LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 07-28-2005, 07:57 PM   #1
M$ISBS
Member
 
Registered: Aug 2003
Posts: 834

Rep: Reputation: 30
Is it safe to post a MAC address?


I have noticed some strange things in my syslog and during shutdown lately, There are ip address and MAC addresses in the part of the file I want to post, Is it safe (from a security standpoint) to post them? Thanks.
 
Old 07-28-2005, 08:11 PM   #2
Nathanael
Member
 
Registered: May 2004
Location: Karlsruhe, Germany
Distribution: debian, gentoo, os x (darwin), ubuntu
Posts: 940

Rep: Reputation: 33
posting mac addresses should be fine. ip addresses however can be a different matter. if they are private range (10.0.0.0/8 192.168.0.0/16 or i think this one is correct, but not 100% sure: 172.16.0.0/11 ) then you are fine posting them, if they are anything else... you could sensor them, ie: change a set of 8 bits to xxx (i would sugest to sensor 2nd or 3rd set of 8 bits)
 
Old 07-28-2005, 08:13 PM   #3
M$ISBS
Member
 
Registered: Aug 2003
Posts: 834

Original Poster
Rep: Reputation: 30
Thanks, I will go ahead then.
 
Old 07-28-2005, 08:14 PM   #4
macemoneta
Senior Member
 
Registered: Jan 2005
Location: Manalapan, NJ
Distribution: Fedora x86 and x86_64, Debian PPC and ARM, Android
Posts: 4,593
Blog Entries: 2

Rep: Reputation: 344Reputation: 344Reputation: 344Reputation: 344
Yes.

IP addresses are not secret: even this web site recorded your IP address when you connected. If you are using NAT (network address translation), your IP address is only significant to the local subnet.

MAC addresses can be changed at will, and are only significant to the local segment (basically the piece of wire that connects you to the router). Almost any interface can be set to any MAC; it is only required to be unique in the local subnet.

As a result, neither value is of any use to anyone else. If it were of use (for example, someone trying to spoof on your local subnet), a few seconds of using a sniffer (a program that captures packets) will reveal both IP addresses and MAC addresses.
 
Old 07-28-2005, 08:20 PM   #5
M$ISBS
Member
 
Registered: Aug 2003
Posts: 834

Original Poster
Rep: Reputation: 30
Getting lots of strange messages in my syslog file when I reboot?

Ok thanks.

Last edited by M$ISBS; 07-28-2005 at 08:22 PM.
 
Old 07-28-2005, 08:28 PM   #6
Nathanael
Member
 
Registered: May 2004
Location: Karlsruhe, Germany
Distribution: debian, gentoo, os x (darwin), ubuntu
Posts: 940

Rep: Reputation: 33
public ip's are not secret: that is true,
BUT
revealing public ip addresses can cause people to try and find vulnerabilities just for fun on those addresses.
just to avoid such a situation, i would not post the entire public ip address.
you never know what some 'mindless' people get up to, when they are bored, and stumble across an ip address... esp. on a computer techy forum.
 
Old 07-28-2005, 08:44 PM   #7
macemoneta
Senior Member
 
Registered: Jan 2005
Location: Manalapan, NJ
Distribution: Fedora x86 and x86_64, Debian PPC and ARM, Android
Posts: 4,593
Blog Entries: 2

Rep: Reputation: 344Reputation: 344Reputation: 344Reputation: 344
You'd probably be amazed how many hits your internet facing IP address gets already. I get several hundred per day; a few more from curious folks on this site certainly won't hurt. Anyone can be DDOS'd, but why expend the effort to DDOS a given arbitrary (and possibly fake) personal address, and in the process expose your zombies?

Trying to find vulnerabilities "just for fun" is illegal in some countries, so you would be risking jail time, fines, and equipment confiscation. Better to rent a DVD.
 
Old 07-28-2005, 09:49 PM   #8
Matir
LQ Guru
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Debian, Arch
Posts: 8,507

Rep: Reputation: 128Reputation: 128
If you do decide to censor IP address, suppose you have the following (FICTIOUS AND INVALID) IP addresses:

145.82.907.16
145.82.907.12

Please do not represent them both with 145.82.907.xxx. It helps to make sure each unique IP stays unique. Use yyy for one, or mask a different block.
 
Old 07-29-2005, 03:40 AM   #9
Nathanael
Member
 
Registered: May 2004
Location: Karlsruhe, Germany
Distribution: debian, gentoo, os x (darwin), ubuntu
Posts: 940

Rep: Reputation: 33
Quote:
Originally posted by macemoneta
You'd probably be amazed how many hits your internet facing IP address gets already. I get several hundred per day; a few more from curious folks on this site certainly won't hurt. Anyone can be DDOS'd, but why expend the effort to DDOS a given arbitrary (and possibly fake) personal address, and in the process expose your zombies?

Trying to find vulnerabilities "just for fun" is illegal in some countries, so you would be risking jail time, fines, and equipment confiscation. Better to rent a DVD.
No Sir, i know exactly what 'junk' comes into an interface connected to the internet (i know this from work, and private interest). DOS and DDOS is not at all what i had in mind either. because a lot of computers are not correctly secured, an ip address can be enough 'motivation' to some black-hat waering kid that knows a little about pen testing, or how to use vulnerabilities in services commonly run. (to me) it is irresponsible to be posting a public ip address, and with that possibly supporting such action.
i know that getting hold of ip addresses is not a problem at all, but in a post ip addresses could get mentioned along with critical infromation.

just sensor public ip addresses, if you do not know if the address you have is public or private, you can search google for 'private ip range' or something along that line.

Last edited by Nathanael; 07-29-2005 at 03:41 AM.
 
Old 07-29-2005, 08:49 AM   #10
Matir
LQ Guru
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Debian, Arch
Posts: 8,507

Rep: Reputation: 128Reputation: 128
Quote:
Originally posted by Nathanael

just sensor public ip addresses, if you do not know if the address you have is public or private, you can search google for 'private ip range' or something along that line.
Or use the wonderful 'ipcalc' utility.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to find an IP address from the MAC address of a remote machine ? jitz Linux - General 3 01-03-2006 07:55 AM
How to find IP address of a machine if I know their MAC Address dysenteryduke Linux - Networking 13 09-12-2005 10:21 AM
how to get ip address, broadcast address, mac address of a machine sumeshstar Programming 2 03-12-2005 04:33 AM
DHCP Server MAC Address found, IP address not assigned wmburke Linux - Wireless Networking 17 11-17-2004 10:33 AM
How to know MAC address ( Machine address)?? vanhelsing Linux - Networking 3 08-12-2004 09:30 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:19 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration