Do you want Gonzo to post your real name?

[moetheman]

Originally Posted by Mediaguy

That's the case only within a local netowrk or a P2P connection.

I did what you said and ran a search. Didn't take long.

TCP/IP packets only need or use your MAC address within a LAN, or on a P2P connection. They keep a full ARP Table on local networks, but those sent out over WAN connections use only the MAC address of the last and next router; they don't need the MAC on your network card and they don't carry the MAC address of your router beyond the next router to destination.

Much as I dislike your innuendo, you at least have been ATTEMPTING to discuss facts.

I will say this: you are assuming that the only way to obtain the MAC addy of the computer that the user is on is by looking at JUST the TCP packets that reach the server (the "last leg" of the trip, so to speak).
That is not so.
The simple fact that the information is contained within TCP packets is enough for anyone with a bit of knowledge and half a brain to realize that the originating computer's MAC address can be eventually obtained after it has connected to a server on the WAN.

Which has been the point all along.

I am not going to break it down for you all any further. I am amazed that it appears as though you two TRULY CANNOT obtain this information on your own.

And guess what? I AM NOT EVEN INTO NETWORKING THAT MUCH AT ALL AND I KNOW THIS!!!!!!

Goes to show.

[Mediaguy]

Originally Posted by moetheman

Much as I dislike your innuendo, you at least have been ATTEMPTING to discuss facts.

I will say this: you are assuming that the only way to obtain the MAC addy of the computer that the user is on is by looking at JUST the TCP packets that reach the server (the "last leg" of the trip, so to speak).
That is not so.
The simple fact that the information is contained within TCP packets is enough for anyone with a bit of knowledge and half a brain to realize that the originating computer's MAC address can be eventually obtained after it has connected to a server on the WAN.

Which has been the point all along.

I am not going to break it down for you all any further. I am amazed that it appears as though you two TRULY CANNOT obtain this information on your own.

And guess what? I AM NOT EVEN INTO NETWORKING THAT MUCH AT ALL AND I KNOW THIS!!!!!!

Goes to show.

I can get it for my machine, my local area network, my whole office... but not your machine.

You've been talking about getting originating computers' MAC addresses via the TCP/IP packets received at the destination server.

Your initial post in this thread on the subject stated flatly that tracking via MAC addresses was common, which is false.

It's true within a LAN.

In the other thread about this, you say:

Originally Posted by moetheman

all that is needed is the IP address. Once that is available, only a SECURE system would prevent someone (or someone's software) from obtaining the MAC address.

I don't know about you but this reads to me like you're saying remote software could get my LAN-side MAC address... which is not true, unless a program or software within my LAN (malware, spyware, or something I downloaded willingly) broadcast the address to that other software.

Remote sofware without a direct connection or relationship with a program within my LAN will not read or detect my MAC address.

TCP/IP packets only carry current device/next device MAC addresses.

So my MAC address is in the initial packet to my router; then the packet's source and destination MAC addresses are re-written from my router and to my ISP; then from the ISP they are rewritten again, the destination replacing the source, and the new destination being the next node or router on the path to whatever site or IP address I'm headed for.

The packet is rewritten from each device's routing table - it's mini-memory of what other devices it's connected to which allow it to forward your request or packet to the next step...

Each device has it's own routing table and MAC address. The TCP/IP packet acquires the current and writes in the next address and will do the same at the next device.

These packets can't and don't retain the record of each device they've travelled through; it's inefficient and unecessary.

So there's no way the destination can read the originating computer's networking card MAC address...

Btw you inferred more than I implied, re. the inuendo.

[Sexyteaser]

I guess the mystery is solved now on mac attacks but will the real "soundslikebullshit" please stand up....

You both have gone on and on about this hoping to get off the point of the entire subject and subsequent subjects,

I believe Gonzo that SoundslikeBullshit and Mark Prince are using the same IP/MAC or whatever and Mark's lame excuse was he gave some computers away and he knows who it is.. blah blah blah Like I said a good polygrapher could have ended this a lot quicker.

[Toby]

Originally Posted by Shelleehale

...I believe Gonzo that SoundslikeBullshit and Mark Prince are using the same IP/MAC or whatever...

The exact detection method is really irrelevant. The security plugin that was tripped only goes off when two user accounts are posting from the same computer.

[Sexyteaser]

Originally Posted by Toby

The exact detection method is really irrelevant. The security plugin that was tripped only goes off when two user accounts are posting from the same computer.

