Mac Address

manu

Oct 14 2003, 07:40 AM

Hey friends,

I have got one of my remote friend's IP address and Mac address. Well, MAC address should be unique, right?... Hey, the thing is, he is using DIALUP to connect the NET and he is getting IP from his ISP Dhcp server... That means, it will change each time he connects.. But, what about that MAC ADDRESS?.. From where it came?.. There is no Network Card in his PC, Well, I have heard about DIALUP ADAPTER etc stuffs, but, can anybody tell me from where that MAC address came?.. Or tell me, if it is unique one for his computer, is there anyway to trace him with it in future when ever he comes Online?... Is there any tools to check the MAC address of a distant PC ?.. Well, if my question is soemthing stupid, dont mind..

I hope that friends in this forum could help me to clear my doubts, thanks in advance..!!

Manu

andariel

Oct 16 2003, 10:55 AM

Hi,
If I am not wrong, a MAC address is just unique in a subnet. It is not unique in all subnets.
Correct me if I am wrong.

nemesis

Apr 17 2004, 01:53 AM

hi,

maybe it's a little late for answering, but anyway..

@manu

QUOTE

But, what about that MAC ADDRESS?.. From where it came?..

it's the ISP who gives him a temporary MAC address

@andariel

QUOTE

It is not unique in all subnets

MAC address is connected with network adapter. Like your car has a numberplate or your hard drive a serial number, a net adapter has a mac address.

Allthough, on some devices you can change your mac address, such as routers.

QUOTE

Is there any tools to check the MAC address of a distant PC ?..

i'm a bit tired, it's 3:45 am so the only thing that comes up to me is to sniff some packets.. ethereal is nice & runs on everything. Just check some packets that come from or go to the one whose mac address you have. just look at source and destination. something like src: 00:30:04:C3:F1:05

QUOTE

is there anyway to trace him with it in future when ever he comes Online

i was just asking me the same question

how can i find an IP with a MAC address? Or is it impossible?

tx ya all

NiteWorM

Apr 17 2004, 02:53 AM

Here is something to think about mac addressses are oftenly used by routers using a protocol called arp(Address Resolution Protocol) this protocol has an ip but needs the mac address so it sends out broadcasts to find the mac address,

But wat if the router has a mac address and not the ip address?
well then the router does a thing called rarp ( Reverse Address Resolution Protocol) where it sends out broadcasts asking for the ip address of the mac.

enjoy dunno if that helps u but its something to think about

nuorder

Apr 17 2004, 03:50 AM

one way to look at it is that MAC adresses work on the data layer, ie the network interface on the router only cares about MAC addresses, so does your modem, ie your modem as a hardware device would not understand an ip address but understands only MAC adresses

IP is used to forward packets between 2 hosts, how it gets there is up to the routers. the routers will forward the packet using the MAC address so normally when you receive a packet the IP address would be from the person who sent it to you and the MAC address would be from the last router that had that packet

therfore i imagine that unless you found a way to use NiteWorM's method determining the real MAC address would be difficult

tweakz20

Apr 17 2004, 03:54 AM

actually, according to google, it's a HARDWARE address (to confirm my doubts...) it doesn't come from your ISP, it's unique to that certain lan card/modem (to change it? maybe some can allow, but i know mine can't)
something that tracks a mac? that's a pretty good idea... didn't hear of anything though, sorry

NiteWorM

Apr 17 2004, 04:06 AM

QUOTE

actually, according to google, it's a HARDWARE address (to confirm my doubts...) it doesn't come from your ISP, it's unique to that certain lan card/modem (to change it? maybe some can allow, but i know mine can't)

Yeah you cant change it at all, its imprinted into to card \ modem the only way to change it is to buy a new card

Oberon1879

Apr 17 2004, 07:27 AM

QUOTE (NiteWorM @ Apr 17 2004, 04:06 AM)

Yeah you cant change it at all, its imprinted into to card \ modem the only way to change it is to buy a new card

as far as i know there are certain models of network card where you can change the MAC addresse. furthermore there are some programms that can change your mac addresse.
you can even change your MAC adresse in your windows network settings but i dunno if that really works.

nuorder

Apr 17 2004, 08:42 AM

QUOTE (Oberon1879 @ Apr 17 2004, 07:27 AM)

QUOTE (NiteWorM @ Apr 17 2004, 04:06 AM)

Yeah you cant change it at all, its imprinted into to card \ modem the only way to change it is to buy a new card

as far as i know there are certain models of network card where you can change the MAC addresse. furthermore there are some programms that can change your mac addresse.
you can even change your MAC adresse in your windows network settings but i dunno if that really works.

here is one tool for the job of changing ur MAC address

SMAC
http://www.klcconsulting.net/smac/

it works for me, but im not sure what u gain from changing ur MAC address, maybe arp spoofing but thats about it

as i said MAC is only for one network interface to another so you dont really gain much information

dissolutions

Apr 17 2004, 09:38 AM

MAC Addreses are Vendor Specific, assigned by the IEEE
Other names for MAC Addreses are the OUI
For more explanation on this:

QUOTE

What is an Organizationally Unique Identifier (OUI)/"company_id"?

