Do you want Gonzo to post your real name?

[moetheman]

Originally Posted by Mediaguy

I can get it for my machine, my local area network, my whole office... but not your machine.

You've been talking about getting originating computers' MAC addresses via the TCP/IP packets received at the destination server.

Your initial post in this thread on the subject stated flatly that tracking via MAC addresses was common, which is false.

It's true within a LAN.

In the other thread about this, you say:


I don't know about you but this reads to me like you're saying remote software could get my LAN-side MAC address... which is not true, unless a program or software within my LAN (malware, spyware, or something I downloaded willingly) broadcast the address to that other software.

Remote sofware without a direct connection or relationship with a program within my LAN will not read or detect my MAC address.

TCP/IP packets only carry current device/next device MAC addresses.

So my MAC address is in the initial packet to my router; then the packet's source and destination MAC addresses are re-written from my router and to my ISP; then from the ISP they are rewritten again, the destination replacing the source, and the new destination being the next node or router on the path to whatever site or IP address I'm headed for.

The packet is rewritten from each device's routing table - it's mini-memory of what other devices it's connected to which allow it to forward your request or packet to the next step...

Each device has it's own routing table and MAC address. The TCP/IP packet acquires the current and writes in the next address and will do the same at the next device.

These packets can't and don't retain the record of each device they've travelled through; it's inefficient and unecessary.

So there's no way the destination can read the originating computer's networking card MAC address...

Btw you inferred more than I implied, re. the inuendo.

Wrong.

Read what I wrote.

The last hop is not the place in the link of connections where you get the original device's MAC address. That gets you the first set (as the TCP packet contains both sender and receiver - each device NEEDS MAC addys to communicate with other devices) which leads to the second set, and so on until you arrive at the original device.

They are ALL linked together. The address information is contained within the TCP packets. Every single one has this info. It is only a matter of going from one device to another, until you arrive at the original destination.

That can be accomplished in several ways. All lead to the same result: the originating device's MAC address tracked by a server over the WAN.

Now, a worm installed on the originating device's operating system (or entering the LAN that the device is on) would - indeed - make it much easier. Entering the LAN and getting it yourself is actually the most reliable method, from what I have read. However. Those are just two of the methods. Not the only methods, by far.

Let me give you some background:

The data link layer, where the MAC address exists, is the lowest layer in the OSI model that deals with addressing. Each device has a unique number, which is known as both a MAC address or a hardware address. That number is used in that data link layer protocol to make sure that data meant to reach a certain machine gets there properly.
Devices VIRTUALLY connect at the layer where IP and HTTP are used, because those connections are CONCEPTUAL ONLY. When a request using IP is made, it is sent one jump at at time. At each jump, AN ACTUAL TRANSMISSION TAKES PLACE AT THE PHYSICAL AND DATA LINK LAYERS.
Thus, MAC addresses point to hardware devices at each jump. In order for that to happen successfully, the TCP packets HAVE to include both sender and receiver information (both hardware addys).
Once you have the first set, you simply backtrack through the sender sequence, until you finally arrive at the originating machine, which is what I stated before.

Let me repeat it one last time: the information (the set of MAC addys) related to the last hop going from originating device to the server in the transmission sequence is NOT the place to look - and it does not have to contain the MAC address you want in order for you to be able to eventually get it . . . it is not as if "if it isn't there then that's it, impossible."

Now, that info I posted above is not necessarily easy to find online on a website, but, at least in the tech communities that I belong to, it is pretty darn common knowledge that, if YOU WANT TO AVOID DETECTION ONE OF THE MANY THINGS YOU DO IS USE SOFTWARE TO SPOOF YOUR MAC ADDRESS(ES) CONTINUOUSLY . . . NOT EASY TO DO, BUT DOABLE.