Yes and to reiterate why it even mattered Soundlikebullshit/Mark Prince drudged up a grievance I have with him ripping me off when he tried to insult a site I have up and imply I was doing something illegal. He will go to any lengths to redirect the comments I have stated and proof I have shown of his fraud. Yesterday he called me an Avon Lady today a Tupperware etc...

Toby, does this look like an innocent man here?

[Toby]

Originally Posted by Shelleehale

Toby, does this look like an innocent man here?

I think my "Turnkey Site" remark yesterday answered that question.

[Mediaguy]

Originally Posted by Toby

The exact detection method is really irrelevant. The security plugin that was tripped only goes off when two user accounts are posting from the same computer.

Mark has shown that he doesn't care about posting under his own name and that he wouldn't be the type to create a fake nick...

But You Can Check, right? Find out where soundslikebullshit was when he created his account by looking at the logs. IP address as well as his MAC Address should both be different since they would both be completely different from his Montreal office computer.

As I said, Prince was in Florida at the time the bullshit guy created his account. So the record of that would have to differ by both IP and the MAC Address compared to those last posts soundslikebullshit did...

[gonzo]

Originally Posted by Mediaguy

Mark has shown that he doesn't care about posting under his own name and that he wouldn't be the type to create a fake nick...

But You Can Check, right? Find out where soundslikebullshit was when he created his account by looking at the logs. IP address as well as his MAC Address should both be different since they would both be completely different from his Montreal office computer.

As I said, Prince was in Florida at the time the bullshit guy created his account. So the record of that would have to differ by both IP and the MAC Address compared to those last posts soundslikebullshit did...

You guys are the best!

[Toby]

Originally Posted by Mediaguy

...he wouldn't be the type to create a fake nick.

Says you. I've seen nothing posted over the last few days that would lead me to that conclusion.

Originally Posted by Mediaguy

As I said, Prince was in Florida at the time the bullshit guy created his account. So the record of that would have to differ by both IP and the MAC Address compared to those last posts soundslikebullshit did...

What fucking difference does it make where he was when the account was created two weeks ago? It was posts made last Wed in this thread that tripped the alarms.

[helix]

wtf...only 6 pages?

[Mediaguy]

Originally Posted by Toby

Says you. I've seen nothing posted over the last few days that would lead me to that conclusion.

All you've seen is Mark post, rant, blast and say things soundslikebullshit doesn't seem articulate enough to type... I don't see the point in Mark creating a fake nick to make a point or enter a response... especially considering the response it gets lol (traffic, pageviews, etc).

Originally Posted by Toby

What fucking difference does it make where he was when the account was created two weeks ago? It was posts made last Wed in this thread that tripped the alarms.

You might be right and he had someone else create the account; but the posts made in that thread were done before he logged in, because I was with him here that morning... but then again that's a sez me claim... so I don't know what to tell you except that Gonzo's magical MAC address detector failed him? That too would be a sez me/sez him thing wouldn't it... except that MAC address detection wouldn't be possible unless their was a broadcast executable delivered to Mark's computer and that I was lying about him not being at the computer that morning (until he was notified about the thread where Gonzo was calling him out thinking he was double-posting...).

[moetheman]

Originally Posted by Mediaguy

I can get it for my machine, my local area network, my whole office... but not your machine.

You've been talking about getting originating computers' MAC addresses via the TCP/IP packets received at the destination server.

Your initial post in this thread on the subject stated flatly that tracking via MAC addresses was common, which is false.

It's true within a LAN.

In the other thread about this, you say:


I don't know about you but this reads to me like you're saying remote software could get my LAN-side MAC address... which is not true, unless a program or software within my LAN (malware, spyware, or something I downloaded willingly) broadcast the address to that other software.

Remote sofware without a direct connection or relationship with a program within my LAN will not read or detect my MAC address.

TCP/IP packets only carry current device/next device MAC addresses.

So my MAC address is in the initial packet to my router; then the packet's source and destination MAC addresses are re-written from my router and to my ISP; then from the ISP they are rewritten again, the destination replacing the source, and the new destination being the next node or router on the path to whatever site or IP address I'm headed for.

The packet is rewritten from each device's routing table - it's mini-memory of what other devices it's connected to which allow it to forward your request or packet to the next step...

Each device has it's own routing table and MAC address. The TCP/IP packet acquires the current and writes in the next address and will do the same at the next device.

These packets can't and don't retain the record of each device they've travelled through; it's inefficient and unecessary.

So there's no way the destination can read the originating computer's networking card MAC address...

Btw you inferred more than I implied, re. the inuendo.

Wrong.

Read what I wrote.

The last hop is not the place in the link of connections where you get the original device's MAC address. That gets you the first set (as the TCP packet contains both sender and receiver - each device NEEDS MAC addys to communicate with other devices) which leads to the second set, and so on until you arrive at the original device.

They are ALL linked together. The address information is contained within the TCP packets. Every single one has this info. It is only a matter of going from one device to another, until you arrive at the original destination.

That can be accomplished in several ways. All lead to the same result: the originating device's MAC address tracked by a server over the WAN.

Now, a worm installed on the originating device's operating system (or entering the LAN that the device is on) would - indeed - make it much easier. Entering the LAN and getting it yourself is actually the most reliable method, from what I have read. However. Those are just two of the methods. Not the only methods, by far.

Let me give you some background:

The data link layer, where the MAC address exists, is the lowest layer in the OSI model that deals with addressing. Each device has a unique number, which is known as both a MAC address or a hardware address. That number is used in that data link layer protocol to make sure that data meant to reach a certain machine gets there properly.
Devices VIRTUALLY connect at the layer where IP and HTTP are used, because those connections are CONCEPTUAL ONLY. When a request using IP is made, it is sent one jump at at time. At each jump, AN ACTUAL TRANSMISSION TAKES PLACE AT THE PHYSICAL AND DATA LINK LAYERS.
Thus, MAC addresses point to hardware devices at each jump. In order for that to happen successfully, the TCP packets HAVE to include both sender and receiver information (both hardware addys).
Once you have the first set, you simply backtrack through the sender sequence, until you finally arrive at the originating machine, which is what I stated before.

Let me repeat it one last time: the information (the set of MAC addys) related to the last hop going from originating device to the server in the transmission sequence is NOT the place to look - and it does not have to contain the MAC address you want in order for you to be able to eventually get it . . . it is not as if "if it isn't there then that's it, impossible."

Now, that info I posted above is not necessarily easy to find online on a website, but, at least in the tech communities that I belong to, it is pretty darn common knowledge that, if YOU WANT TO AVOID DETECTION ONE OF THE MANY THINGS YOU DO IS USE SOFTWARE TO SPOOF YOUR MAC ADDRESS(ES) CONTINUOUSLY . . . NOT EASY TO DO, BUT DOABLE.

[moetheman]

Originally Posted by Mediaguy

In the other thread about this, you say:

all that is needed is the IP address. Once that is available, only a SECURE system would prevent someone (or someone's software) from obtaining the MAC address.

I don't know about you but this reads to me like you're saying remote software could get my LAN-side MAC address... which is not true, unless a program or software within my LAN (malware, spyware, or something I downloaded willingly) broadcast the address to that other software.

Remote sofware without a direct connection or relationship with a program within my LAN will not read or detect my MAC address.

What you quoted referred to the scenario of going to a target machine and getting it yourself, or placing software there that would grab it and send it to you.

Now, remote software can indeed backtrack through the sequence I referred to in my prior post, eventually getting to the original destination.

Would it be INFALLIBLE every time?

I doubt that.

Has it been done?

YOU BET.

How do you think some of the crackers/scriptkiddies have been caught? It's not like only the VERY dumbest/inexperienced of them have been caught. Not like they did not take even plenty of measures to avoid detection . . . however . . . as in ALL Law Enforcement vs. Criminals games, the criminals can only make ONE mistake . . . or even two.

Now, I personally do not find cracking to be interesting. It is not that hard anyway. I know a few of those guys from boards. Some do it for fun, others for profit, some for both, but, I am not interested, therefore, once again, I will say that I am not like an authority on it, simply because I am not interested in it.

[Hell Puppy]

I dont have time to keep up with all this shit, could someone please post a daily highlights thread.

Thanks!

[ScottMcGowan]

Originally Posted by Hell Puppy

I dont have time to keep up with all this shit, could someone please post a daily highlights thread.

Thanks!

All of these people should be gassed.

I think that about covers it.

[Buckwheat]

Originally Posted by Hell Puppy

I dont have time to keep up with all this shit, could someone please post a daily highlights thread.

Thanks!

like i said . . . krazy "General Hospital" fucked up shit!