How do ISPs know what IP you have?

Everybody hears how the RIAA and the MPAA can track your IP and ask your ISP for your information.

My question is: how do ISPs know which customer has what IP?

My theory is that they check their DHCP server logs to see which IPs are issued to whom.

But, I could just make linux claim another IP and do my leeching from there instead, and dispose of it when I don't need it anymore. Would that make me hidden from them?

I know that the MAC address could link it to me, but do routers keep track of the MAC address and which IPs they used?

I'm relating these questions to a cable ISP (optimum online).

Honestly I don't know the answer to your question but to add to what you're saying even a mac address can be spoofed. It is possible to spoof a mac address and from there really what can they do? The combination of what you said and spoofing the mac would make it extremely hard to trace.

IPs tend to be issued to a certain area (physically) based on subnet. Using DHCP they identify which users have which address (you are paying for the access so they will associate it to you). Routers can keep track of MACs (do some research on ARP and RARP). That said, even if you "spoof" the mac the other users on the subnet aren't necessarily doing so. As a result, by simply elimination, they will find you.

Lastly, it's not that hard to figure out who's downloading. Volume tends to give it away. ;) All they'd have to do is stop the access for the high volume users (a technique that is used) and see who "whines" first about losing access. :D

Very true, I didn't really think about them issuing by area... But what if you spoofed the Mac Addy of one of the other users in the area? And by using more and more ways of concealing your Identity proxy chains etc. etc. They really won't be able to take the time or money to find you. The ISP may and I know that's what is in question but outside sites wouldn't be able to. And I'm sure there are other means of concealing identity between you and your ISP though...

ISP connection servers can "track" users/physical link/ip address.

So when you connect, server logs you and ip assigned.

Depending on ISP technology, yes, you can change and use other ip address after connection. Most of ISPs try to simply "shutdown" your connection when detect this misbehavior.
Some treat this like a TOS violation and ends your contract

Eventually, it will cause an odd behavior on ISP network and they will find you, using an ip
address diferent that was assign by them. So, cops go there and arrested you.

BTW, you are pirating music and spoof address, what do the cops think about you? an innocent guy downloading files from internet, or a professional hackers that must go to jail?

Quote:

---

But what if you spoofed the Mac Addy of one of the other users in the area? And by using more and more ways of concealing your Identity proxy chains etc. etc. They really won't be able to take the time or money to find you. The ISP may and I know that's what is in question but outside sites wouldn't be able to. And I'm sure there are other means of concealing identity between you and your ISP though...

---

If you spoof the MAC, someone will complain and the ISP will know about it. Using proxy chains might be helpful but don't bet that it's a 100% guarantee of anonimity. There is ALWAYS a way to find out and there is always a trail. And given the depth of the pockets of both these organizations, it does sound like they are willing to foot the bill.

Quote:

---

an innocent guy downloading files from internet, or a professional hackers that must go to jail?

---

Innocent? Ya. Right. Professional Hacker?! Good lord! Anything but. I don't, and I suspect I'm not alone in this, consider downloaders as "hackers". Crackers or pirates maybe but Hackers? Please.

Even if you hide yourself from the RIAA or whoever, the volume downloaded will be picked up by someone and will probably constitute a violation of the TOS, which gets you banned from their services. Piss off enough ISPs and you maybe trying to find access via war-driving (MMVPA).

Hey, I didn't say was doing it I was just helpin a brother out! LoL. Personally I don't pirate music or software anymore... Became a security issue and with the lawsuits that started poppin up I wasn't gonna risk it... Instead I use LaunchCast!!!

www.launch.com
Free Internet Radio and Video Radio

Dear MsMittens, be aware that term "hacker" is general used as "criminal" outside there.
There is no such thing, out of security community, as white hats, gray hats, pink hats, hacker, cracker.
For them, hacker is a guy that do bad things thru internet. Include piracy, porn, hacking, cracking, defacind, whatever.
And cops (that are outside our community) can distinguish between those "types".

Most Internet wrongdoers don't not get caught because of some super technique
they used to stay in the shadows but because they didn't piss the right person at the right time.
Do something really illegal and find out just how poorly spoofing works for you.
In regard to operating from a your home cable connection anyway.

File swapper lawsuits are a parade to create FUD more than anything.
Millions of swappers and a handful of trips to court..

Stop being a cheapa$$ and buy the content... :)

With that in mind, I doubt there is anything you can do to NOT associate your home/account/billing info with your cable connection regardless of your chosen spoofing technique.
As has already been stated, the process of elimination will probably handle that.

Quote:

---

Dear MsMittens, be aware that term "hacker" is general used as "criminal" outside there.

---

Uh huh. I'm well aware of that. But we're not "outside". This is a security community. ;)

You have to authenticate to connect to an ISP. It's either done in their software, in your network connection properties or in the modem. The modem is tagged before you ever get it with details connected to your subsciber information. Now if you don't get the modem from them there is probably a username in the system somewhere. I have never seen an ISP in my town that does not authernticate users somehow. And with that authentication comes the corresponding IP address that authenticated.

Quote:

---

Originally posted here by MsMittens
IPs tend to be issued to a certain area (physically) based on subnet. Using DHCP they identify which users have which address (you are paying for the access so they will associate it to you). Routers can keep track of MACs (do some research on ARP and RARP). That said, even if you "spoof" the mac the other users on the subnet aren't necessarily doing so. As a result, by simply elimination, they will find you.

---

I am able to manually claim another public IP address with my cable modem, and I can tell my IRC and P2P programs to bind to it, so there would be nothing about my IP in their DHCP logs. Yes, I know that router keeps track of the MACs, but it doesn't seem to do so for long. (Ethereal says I'm constantly bombarded with ARP requests.)

My question is, if I dispose of that after using it, can it be traced to me? Sorry if I wasn't clear.

Quote:

---

Lastly, it's not that hard to figure out who's downloading. Volume tends to give it away. ;) All they'd have to do is stop the access for the high volume users (a technique that is used) and see who "whines" first about losing access. :D

---

Oh, my. I think I've fallen victim already, since suddenly, my service gets lots of interruptions. When I called them about it, they said they would need to send someone to my house to fix it. Should I be paranoid here? I don't think I use a lot of volume anyway, since I don't download too much.

Quote:

---

When I called them about it, they said they would need to send someone to my house to fix it. Should I be paranoid here? I don't think I use a lot of volume anyway, since I don't download too much.

---

You might want to be. It could be a legitimate fix. Then again, it could be that they want to put a newer cable modem in place that will track things better. I used to have a fair amount of interruptions with my service due to some construction in the area and the unfortunate side-effect of cables being in the open (thus suseptible to a variety of environmental issues on bad wires). Boosting the signal seemed to resolve this.

Then again, if you aren't doing this, then there is no issue.

Quote:

---

Stop being a cheapa$$ and buy the content...

---

A few years ago there where many legal issues over tapes and VCRs. And I'm not just talking about the legal issues of selling copied tapes... Like lets say if you rented a movie and have a few days left and you give it to someone else for the rest of the days you have left... or just recording something and giveing recorded content in exchange for other recorded content from someone else. I'm talking about various groups of folks talking about the legal issues and "possible economical threats" of owning and operateing a tape recorder and a VCR.

Well the major difference now and then is things are put to CD-R and you can not only share what you have recorded with friends well beyond walking or driveing range... but share randomly with the world. Agian... mass panic amoung the big wigs. These peaple are just repeating history and solveing nothing by turning file shareing into an issue. At some point everyone has "stolen". Your comment above is just plain stupid. That would be bending over for mob organisations.

Right...............I think that I have seen enough social engineering crap.......your question:

Quote:

---

Everybody hears how the RIAA and the MPAA can track your IP and ask your ISP for your information.

---

Yes old chap, and the CIA, FBI, BNDD, USSS...............and even worse?.............the IRS

Either tell us what you are really about or go somewhere else..............

I am being as polite as I can.

"The man from Del Monte says NO"

:confused:

From what i hear the best way to stop an isp from knowing who you are is to buy a chiped cable modem. which is simply put a normal modem with a MAC that is the same as a paying customer. so if the police or who ever is after you will go round to the paying customers house and not you.

