How do I find out the IP of a computer.

Hello,
How do I find out the IP Address of a system that 'had' connected to my WLAN Router during the day? (Note that it is no longer on the network)
And with this information how do I get to know the system name?
I had someone access my "Unsecured" network and delete files from some of the shared folders (yes I know its stupid to have had an unsecure network) :-)
Pls Help ASAP.
Cheers


Moderator Note:> HYBR|D
Action Taken:> Moved this post from an older topic. ( http://www.antionline.com/showthread.php?t=278745 )

The IP address of a system that has joined the network but is no longer there isn't much use when dealing with wifi. DHCP assigns a free IP address to whomever joins. That doesn't actually identify who was involved.

Your router should have a log showing the IP addresses and/or mac addresses of all connections.
The logs will not show the system name.

I am curious if the person was smart enough to at least use a anon proxy before causing havoc on your shared device?

Could it be a close-by neighbour? maybe a teenager getting into mischief?

If ther person has struck once, i would imagine that they would tempt fate in the future and try again.

HoneyPot comes to mind, while actively capturing network in-bound - out-bound traffic.

Quote:

---

Originally Posted by HYBR|D

I am curious if the person was smart enough to at least use a anon proxy before causing havoc on your shared device

---

What do you mean? Aren't we talking about a local network? How would you use a proxy for local connections? And even if you did, couldn't you just MAC spoof instead?

How do you know that the intruder connected via wireless connection instead of via a wired connection?
Is you connection to your ISP wireless?

Quote:

---

Originally Posted by metguru

What do you mean? Aren't we talking about a local network? How would you use a proxy for local connections? And even if you did, couldn't you just MAC spoof instead?

---

Correct, sorry was in a rush when i typed out my post. I rushed the submit reply instead of taking my time.

i originally moved the topic, i had briefly glanced over the post prior to moving it into it's own thread, then i later made my post without refreshing the page & properly re-reading and just typing what i typed and not taking my time with a proper response.

Sorry for the confusion folks. :(

Quote:

---

Originally Posted by gerry90

How do I find out the IP Address of a system that 'had' connected to my WLAN Router during the day? (Note that it is no longer on the network)
And with this information how do I get to know the system name?

---

Suppose you found out it's 192.168.1.34 and the system's name is "SOMELAPTOP". Then what?

Hi there gerry90, and welcome to AO :)

Quote:

---

How do I find out the IP Address of a system that 'had' connected to my WLAN Router during the day? (Note that it is no longer on the network)

---

Could we have a few more details of the equipment please? In particular; does this device support wired cat5/RJ45 connections as well, and if so, is it physically secure.

For example, I have a wireless router that has two RJ45 network ports. It is in my bedroom, so it is physically secure.

On the other hand, it is not wirelessly secure :eek: as I discovered the other day whilst fixing a friends laptop. The lappy had not been registered on my network, yet software was able to update itself via the internet.

It would appear that whilst it provides some security for the network it is serving, it does not have security of itself. Also it does not seem to do much in the way of activity logging.

My point is that apart from the fact that your data appears to have been messed with, how do you know that unauthorised access took place, and that it was wireless in its origin?

I think that metguru has a point with MAC spoofing?..............if your router thinks that the device is genuine it will let it connect?

I doubt if you will find any useful information after the event. :(

EDIT:

@ SirDice:

Quote:

---

Suppose you found out it's 192.168.1.34 and the system's name is "SOMELAPTOP". Then what?

---

Exactly!

you should also look through your machine's Security Event Log during the time said user was there.

It *should* give you computer name, ip address (if via ip) and any user name it attempted (guest or other) ... if you're not logging then you need to setup security logging so that you GET said information.. its not the greatest (security event log) but it is something.

One can always set up Windows auditing to log all file activity including read, write and delete.

Quote:

---

I had someone access my "Unsecured" network and delete files from some of the shared folders (yes I know its stupid to have had an unsecure network) :-)

---

Another thought:

1. Was that all of the files in the affected folders or just some of them?
2. Does the nature/content of the files give you any clue as to who or what might have done this?
3. Were they specific filetypes like MP3, AVI, MP4, MPEG?
4. Have you run AV/Antimalware recently?
5. Have you tried a file recovery utility? I am curious as to whether they have been deleted or erased.

Is this unsecured network open to the internet, or should it only be accessible locally?

Click the Start menu button on the Windows taskbar.
Click 'Run...' on this menu.
Type 'cmd' in the text box that appears. A command prompt window launches on the desktop.
In this command window, type 'ipconfig /all'. Details are shown for each of the computer's network adapters. Computers installed with VPN software or emulation software will possess one or more virtual adapters.
The 'IP Address' field states the current IP address for that network adapter.
The 'Physical Address' field states the MAC address for that adapter.

mmmmmmm...gee and I thought the poster was looking for remote system that connected to his WLAN???

