What networking device information can I get from just my computer? (MAC’s, existence, etc)

pts.
Tags:
Microsoft Windows
Networking
Let's say my setup looks like this: (WindowsXP PC) <-->(Ethernet Card) <--> (Custom Router) <--> (Linksys Switch) <--> (Linksys Router) <--> (Cable Modem) I'm wondering what information about each of those devices (MAC address, brand, that they exist, etc.) can be obtained *from the Windows PC*. Assume that I have no login/pword info for any of the routers. "tracert" and "pathping" only give the lan ip of the router I'm directly connected to, if anything. I've downloaded and installed ethereal, but I'm not sure what or where to look. Basically, I want to know if it is possible to get any details about every device between myself and the internet. For example, could you sit down at the computer above and tell me the MAC number of the Linksys Router above? Could you tell that there even is a Linksys switch? Thanks

Answer Wiki

Thanks. We'll let you know when a new response is added.

Yes – NO – Maybe.
Windows is ‘helpful’ it will hide the details.
If I presume, that you acually have Internet access, and have run the “www.whatsmyip.com” check to see the conection exposes to the outside. Then you can see if and maybe how many layers of NAT occur.
1 – cable modem usually has an external address set by the company’s DHCP server (64.206.123.89 as example.) the ethernet port is then set to a private address (192.168.22.89 as example) and you confiure the computer to use the 192…as gateway and set the DNS lookup servers as instructed by the cable company. This works as long as the next item in the chain has an address in the same scope (i.e. 192.168.22.xxx with subnet 255.255.255.0).
2 – is we presume the Linksys router (i.e. WR54g etc) is also a NAT the picture changes to output of the router on a 192.168.22.xxx address and the inputs on 192.168. not22.xyz with the gateway now being 192.168.22.whatever.
3 – If the custom router does any thing special then the whole system working is a miracle and the odds of identifying the intermediate walues without physical access and substitution becomes vanishingly small.
Since each router maintains a table to ID port/MAC to ip number in transit the ID of intermediates are ephemeral, and meaningless.

Discuss This Question: 6  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • OldNebs
    The simple answer is no. Your devices are set to transmit the data through their tunnels and unless you are aware of the management IP address of the device it will simply pass the data on. If however you were looking at ethereal, you may notice management information from the local routers and you could look up their IP addresses and from there connect on the open ports to the management services they host. These will usually tell you what they are, but if they are for example wireless routers they are some times limited on the information they broadcast. MAC addresses will indicate a probably vendor of the NIC (but this can be changed), also they are only available on the local network, so an outside will not be able to see them. The switch, if unmanaged, will not have any interface you will be able to interact with so it will appear invisible. So you may be able to detect some items. The use of the likes of nmap (www.insecure.org) may reveal the types and vendors of the other management equipment and their open ports but other than that you will get little. Basically it depends on what you want to get and what tools you use. Finally, I am not aware of anyone being able to 'play' with their cable modem as you site on the wrong side - but I may be corrected. Sorry its a wooly answer, but I am not sure what you are trying to achieve and why. Give us more info and i/we may be able to assist you more. Steve
    0 pointsBadges:
    report
  • Nortonloaf
    Hi, Thanks for both responses. I don't have an actual problem I'm trying to solve...this is just for curiosity. What I'm wondering is whether or not an external program that has been given access to my computer to run something, could tell how many devices are between myself and it. So as an example, say I was playing the online game "Everquest", where you download their program, which communicates with their servers, etc. Could they tell whether I am behind a router, what the MAC address is of my cablemodem, the MAC of my network card, etc etc.
    0 pointsBadges:
    report
  • Bobkberg
    Well, being a tool junkie, I noted that you didn't specify any software tools. You can do an SNMP sweep of your local network (try the evaluation version of SolarWinds.net IP Network Browser). You can do a batch job ping of all IP addresses in your local network, and then do an "arp -a" at the command prompt to see all MAC addresses found. If you don't know - the first 6 digits (3 bytes) of any MAC address is registered to the manufacturer. These can be looked up at www.ieee.org. Just remember (as they point out) that the manufacturer of the device may not be the same as the manufacturer of the network chip set. E.g., I have a "Linksys" brand PC adapter which has a "RealTek" chipset - and so is identified as "RealTek" There's more - but if you're just learning, this is plenty for right now. Bob
    1,070 pointsBadges:
    report
  • Swiftd
    As long as all devices between an endpoint and yourself have a non NATTED IP, you can use paratrace to get the route whether or not ICMP echos and requests are permitted. It's part of the Paketto Keiretsu TCP/IP Toolkit found here: http://www.doxpara.com/read.php/code/paketto.html Here's how it works: Excerpted from: http://www.giac.org/certified_professionals/practicals/gcih/0392.php "Paratrace (Parasitic Trace) is a cleverly designed program that traces the route from the source to the destination, by `piggy backing? on a current TCP connection. The output result is similar to Unix traceroute and Windows tracert, but works in a different manner. Paratrace utilises well selected time to live TCP messages for each router and collates the information received back in the time exceeded replies. Because of the different way it works, it is possible Paratrace is able to identify routing devices behind a stateful packet firewall which may have also been network address translated." I don't know of any tools that will permit you to get the MAC address of those segments since they are locally significant. I also don't see why it would matter. Unless you own the router/switch for the segment that it's on, you won't need to spoof the address. If you owned those devices, you could just pull it off the wire. You could use nmap to try to determine the OS of the system if it's a routable address and responds to TCP, UDP, or ICMP queries. Typically you need an open and closed ports to get a better guess at the OS. It's not a perfect science, but it's good. Amap, from THC, can do OS guesses as well as try to determine the type of service running on the port number. Enjoy
    0 pointsBadges:
    report
  • Bobkberg
    Although I've already replied - Swiftd piqued my senses. Part of the answer, dear fellow, is to satisfy a bottomless pit of curiousity. The other part is - to learn how to learn as much as possible, and to learn how you learned it. You never know when you might have to do it again. Little bit of leg pulling, little bit of seriousness, Bob
    1,070 pointsBadges:
    report
  • Nortonloaf
    Hi, Thanks all for the posts...very useful, good starting points for me to learn about this stuff. Thanks again!
    0 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following