Finding mac addresses

Chijtska · 02-19-2002, 06:35 AM

lets say you check your apache logs and you find someone's ip address that is consistently attacking your box... is there anyway to find that person's mac address with the ip address you have?

acid_kewpie · 02-19-2002, 06:46 AM

no.

you can find addresses if you own the dhcp server they use, otherwise, no not in your situation.

Chijtska · 02-19-2002, 09:11 AM

the reason i ask is say: someone has dynamic ip addressing (as im sure most 133t script kiddies do

) and you want to put their address in your hosts.deny file...how in the world would you do it?

kill-hup · 02-19-2002, 09:29 AM

You'd probably have to block their entire subnet - there's no easy way to block someone with a dynamic IP. Some ISP's have different subnets of addresses as well, depending on which access server the client connects to, so this will most likely turn into a game of cat-and-mouse every time the unwanted outsider gets a new address.

Your best bet is to log the date/times and types of the attacks along with the IP addresses used and contact their ISP's abuse staff.

LinuxGod · 02-27-2002, 03:57 AM

You would download portsentry and set it up to add portscanners
to a iptables block file, that would stop all the hassles.

Thanks

raz · 02-27-2002, 04:34 AM

That won't help.
Port 80 is public, you need content checking then blocking.

/Raz