IPCONFIG wont give you that :rolleyes:

MLF

Quote:

---

Originally Posted by morganlefay

IPCONFIG wont give you that :rolleyes:

MLF

---

Then why not participate with more construtive input into the topic? I gather you may have a "better" suggestion? Then why not just do so?

Quote:

---

Then why not participate with more construtive input into the topic? I gather you may have a "better" suggestion? Then why not just do so?

---

Much like your valuable input??? :rolleyes:

I was stating a fact.....and did not want to repeat what has already been said about logging etc.....

Unless of course if you have some knowledge about IPCONFIG that I am unaware of....please do share. :eek7:



MLF

IPCONFIG is akin to IPFREELY. Just as this topic has no value. Someone connects to a private, unsecured network. Hummmm... Let me think, what to do???

NOTHING.

Let me put it this way. I was the one who connected and deleted your files. Now what?

just to clarify

if ANYONE conects to YOUR WLAN
they will get an IP address from YOUR selected scope :eek:
and as it will be set to deliver private addresses, that 192.168.x.x will be the preferred range given

IPCONFIG is for YOUR local macine detailing

you are probably being interfered with by someone you know :rolleyes:
set some feckin security up on the router
it doesn't take a rocket scientist
and NOT WEP :p
reset ALL passwords
lock the PC when you leave it
press the windows key + L ;)
when not in use
power down

Ladies, Gentlemen, the OP of this thread and The-Spec,

nihil's GRAND CONSPIRACY THEORY :shocked:

1. We are being used as laboratory rats.
2. donaldsmith is not a real person, donaldsmith is a bot, donaldsmith makes one stock post and never responds again.;)

If you examine all his posts (as I have) you will see that they are relevant to the subject matter, but only in so far as a search engine spider would determine.

When you look at the specifics of the thread you will see that that the post is irrelevant? As is the case here.

Somebody is out to make or save a shed load of money by creating an automated, computerised helpdesk system.

Ha! I love it!..............the outsourcers are outsourced...........replaced by a machine :cool::D

They are using this site as a testbed to see what responses the bot's suggestions attract. As I noted, the bot doesn't respond to these as it has closed the ticket?

Well, whoever you are, here is my response:

Stop making the damn thing sound like a cut and paste from Biggelows.

Anything more I charge for.

And shame on you all who were taken in by this and rose to the bait like good little fishies :lildevil:

dammit Nihil: Shame on you for ending what could have been a really fun thread. Quit acting like a gAyhO administrator! Negs for you - (not the neg/MG type)

Hey, nothing wrong with the thread mate, it's just that I find this account rather strange, and, if I'm right, very interesting?

I am sure that most of us have called a helpdesk at some time and you just know that whoever you are talking to doesn't know anything about the product and isn't even listening.....they are just chasing a flowchart?

This looks like a new angle, as the posts look like snips from Microsoft KB articles?

I think that we might have another one on the go, but I am not sure yet.

It has occurred to me that this same mechanism could be used to run sock accounts?

Hey, tell me what you think, you've been around a long time..........is the donaldsmith account weird or am I just paranoid?

I don't know. Your talking about a Turing Test. If that is the case - Donald would have to monitor the results, or replies in this case.

Can you see how often Donald logs on? Can you see the time stamps for every post in Donald's thread? If so, your paranoia is founded if Donald logs on shortly after each post to his thread.

Quick question, can you (or any mod) modify user accounts? Specifically signatures?

Jeez my grammar sucks.

To prove your theory, Donald will log on every time a post is made to a thread he created.

Thanks, I obviously need to do some more research :)

In answer to your question, yes, a moderator can modify signatures. I know that because I have occasionally removed hyperlinks to commercial sites from them.

As regards Donald, I see what you are getting at, but suspect that he might be in early beta at this stage?

It would be difficult to be sure if he logged on or not, as you can read posts as a guest and, like I said, he isn't responding. I don't think that Donald does anything after the first post, and I don't believe that he has created a thread himself.............I think that he is a response bot, and that any feedback is being gathered manually.

I don't think that something like Donald would be much use on sites like this, as we allow multiple posters to a thread. In a one-on-one helpdesk scenario things would be quite different. I guess you could program to only respond to the OP, but that would look even more clumsy I would have thought?

:)

if your theory IS correct, then they 'only' have to C+P replies anyway
then get some 'analysts' to sort th eresponse s into some form of order

we had someting like it at Fujitsu UK when I was there a while back
allowed the 1st line to go quite deep into any reply

quite a sight really
can't remember the correct term for the logcal flow charts
but you know em
did such and such do xyz? ---> yes = or ---> no =

that sort of thing
we added to it as we worked too
any new anomaly we found was inserted

we could see a pattern within some 'engineers' PC DOA returns
if their soccer team was playing a big game that night, their returns ent WAY up
allowing them to complete their workload early :P

so we added a few little tweaks to the scripts for the1st liner to work with :)