New answers tagged

2

If the IP address of the suspected RDP source is within your managed network, and if within your network, all your IP addresses are attributed through a correctly tracked process of IP managment: DHCP or radius or 802.1X, and if this IP address attribution mechanism is correctly logged on a protected log server: through syslog, then you can get a valid ...


1

However to prove that the source IP was not spoofed is it possible that I could find the MAC address of the PC from where the RDP session was initiated? An IP address is at the network layer while the MAC is at the data link layer (see OSI model). The IP address is the same when the data travel through the various networks while the MAC address changes ...


2

No. There is no guarantee the other machine has a MAC address at all. Following the IP over everything principle, the connecting partd may be sitting in a tree using IP over avian carriers - and pidgins do not have MAC addresses. You may only get a MAC address of an IP in your local network at the time the connection in done, as the mapping can change ...



Top 50 recent answers are included