If your spoofing the IP address rest assured The ISP server that is sending/receiving data to your system is sending the information to an IP that was authinticated to your account in some fashion. usually by username and password, or by mac address, sometimes by ip address and orinating phone number. Most ISP's I know of don't allow connections that seem to go into a voidless space. If somehow the connection "ghosts" usually the server will stop data transfer. By the time whoever is looking for the person that had a connnection to the isp when some particular data was transfered, lets say music files for instance, They have already backtracked the connection all the way back through what ever proxy or spoof to the second last link in the chain, the ISP. The suited lawer type tell the isp to hand over the logs concerning the connection the data(mp3's) were going to and viola, keep the red strobe flashing thing put away the printer is over there. If you ask your ISP for data off of these logs they will probly instantly tell you for security reasons you will have to supply a warrant of a supina to protect customer privacy. kind of ironic.

Quote:

---

Your comment above is just plain stupid.

---

Ah yes, clever forum abuse from The Specialist.
Very impressive indeed.
You almost made a point, keep trying it will come to you.

Thank you... and there was nothing impressive about your posts. You just commented my point. But keep trying and someday you may actually appear to be an intelligent person.

Quote:

---

Originally posted here by syberdave
[B]Everybody hears how the RIAA and the MPAA can track your IP and ask your ISP for your information.
My question is: how do ISPs know which customer has what IP?

---

They allocate them, so they log who has which one. Depending on the connection type, this could be relatively easy - chances are their rotuers which allocate IPs to customers using PPP just log each customer's IP and store it centrally on some server somewhere.

Quote:

---

My theory is that they check their DHCP server logs to see which IPs are issued to whom.

---

Or DHCP if they use DHCP if they have an ethernet-like broadband. Again, their routers will record which MAC address belongs to which customer, and you will have to register the MACs or it will automatically record a customer-MAC address table.

Quote:

---

But, I could just make linux claim another IP and do my leeching from there instead, and dispose of it when I don't need it anymore. Would that make me hidden from them?

---

If you told your machine it had a different IP address, almost certainly you would not be able to communicate, because their routers would not automatically update their routing tables, so you would not receive any packets.

Not only that, if they detected such spoofing, they'd probably assume your machine was broken and cut it off.

Quote:

---

I know that the MAC address could link it to me, but do routers keep track of the MAC address and which IPs they used?

---

MAC addresses are only for ethernet. Most broadband providers do not really use ethernet, even if they use something which "looks like" it.

So there is likely to be an underlying address that you cannot change.

Quote:

---

I'm relating these questions to a cable ISP (optimum online).

---

As I say, they probably don't "really" use ethernet.

If you abuse their service, they have the right to cut you off. If they suspect that you are doing something really naughty, they can report you to the relevant authorities. Either way, attempting to abuse the system is asking for trouble.

It's highly unlikely that an ISP would cut you off if you aren't abusing *their* service, unless they are asked to by some higher power. I'm pretty sure they won't routinely scan every packet for nasty stuff - if they did that all the time, they would not make any profit because all their money would be spent on hardware and personnel to do it.

Slarty

My brother is an admin at an ISP. His boss is the anti-gov't type and has the logs purged as soon as they're created to remove the possibility to track you. I would assume some other ISPs might be the same.

Don't expect because you're getting ARP packets that the network has forgotten about you. Its just checking to make sure you're still there and still the same person/machine.

If you spoofed the MAC of another customer and that customer came on, and the ISP is not using a layer three switch, you'll have some really weird results.

If you try to bypass the DHCP servers you could get an IP collision when the DHCP server decides to hand out the address that you have. You can't just make up an address that the server would not hand out, because most likely the only routable IPs on the network are going to be in the DHCP pool.

You also have to worry about authentication. ISPs don't just allow anyone to connect to their network. You either have to have a login/password which could be used to track which connection was yours. If you have a broadband connection that doesn't require a login, they can still track you. I'm not positive how this works, but I do know that if you are having a problem and call tech support for the company they can figure out which device is yours and test it. This might have to do with the MAC of the cable/dsl modem which is most likely hard to change, or they might have a way of telling which pipe runs to your house. This part I'm not sure exactly how it works, but I know they can tell which is which.

Quote:

---

Originally posted here by zENGER
His boss is the anti-gov't type and has the logs purged as soon as they're created to remove the possibility to track you. I would assume some other ISPs might be the same.

---

I have no idea how it works on USA, but here if an ISP doesnt keep log files to show to the COPS..... police can charge ISP owner/admins with the same crime as the "user" did.