LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-07-2004, 10:11 PM   #1
m00
LQ Newbie
 
Registered: Nov 2003
Posts: 2

Rep: Reputation: 0
can MAC addresses be tracked?


Hi, I'm curious if someone can help me with this question, never got a real answer from anyone who knew for sure

I'm on a cable network that uses dynamic IPs, If the CableModem is rebooted usually it gets the same IP it had before, but if I change the MAC address on the Router right behind the Modem, the Modem gets a different IP

If I were to start a file transfer or chat with someone they would see my Modems current IP adress and the Modem's MAC address(that I can never change) in the packets, right?

So once they get the MAC address of the Modem, can they use it to track the same Modem nomatter what IP address it gets? or can only static IP addresses be tracked?

There is no way to find a machine if you only know the MAC address of the Modem but not the IP, right?

I know the operators at the cable company can look up your Modem by its MAC address and find the IP, but can people outside the cable company do that?
 
Old 03-07-2004, 10:25 PM   #2
jtshaw
Senior Member
 
Registered: Nov 2000
Location: Seattle, WA USA
Distribution: Ubuntu @ Home, RHEL @ Work
Posts: 3,892
Blog Entries: 1

Rep: Reputation: 67
Unless the cable company is willing to give out that information it shouldn't be trackable.
 
Old 03-07-2004, 10:48 PM   #3
natalinasmpf
Member
 
Registered: Dec 2003
Distribution: Slackware 9.1
Posts: 309

Rep: Reputation: 30
MAC addresses are on the network physical level, as would sectors would be over filesystems (ie. filenames).

MAC addresses are used to identify people on a single subnet and uses the ARP protocol. The internet and IP system uses a combination and network of subnets, and the IP system transcends over the MAC, just as mount points and filesystems transcends over luns, channels, IRQ's and sectors.

Ie. there is this IP address, which is outside of your subnet (ie. from your company network to google.com) thus you rout the request to your gateway which connects to a WAN, which knows the MAC address oof the next gateway which knows the computer with the IP address is in this direction. The request heads for this subnet, which knows the MAC address of the next subnet, and finally the subnet of the home computer, which knows the MAC address of google.com. However, the subnets in between do not know this MAC address information routs to where, and thus you normally cannot use it, since the ARP information doesn't reach across external subnets.

Of course if you use a very manual request to a specific server (ie. IP tunneling) you can use MAC addresses. However, you have to know the specific subnet, how to connect it from the next subnet, all the way from your subnet.
 
Old 03-08-2004, 01:15 AM   #4
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 76
natalinasmpf has the technically correct answer. The short answer is this:
Only your ISP and other users on your same cable loop can see your MAC address, no one on the Internet can see that since MAC addresses are only used between hardware devices.

On another note, don't do anything stupid/illegal and think that just switching MAC/IP address will cover your tracks. There are tons of ways to figure out who/where you are just by your Internet presence.
 
Old 10-29-2004, 02:33 PM   #5
DigitalAmp
LQ Newbie
 
Registered: Oct 2004
Posts: 2

Rep: Reputation: 0
Re: can MAC addresses be tracked?

Quote:
Originally posted by m00

If I were to start a file transfer or chat with someone they would see my Modems current IP adress and the Modem's MAC address(that I can never change) in the packets, right?

So once they get the MAC address of the Modem, can they use it to track the same Modem nomatter what IP address it gets? or can only static IP addresses be tracked?
Here's the straight answer to your question. The answer is no. Your public ip isn't bound to your cable modem's mac, it's bound to the host's mac address, which in this case would be your router. Why else would your public ip change only when you change your router's mac? In other words, your cable modem is completely invisible to the outside (generally speaking) as it works transparently to bridge your host to the internet. The cable modem's mac address is tracked by your isp "exclusively," as all of them are assigned private ip addresses that are also tracked by the isp. So what you're looking at is this: The cable modem itself can never be tracked via internet based on it's mac address as it will never ever be visible to the public, only the isp that maintains it. What is trackable is your host's mac address (your router), but that's something that you can change, to get a new public ip. Hope this helps.
 
Old 10-30-2004, 07:10 AM   #6
natalinasmpf
Member
 
Registered: Dec 2003
Distribution: Slackware 9.1
Posts: 309

Rep: Reputation: 30
Public IP? As in the ISP proxy or?

I don't really recall my PC having two separate IP's. Yes, I have a "router", (but its more of a hardware Network Address Translation agent), with private 192.168.x.x IP's and all, but for the modem? Well you probably are correct, but I have no idea of this practice. My understanding is that the modem will request via DHCP to get its IP...it just as a private hardware verification thing (ie. verifying its a modem at sth address) but its not really a MAC thing, that deters activities like connecting to the network for free. . If you change your MAC address, it doesn't matter; it still will request via DHCP successfully as the ISP router will accept it.

I mean yes, if I change it in the middle of a download, it will be interrupted since you probably get an entirely new IP address. And anyone connecting to your former address will probably not know the new one.
 
Old 11-02-2004, 10:01 AM   #7
ugge
Senior Member
 
Registered: Dec 2000
Location: Gothenburg, SWEDEN
Distribution: OpenSUSE 10.3
Posts: 1,028

Rep: Reputation: 45
The question about MAC for the modem depends on the type of connection, cable or DSL.
Point to Point connections don't need physical addresses since they are the only devices connected to that particular circuit.
 
Old 11-16-2004, 09:50 PM   #8
DigitalAmp
LQ Newbie
 
Registered: Oct 2004
Posts: 2

Rep: Reputation: 0
Quote:
Originally posted by natalinasmpf
Public IP? As in the ISP proxy or?

I don't really recall my PC having two separate IP's. Yes, I have a "router", (but its more of a hardware Network Address Translation agent), with private 192.168.x.x IP's and all, but for the modem? Well you probably are correct, but I have no idea of this practice. My understanding is that the modem will request via DHCP to get its IP...it just as a private hardware verification thing (ie. verifying its a modem at sth address) but its not really a MAC thing, that deters activities like connecting to the network for free. . If you change your MAC address, it doesn't matter; it still will request via DHCP successfully as the ISP router will accept it.

I mean yes, if I change it in the middle of a download, it will be interrupted since you probably get an entirely new IP address. And anyone connecting to your former address will probably not know the new one.
Of course I didn't mean that the pc pulls two ip's. I was only stating that the cable modem is maintained by it's ISP via a private address (most likely a 10.x.x.x). This is done to save money as it would be too costly to provide each cable modem with an ARIN assigned ip. Meanwhile, it's the host, be it a computer, router, PS2, XBOX, Gigabit Toaster, whatever, that recieves the public ip, which would be outside of the 192..., 172..., or 10.x.x.x networks. Since most ISP DHCP leases arbitrarily expire (and even when they do you're usually assigned the same ip unless there's a network change or you leave your modem off long enough for another host to grab it), and remain bound to the host's mac, a good way to quickly change your ip is to change the host mac address. Try it.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables rules with MAC addresses ProtoformX Linux - Networking 5 04-28-2005 07:54 AM
can duplicate MAC addresses exist ? mehargags Slackware 3 03-22-2004 01:46 PM
Viewing MAC addresses ivanatora Linux - Networking 1 09-26-2003 12:47 PM
Mac Addresses nixdisciple Linux - Security 6 07-01-2002 10:55 PM
Finding mac addresses Chijtska Linux - Security 5 02-27-2002 04:34 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:42 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration