plugged in, you can look at the ARP table to find this information (if the laptop has been active recently). If you don't have access to that router, you are pretty much out of luck, as the Ethernet "hardware address" has local network significance only, and is usually not transported on further hops.

Also note that it is trivial to make any node use a different hardware address, by simple configuration.

best regards Patrick

Reply to
Patrick Schaaf

If it's nearby (on the same ethernet), sure. You need to get access to ARP tables and caches. Ideally a RARP query.

Once it has been routed (IPv4), the MAC is lost. Some implementations of IPv6 embed the MAC in the IP. So you cannot trace that laptop far.

-- Robert

Reply to
Robert Redelmeier

If you mean a stolen machine, where you don't know which network it might be connected to, no. The MAC address does not pass through a router.

Now, it might be that software that depends on a MAC key would have the MAC address sent through when it is registered, and you might find that it could be traced that way.

-- glen

Reply to
glen herrmannsfeldt

Thanks, yes it was (is) a stolen machine. On the plus side, time for a new machine.

Thanks

Reply to
ScreamingMan

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.