Say if i have the IP of a user x.x.x.x , then using the IP can i track all the activities that the user is doing ? How can i do this ?
how can i check which web pages is the user opening or something similar
please guide
No, you cannot. Traffic is point-to-point and knowing the address of a point is not enough to know the traffic going to/from that point. It's like asking if you can read someones (snail) mail just because you know their house address.
In order to "snoop" that fully, you need to be in the middle where all traffic passes through your node (liking having the postman give you the mail and then you giving it to the owner of the house).
If you have a machine, the traffic from the user is reaching it (e.g. you're connected to the same switch) then probably yes. The most trivial way is using network sniffer (Wireshark for windows, tcpdump for Linux).
However if the used surf SSL secured site (a.k.a https) than you will see only encrypted content
Geolocation is not accurate because the primary source for IP address data is the Regional Internet Registries. They do not hold a database for information about individual IP addresses, but information about ranges of IP addresses that have been assigned to certain organizations. Such an organization has free reign over the IP addresses they get and they do not need to give location information to the RIRs. In other words, only your ISP knows your exact location. If you want to find the location of a user you will have to ask your ISP, and they will most probably deny your request.
You can't sniff packets sent from someone, unless you are part of the same subnet - you would have to be connected to the same switch and be on the same Virtual LAN as that user. Even if you somehow find the physical location of a user and connect to the same switch, the ISP has most likely sat up port security, which would deny access to your MAC address.
In conclusion, unless you are already connected to the same switch, you can't track that user's activities.
If you are connected to the same switch, you can install one of the popular packet sniffer utilities such as Wireshark and set it to promiscuous mode.
Related
AFAIK when i turn on my modem, it says: "Hi ISP, i need an IP".
Then, my ISP give it an IP.
How does my ISP identify my modem? by last IP, key, or what?
After i have an IP, i can navigate, but after some hours my modem changes its IP.
2) How is that change done?
I mean, my ISP says: "Hi user modem, there is your new IP"
It gets even funnier if when i turn on my modem, some other modem has the last IP my modem had.
There is a collision. So, my ISP would give my modem another IP, wont it?
I know im talking about technical stuff, but i would like you to explain me in your own words in order not to make it cumbersome.
If technical references arise, maybe just name the concept or leave a link. It would be enough for me.
Thanks you all!
By posting under the tag „dhcp“, you are obviously already assuming that the DHCP protocol is the answer to your questions:
The DHCP Protocol allows the DHCP Server (your ISP) to identify the DHCP client (your modem) by a multitude of information. The most important one is usually the MAC address of your modem. The last IP is also transmitted from client to server along with proprietary information such as the client identifier and others.
The server supplies the IP address along with a lease time. The client will renew the IP address with the DHCP server when the lease time is about to expire. The server decides in the renewal process triggered by the client if the same IP is ok to use further or not.
Restart is not much different from renewal. The DHCP protocol is for that purpose equipped with a broadcast feature so the collision does not really happen, because the client (modem) will ask for an IP address before it uses the old IP.
It is possible that modem and ISP do not use DHCP but the mechanism is probably similar. DHCP is specified in RFC 2131.
I've got difficulties in understanding NAT, NAPT, and port forwarding.
I got what NAT does. But when I try to describe port forwarding, NAT's concept becomes too vague.
I found NAPT and there is only a vague assumption that port forwarding is related to this.
Is port forwarding related to NAPT? If not, what is the difference?
NAPT stands for Network Address Port Translation and it specifically is in reference to be able to have many private IP addresses (ie - inside your building) all able to share a single public IP address (that would be assigned to your router from your ISP).
Think of it like this ... your public IP Address which is visible to the entire Internet exists on the ethernet port that you have connected to your Internet service.
Then, the other ports on your router / firewall / WiFi are all on a different network entirely - that's called your PRIVATE network.
In order to get all of those IP addresses on the inside private network to be able to have autonomous access to the Internet, your router/firewall does what we traditionally call NATting - Network Address Translation. So lets say that you and three other people access the same web site from inside your house... your firewall will see those requests to access that web site on your three different private IP addresses and it will assign to that browsing session, a unique session ID to that datastream and it will then go out and contact that web server but that unique session id rides with that datastream so that when packets come back from the web site the router knows which private IP address to send them to ... it acts as a facilitator for the internet packets going to and from the private IP addresses inside your building.
And a private IP address can be assigned to computers, tablets, cell phones, printers etc. etc.
PORT ADDRESS TRANSLATION is the exact same thing, only in reverse.
You do NOT want anyone on the Internet to be able to access any of the devices on your private network, so by default, your router/fireall denys any requests coming from somewhere on the internet that might be trying to access your public IP address.
But there are times when you have something running on one of your private IP devices ... like a gaming console, or maybe a remote desktop session that you need someone to access from the Internet ... what we typically do, is go into the routers configuration settings, and we create a PAT rule that says, "Allow any attempts to access my public IP address ON this specific port number and send those requests back to this specific private IP address." - in a nut shell.
NATting is when traffic is generated from the inside of your private network and it is going out to the Internet where PATting is for traffic coming FROM the Internet into your private network.
Hope that help clarify things a little ...
Edit: I should point out, that these days, when a device or some software running on your computer needs to allow traffic from the Internet to reach it, there is a feature in most home routers called UPNP (Universal Plug And Play) that, when enabled, devices like XBOX and other software can create - on the fly and without you having to give it any thought at all - PAT rules inside your firewall. UPNP was created because most home users don't remotely understand how network traffic works so trying to teach the non-tech person how to create PAT rules was becoming an issue, so UPnP was invented... it has its issues, but for the most part it's fairly reliable and nothing to worry about.
I am at a large University, with servers set up on the Univeristy network. The network has internal (10...) IP addresses, and external (129...) IP addresses. I have a ColdFusion-based business process which FTP's data from an external server.
The server on which the ColdFusion instance is based has several (about 10) IP addresses associated with it, both internal and external. It has one primary address, which has been, until recently, external.
Using Wireshark, we have been able see which IP is used, and it is never the primary, but other than that, does not seem to follow any logic.
We recently changed the primary IP for the server to an internal address, to comply with new University-wide security policies, and the FTP connection from Coldfusion stopped working. Using Wireshark, we've confirmed it is going out on one of the internal (10...*) IP addresses (not the primary).
Is there a way to control which IP ColdFusion uses for an FTP connection, either through system configuration, or programmatically?
Code for the FTP call:
var ftpService= new ftp(
username = partnerConfig.sftpLogin,
connection = "MyConnection",
password = partnerConfig.sftpPw,
fingerprint = partnerConfig.sftpFingerprint,
server = partnerConfig.sftpServer,
secure = "yes"
);
var result=ftpService.open();
var result2=ftpService.listdir(directory = partnerConfig.inFolder, name="dirlist");
var result3=result2.getResult();
EDIT: My server guy tells me that this University is fairly unique in how it configures the subnets. NO firewall exceptions are allowed from the 10.* subnet. The "Public" IP's are not public by default, simply the ones which are capable of having exceptions.
FURTHER EXPLANATION: It comes down to the Rules and IP addresses the main IT org at the university set up. the 10.x.x.x IPs are never allowed access outside the university ("internal"). 129.x.x.x IP, may have firewall exceptions ("external"). If I type ipconfig (it's Windows), I see about 10 static IP addresses, half of which are 10.x.x.x, and half of which are 129.x.x.x. When the "primary" IP for the machine was a 129.x.x.x address, Coldfusion chose one of the OTHER 129.x.x.x addresses for the outgoing IP for the connection. With the "primary" IP switched to a 10.x.x.x IP, ColdFusion is choosing one of the OTHER 10.x.x.x addresses for the outgoing connection. My choices, as far as I can tell are 1) Switch the primary back to a 129.x.x.x for the server; 2) Move the site to a different server with a primary of 129.x.x.x, and keep other sites on the server in compliance with the new policy; 3)See if I can figure out how to control which IP Coldfusion chooses from the 10 static IPs on the server.
Our admin figured it out. We needed to add a static route to the server, so that whenever ColdFusion (or any application) tries to connect to the specific destination we were FTPing to, it goes through a specific outgoing IP address.
This was not something I was familiar with, but a quick search gives the basics: http://technet.microsoft.com/en-us/library/dd469825.aspx
You have an internal IP address and you are not sure what the external is? This sound like a network bridge issue. What you are looking for is FTP proxy or some tool that associates an externally assigned IP to an internally assigned IP for port 22 (or whatever you set your port to). Look at: http://wiki.squid-cache.org/Features/FtpGateway
FTP reverse proxy
It sounds like your IPs (even internally may not be static)...or maybe it just feels that way. Make sure your internal IP is static.
Read about FTP port forwarding: Here are some port forwarding guides.
Other keywords FTP bridge, FTP one-to-one mapping, among others.
Good luck.
I had a similar question regarding the cfmail tag:
Force cfmail tag to send from a specfic server IP address
Unfortunately, I didn't get an answer that worked. ColdFusion seems to pick (seemingly at random) which source IP address is used.
According to Obtain client MAC address in ASP.NET Application, it is not possible. I am not entirely convinced because whenever I connect to Tim Hortons WiFi, my MAC address is known.
Occasionally, the network is slow and I see this URL like this before being redirected to the Connect page:
http://timhortonswifi.com/cp/tdl3/index.asp
?cmd=login
&switchip=172.30.129.73
&mac=60:6c:66:17:1a:83
&ip=10.40.66.229
&essid=Tim%20Hortons%20WiFi
&apname=TDL-ON-NEP-02177-WAP1
&apgroup=02177
&url=http%3A%2F%2Fweather%2Egc%2Eca%2Fcity%2Fpages%2Fon-72_metric_e%2Ehtml
So according to this URL, the site knows the IP address of the router, my MAC address, the IP address assigned to my device by the router, the network SSID, some other pieces of information, and the URL I was trying to access prior to connecting.
There's two options: Tim Hortons WiFi Basic and Tim Hortons WiFi Plus, where the "Plus" option allows me to connect to any Tim Hortons WiFi access point in Canada automatically with this device. Registration requires an email address, so I'm assuming this is possible by checking the MAC address and storing it in a database that routers ping upon connection. More info here.
According to the extension of this page, I can safely assume it is ASP. How are they obtaining this information?
When your client traffic reaches the first router, that router will route the traffic to the adecuated port, changing the response MAC address with its own MAC address so the answer will be routed to it. And this will happen for each of the routers the packets travel by. So, at the end, the web server will only see the MAC address of the last router where the answer will be sent to be routed back to the previous roter, and this process repeated until the answer reaches the client.
No, there is not way to obtain the MAC address of client from server side.
But, what you are seeing is a client sending its information to a server. So, the answer can be converted into "how can i obtain my local mac address and send it to the server?".
Browsers do not allow to read this information. Some properly signed/configured ActiveX or Java applets can do it, but they can be blocked, or you can have some device that will not execute java nor activex, so it is not a reliable way of doing it.
In the case in your post, the easiest way of doing it is configuring the wifi access point dhcp or dns server to serve a proxy configuration file that will allow to configure a redirection to the desired web server, redirection that has been created inside the access point, which have all the shown information in your post.
can one location have more than 1 IP address? I have 2 IP addresses and need to know if they originate from the same source. Thanks
You're missing clear definitions of "location" and "source" in your question but lets go with the assumption that you mean "physical machine" for both (as it's obvious that multiple machines will have different addresses and that a single machine can change its IP address over time).
In that case, the answer is yes. The operating system may bind as many IP addresses to a physical network port (and a single MAC -- the physical addressing used by Ethernet) as it wishes.
Binding multiple IP addresses was the standard way of doing "virtual web hosting" before HTTP/1.1 arrived with the "Host" header. The provider would use DNS to map different host names to different IPs on the same network (usually the same subnet as well) and then assign all of them to the same interface. The webserver would get address information from an incoming connection and based on the local IP address would know which virtual host was being accessed.
This led to a higher-than-typical use of public IP addresses but the practice is now gone with the proliferation of HTTP/1.1.
I'm not sure how Windows presents it, but Linux will present a physical interface with multiple IP addresses as multiple logical interfaces such as "eth0", "eth0:1", "eth0:2", etc. Each logical interface has a unique IP address even though they share the same physical interface.
This is hard to tell. Especially it is hard to tell if these IP addresses are from different times. Today I may have a different IP address than tomorrow.
Even they are from the same time, a load balancer im my internal equipment might send my packets over the fail-over line if the 1st one is overloaded or broken down.
One network adapter normally has only one IP address at once and a typical end user only has one network connection active, but even then the IP address can change. The user could switch from wireless to wired and back or a power outage might reset the ISP's DHCP server (assigning everyone a new IP address).
If you want to identify the user even if his IP address changes, you need to identify the user by his session id, stored in cookies. As two users can have the same IP address (a whole company could be behind a NAT), you should never rely on IP addresses for identification.