Ethical Hacker Community Forums

Is it possible to track someone on the internet by converting thr MAC/Physical Address into Internet IP Address?
 
 or in other word, suppose I have Physical Address of someone  PC(ex- 00-19-5b-9c-21-34) and I want to know thr IP address, how it could be possible?

You will only be able to see their MAC address if you are on the same subnet they are. Any machines separated by a router will not see each other's MACs.

To expand slightly on heffnercj's post......

MAC to IP resolution is done using the ARP protocol.

ARP is non-routable so as heffnercj says "Any machines separated by a router will not see each other".

To track someone on the internet via their MAC address would therefore require some external mechanism ie software rn directly, as a worm, etc to feedback the IP address/MAC address relationship back to a central location. This approach would also need to ensure the information from devices that were behind firewalls or devices that were NATed could be captured as well.

Just imagine if Google ran some kind of script every time you accessed their site that did this correlation and held it in some kind of big database - EEEK!!. Scary thought and not beyond the realms of possibility.  ;)

If you're trying to track a particular machine over the Internet, BiotiC is right, the best way would be to have some call-home program installed on it. Although you can theoretically trace a computer based on time skews measured from the time stamp option in TCP packets, it requires gathering several thousand packets, and I'm not aware of it being performed in a real-world situation (paper on it here: http://www.caida.org/publications/papers/2005/fingerprinting/). 

Of course this could be mitigated by turning off the time stamp option too. :)

There are some ways of remotely determining a node's MAC address. Good ol' nbtstat comes to mind for windows machines. Today you are much less likely to receive a response to a NetBIOS query than say 5 years ago but this still works in many cases.

Jim

Thank-you all for your answer

Just curious, how did you get their MAC and not their IP/DNS Hostname?

One other piece of information you can get from the MAC address is the vendor of the network device. The first three octets show who the range of MAC addresses is assigned to and you can look this up at...

http://standards.ieee.org/regauth/oui/index.shtml

The MAC address you listed is assigned D-Link, so you can be relatively confident you're looking for a device manufactured by D-Link. Beware that the name branded on the device may differ from who the address is assigned to. A good example is that modern Linksys kit resolved to Cisco Corp, since Cisco bought up Linksys a few years back.

Regards,
Jim

>because it was my own laptop MAC address which was stolen by someone

it means almost it is impossible to track any one from there MAC address.

But is it Possible to retrieve MAC address from someones IP address? if yes then pls let me know how to do that.

To get a MAC from IP you would need to be on the same subnet or have some kind of Trojan program on the victims computer cause the MAC (Layer 2) is not routable on the internet (layer 3 & up).

Brian

One remote possibility would be to wardrive and check for an active client with the same MAC, assuming that the interface was a wireless one. This would only work if

a) the laptop was power up
b) it has joined a wireless network
c) both of the above occur while your driving by

You could possibly set up a fake AP as part of your wardriving kit and hope it associates while your passing by. The chance of success is somewhere between long shot and fantasy however.

Jim

If I'm not wrong then with AP wardriving is possible in Local Area only then how could I  track them globally over internet..?

I think if you really needed to track a stolen laptop we need to forget the MAC address idea. The advice on this thread so far basically says in most cases you need to be on the same subnet as the 'physically compromised' machine to have a chance of tracking it.

There are other possibilities for tracking, but again the chances of success are slim. Is there any software on the laptop that 'phones home'? This might be for example an instant messenger account that's set to log in automatically. You could try creating a new account, adding your old account to your contacts and waiting to see if your account is logged in from elsewhere. The IM provider might give up the IP address but only to law enforcement agency.

The long and the short of it is that you're very unlikely to get your laptop back. Your best bet would be to ensure the theft has been reported to the police and that they have the serial number of the laptop in case it's recovered.

Regards,
Jim

I'm in exactly the same situation. My laptop was stolen a few months ago, the police did nothing to find it. I am currently trying to find out if there is any way of tracking it over the interent. The problem is I dont know my laptop's IP or MAC or any other numbers or addresses. I never thought I would need to write them down. What I do have is access to emails sent from it, some forum posts posted from it, cds burnt on it and maybe something else i cant think of now. My laptop had MSN and Skype that were signing in automatically on it. However I changed the passwords ever since. I could change the MSN password back to the one I was using on my old laptop but i guess that probably wont be helpful after such a long time. Please if anyone could give me any details on where and how to start, i would be extremely thankful.

Dont change back to your old passwords on any of those accounts. Yes that would work if you were working directly with the server it connected to and got the originating IP and if you had a court order for the ISP to give up the location. You could check a few pawn shops or if you had recorded the mac (dont feel bad you didnt, most people dont) you could wardrive around, but dont spend too much time driving around with $3.00 a gallon gas. Even if you had recorded the mac and had managed to find it wardiving, what would you do? Go bang on the front door of the house? Call the police and try and convince them someone in that house has your laptop because Kismet seems to indicate it? Unless the house is full of Al-Qaeda and you had nuclear secrets on your laptop you will be out of luck. In other words, too much hassle and expense. I hate to say it but the place to start is to start saving up for a new laptop.

well day by day it seems that internet security is getting tighter.Few years back we can easily get ip.host names withe use of cmd in windows,but nowdays its just noway. I just want to ask is there any way nowdays available for getting ip over global network??

Rok,

I don't want to sound rude as I could be missing something (been working for last 28hrs straight :( ) but isn't IP over a global network called the internet? Can you elaborate further as I'm sure I must be missing something obvious...

Well, global network could be said to be a companies VPN spanning multiple countries etc... but I don't know if that's what he ment.  Interesting thread btw... perhaps I'll write down my MAC.  :P  Probably not, but perhaps.