Printable View
hello guys,
just wanna know is it possible to track the location(geographical) location of a person while he is in same city as yours and uses internet services like mailing u etc.
i dont know if the person has the same isp.
and if thts not possible then how was the code generator of iloveu virus was caught. i tried in google but i think i cud not get the right match of words.so it was a futile search .im not sure what i shud look for .
can u help me?
its possible, why do you want to know
it is possible.If you want to know IP address of a person who sent you a mail open mail header and analyse.
Once you have IP address you can track that ip address to an address(well in most of cases).
How?
If you want to get exact location of an IP address like those show in hollywood movies i don't think you can do it on your on.I see that you are from india now most of cable net users from india are illegal they are non tax paid so they don't have a valid global ip address associated with them.i am not so sure but i don't think that they can be traced.if they have commited some cyber crime from their PC then related agency will contact their cable net administrator for their location.
but you can certainly have an idea about estimated location of a IP address there are many ways to do that.see this.....
http://www.antionline.com/tools-and-toys/ip-locate/
with this link you can get an idea about estimated location associated with a IP address in most of cases country associated with a ip address is correct.
***http://www.antionline.com/tools-and-toys/ip-locate/***
littlenick.... this thing doesn't work. It is showing the wrong ip and wrong country as well. I'm using cable but it isn't even pointing in the right direction. Why do u suppose this is happening? In fact.... it says that 255.255.255.0 is in netherlands and 127.0.0.1 is in California :D
http://www.antionline.com/tools-and-...ress=127.0.0.1
http://www.antionline.com/tools-and-...antionline.com
what does 127.0.0.1 means to antionline.com?i guess antionline.com so it shows location of where antionline is located.tell us all what are you trying to do?I don't understand as long as you don't tell us we will never understand your question properly
Hi Bisht,
There are two answers to this one: "yes" and "no" :) so I will look at two situations:
1. You and I as private individuals:
If I am using a proxy server, that is the IP address that you will see.............it will tell you nothing of any value.
If you traceroute my "genuine" IP address it will tell you that I live in Manchester, which is about 120 miles away! That is because it stops at the ISP, and it is all standard copper wire telephone cables from there to here. Although I have a unique IP address at any one time, it is from a block of them on the ISP's sub-net.
2. You and I as law enforcement agency or counter-intelligence operatives.:
Here we can go to the ISP and get their logs. We have the unique Manchester IP address that was allocated to a particular user at a particular time. That will trace directly back to the ISP's customer. But we would need access to their customer/accounting records as well.
If a proxy server was used, then the case is more difficult as we would have to match the proxy's logs to the ISP's logs. If the proxy were in an "unfriendly" country, or deliberately cleared their logs regularly, the task would be difficult.
There are a lot of complications such as Wardriving, spoofed addresses and the like; but I think that I have answered your basic question.
As far as i know 255.255.xxx.xxx...................is some sort of reserved address, and 127.0.0.1 is the internal address of most if not all PCs on Earth. Totally useless from a tracing viewpoint.
Cheers :D
For clarity the 255.xxx.xxx.xxx block of addresses are the broadcast addresses for the different network blocks. A general broadcast to every computer on the internet would be 255.255.255.255.
You can trace the sender..... one way of doing that is if you are using services of yahoo, hotmail or lycos there is an option of all hearders in advanced settings i think... you have to enable it .... After doing that whenever you receive mail you can see the original IP address of the sender..... after getting it trace with any tracing software.
FanacooL,
The problems with what you are suggesting are:
1. The header address can be spoofed, as it is with most SPAM mail.
2. You will only get an IP address trace back to the address of the ISP's block that it issued the address from. Over here (and in many other places) the connection address is dynamic, and gets issued with every login.
To go beyond that you need to see the ISP logs and account information.. I can find out who the ISP is, but that is all. If a proxy server has been used the information is even more misleading:)
3. The sending box could be "owned", so the address information is totally irrelevant. It could point to a completely different country.
Even on cable modem all i have to do is reset my router and 7 times out of 10 i have a new IP adress. If it were a realistic possibilty cyber stalking would be much more scary than it allready is.
Look.... it's not just abt the reserved ip addresses.... i've just opened the ip locator and it gave me my ip address as 202.63.119.209 and my location as NSW, Australia !!! I'm from India. Why is this happening. BTW my personal ip address is 192.xxx.xx.xxx. Isn't this a reserved ip as well? Now, how will they track me down if this ip address can point any local network in the world and isp address is located in Australia??!!
The IP Locator here is flaky. Try this one: http://www.ip2location.com/free.asp
Yup .... this one works :D . Good thing though, I thought i was completely secure with absolutely no effort on my part. Thanx.