An OUI / "company_id" is a 24-bit globally unique assigned number referenced by various standards. For example, the OUI is used in the family of 802 LAN standards: Ethernet, Token Ring, etc. The OUI is usually concatenated with another 24 bits that are assigned by that Organization in order to make a 48-bit number that is unique to a particular piece of hardware, to make it possible to uniquely address that hardware. For example, the Ethernet MAC Address is such a 48-bit number, unique to one particular Ethernet interface. The OUI is usually concatenated with 24 or 40 bits to form an EUI-48 or an EUI-64. There are other uses of the OUI however, such as its use as a company identifier in the SNAP protocol.

For Vendor specific addresses point your browser here: http://standards.ieee.org/regauth/oui/oui.txt

nackas

Apr 17 2004, 10:30 AM

QUOTE (nuorder @ Apr 17 2004, 06:42 PM)

QUOTE (Oberon1879 @ Apr 17 2004, 07:27 AM)

QUOTE (NiteWorM @ Apr 17 2004, 04:06 AM)

Yeah you cant change it at all, its imprinted into to card \ modem the only way to change it is to buy a new card

as far as i know there are certain models of network card where you can change the MAC addresse. furthermore there are some programms that can change your mac addresse.
you can even change your MAC adresse in your windows network settings but i dunno if that really works.

here is one tool for the job of changing ur MAC address

SMAC
http://www.klcconsulting.net/smac/

it works for me, but im not sure what u gain from changing ur MAC address, maybe arp spoofing but thats about it

as i said MAC is only for one network interface to another so you dont really gain much information

You can change your static IP depending on your ISP. Most link your IP and MAC address, so if you change network adapters, or somehow change your MAC address.. you then will have a new IP

nemesis

Apr 17 2004, 01:39 PM

QUOTE

actually, according to google, it's a HARDWARE address (to confirm my doubts...) it doesn't come from your ISP, it's unique to that certain lan card/modem (to change it? maybe some can allow, but i know mine can't)

Yeah you cant change it at all, its imprinted into to card \ modem the only way to change it is to buy a new card

MAC addresses are given by ISP ONLY when it's a dialup modem.

@NiteWorm
thx for arp and rarp, thought it was that.. only, didn't found out how to get mac from someone on the internet with it.. on local, it worlks.. do some ping and then arp and it s ok. But on the net ? how to use arp?

Some people change their routers mac address in order to connect with their isp if first connection wasn't with that router... found that on google.

So, if i understood, it will be very very hard , or impossible to retrieve ip with someones mac address. And even in the other sense...
talking about that, i have a problem with emule and sygate firewall..
Emule is allowed to enter and go out from my network. And emule is connected with a server. Alltough, sometimes, i get packets from the mules server (according to mac address, ) but it's not bound with emule.exe, if u c what i m trying to say in my poor english

i ll give some log-lines to show u.. macs are fictive

CODE

action remote mac remote ip application port
allowed 01:02:03:04:03:02 x.12.x.1 emule.exe 33660
allowed 01:02:03:04:03:02 x.214.x.18 emule.exe 4661

blocked 01:02:03:04:03:02 x.214.x.18 4661

the problem is that i have a lot of traffic that isn't bound with emule, so sygate detects that as a port scan, and then blocks the connection with server..

i'm one and all ear
if someone has a solution to this..

another question, how does the firewall knows the mac address? I know it can't be my isp's routers mac address, caus i blocked several sites and persons who are annoying me, ans i still have internet access.. If i'm all wrong about this, plz tell me

thank you all

NiteWorM

Apr 18 2004, 12:38 AM

WoW i never knew you could change the mac address
i am going to try out smac

it may prove very useful how would i go about finding my mac address for my modem?

tweakz20

Apr 18 2004, 01:57 AM

ipconfig tells you... if you're running windows anyway... go into cmd and type ipconfig and either a box will come up or a cmd based program will run.. (depends on your os).. and if it's command line, type "ipconfig /all"...
this works for lan card and i'm pretty sure it does for modems too, correct me if i'm wrong

NiteWorM

Apr 18 2004, 02:23 AM

Ah thats what i was doing wrong i was doing only a ipconfig not an ipconfig /all , thankz