No, that is a Local network-wide broadcast to all networks physically connected to the same switches/hubs you are. A general 255.255.255.255 broadcast will not be routed, only directed broadcasts will. There are certain limited exceptions to this rule, but generally it won't reach the Internet.Quote:
Originally posted here by Tiger Shark
For clarity the 255.xxx.xxx.xxx block of addresses are the broadcast addresses for the different network blocks. A general broadcast to every computer on the internet would be 255.255.255.255.
csch:
The principle of what I said is correct and you are right but you are assuming that the ISP's out there are properly set up.... Some are clearly allowing some 255.255.255.255's to get to my network, (thus my ISP isn't exactly perfect), because I can show you the packet dumps directed to 255.255.255.255. They are almost exclusively Messenger Spam but I would be happy to search for some others if you like - bearing in mind I can't _prove_ their origin but I do know the owner of my ISP personally and I don't think he's the spammer.
Just my 2c on that issue....
I could show you some too, but I'm on cable and inside the border routers all broadcast traffic is treated as on a LAN. Is that possible in your situation? I know if I ping a broadcast address from inside my LAN every piece of routing equipment I've played with keeps it on the "lan" side of things (ie: does not forward it via the WAN port), at least by default. Some can be configured to do so intentionally, but it's generally not a good idea.
wow guys
now i do have options.well i take it tht u guys are telling me tht i need some acsses to local isp records,database but i dont think i dont have tht,
and yes nihil u r right tht illega thing in india is too much.ur right
guess i ll have to drop this aim.but thnx
i think i will use bit of social engineering to find out the missing links.and if tht thing abt near aprox of location is correct i think i have won the bet.
and any ways guys thnx.
u ppl really did a great job.
bye
u know i think why waist time studying when ignorance is instantaneous and birth got.
csch:
It's quite possible that they are coming from within my ISP's block and their routers are letting it run internally to their network because of some monitoring software or whatever that they use for management but I do see them from somewhere.... It's just sorta impossible to tell where from... If I think about it I'll take a look at the TTL and see if they are inside the netblock or not. I know I block my broadcasts because I had to stop logging the "deny"s about an hour after I turned it on.... :rolleyes:
If it is inside the ISP's netblock I'll have them track down and talk to the owner because they are spamming Messenger stuff and, as far as I know my ISP doesn't have private customers, (I think they are all corporate/small business), and I'm pretty sure Norm would agree with me that it is a tad out of order.....
In order to Track the IP you need to see the IP Addresses provided by all the ISP's in ur region and once u get to know about the network addresses provided by a particula ISP , u can contact tat ISP and get to know the persons Geographical Information.
That ISP won't give such kinda information to anyone...... ya if authorities try to trace such an ip address ISP will cooprate
So How Come Persons at gov agencies trace the Hacker,they do get arrested right and also how do you trace someone who has tried to access your pc from outside the lan network but the default IP adress is showing one of your own LAN PC
Because they (government people) have things like "deep pockets" or "lots of resources" and "warrants". "Warrants" are things that make ISPs go "Ewwwwwwwwwww" and hand over their user lists and the associated IPs.Quote:
So How Come Persons at gov agencies trace the Hacker,they do get arrested right and also how do you trace someone who has tried to access your pc from outside the lan network but the default IP adress is showing one of your own LAN PC
If someone has tried to access your machine from outside the lan and it's showing the machine's IP (if I'm understanding you correctly) it's usually one of two things: not actually someone outside but the machine itself accessing itself or it's a spoof (which means you're router/firewall isn't configured to prevent this). You might want to fire up a sniffer to truly see traffic that is coming to your machine. You then should see the real IP. I'd also double check your firewall/router to ensure it denies packets or connections attempting from outside the lan to into the lan like localhost (127.0.0.1) and private/reserved addressing from outside (10.x.x.x, 172.16.x.x, 192.168.x.x). These addresses should never be sourced from the Internet.
I had to shut down NetBIOS/RPC traffic logging as well as broadcasts. Seems like people on cable around here are VERY friendly. ;)Quote:
Originally posted here by Tiger Shark
It's quite possible that they are coming from within my ISP's block and their routers are letting it run internally to their network because of some monitoring software or whatever that they use for management but I do see them from somewhere.... It's just sorta impossible to tell where from... If I think about it I'll take a look at the TTL and see if they are inside the netblock or not. I know I block my broadcasts because I had to stop logging the "deny"s about an hour after I turned it on.... :rolleyes:
Uhh yeah, it would be. Might even violate the AUP.Quote:
If it is inside the ISP's netblock I'll have them track down and talk to the owner because they are spamming Messenger stuff and, as far as I know my ISP doesn't have private customers, (I think they are all corporate/small business), and I'm pretty sure Norm would agree with me that it is a tad out of order.....
OK, I still had some captures save so I took a quick look.
Assuming someone isn't playing with the TTL's just to be an azz the TTL's imply around 10-20 hops. Funnily enough the messanger popups come on groups of 2-4 all at once. The IP addresses they purport to be from are all different but the TTL's are all the same in each group.... Funny huh? ;)
So the upshot is that my ISP allows anything through and it seems like the spammers aren't inside the ISP's netblock.