It seems like something that an average person can't do, but can some big-name companies or maybe hackers have the technology to look up all Internet activity that has been done by a certain MAC address (or other computer identifier like an IP address)?

  • by "look up" do you mean current live activity, or historical? Live activity can be monitored as described in the answers below. Historical activity depends entirely on whats been logged, and how long the logs are stored for (if your ISP has a data retention policy for instance). An average person can certainly monitor and log traffic they have access to, such as their own, or a shared network they are on (eg; coffee shop).
    – Hearth
    Nov 12 '15 at 23:25

There are a lot of variables to consider with this question, and I've ignored MAC address tracking, since it is generally fairly easy to change a MAC address anyway.

  1. An ISP can look up what connections have been made from devices which use its network. This may be down to the page level, for HTTP connections, the site level, for HTTPS connections, or to an IP level, for things like SSH or proxied connections. It cannot generally see what happens outside of its own network, so it wouldn't see communications between an ecommerce site server and a payment provider server, even if that was triggered by an action on the network it can see - you submit login details to the shop, shop server sends stored card details to payment provider, along with total cost, provider responds to shop, shop responds to you. Only the first and last steps would be visible to the ISP.

    The ISP also can't see, generally, what happens within your local network - it couldn't say which machine on your network was the original source of a request if the connection is using NAT (typical for most providers). This changes slightly with IPv6, but I'm going to ignore that for the moment!

  2. Analytics, advertising and social network providers can see what pages a given computer has visited, based on cookies, and enhanced by IP addresses. They can only see pages which have embedded their code - in the case of Google, that's a lot of pages, since so many sites use Google Analytics - but can see down to the specific page level, even on HTTPS connections. They have no visibility of non-web activity, so can't see if a computer makes a SSH connection, unless it is to a server they control.

  3. Theoretically, operating system vendors could see everything that a specific computer did whilst running that operating system, since all the traffic is likely to go through OS control layers. In practice, there is no evidence of this taking place, even with report-back features in some operating systems.

  4. Similarly, theoretically, a PC manufacturer could embed a monitoring device into computers which could report back. Again, there is no evidence of this happening, and any data sent in this way would have been detected by routers.

  5. If you are on a business network, the IT department can see pretty much everything that goes on. This may include HTTPS traffic to the page level, if they are using man-in-the-middle monitoring techniques, although these do tend to violate privacy of users, and may leave company systems open to other attacks. For business, include educational institutions, general governmental departments, and any other corporate environment.

  6. Security agencies (e.g. NSA, GCHQ) can obtain information from ISPs, social network companies, advertising agencies, and businesses, either legally, with a warrant, or through more dubious means. They can therefore obtain pretty much any data about what an IP address has been up to. They cannot generally state that activity connected to a particular IP address was generated by a specific person (there are exceptions - if there is a video call and a target is speaking to the camera, it would be very hard to argue that it wasn't them). They also have limited ability to follow data running through secure proxies - they can see a connection was made to one, but may not always be able to see the ultimate destination of the traffic.

  7. Hackers. I'm going to sub-divide this one:

    1. If they can install a rootkit on your system, or your router, treat as malicious PC manufacturers. Assume they can see everything (you are probably safe if you use a live CD).
    2. If they can install monitoring software on your system, treat as malicious OS manufacturers. Assume they can see everything from current operating system up (you are probably safe in a different OS)
    3. If they can sniff your traffic, treat as ISP. Assume can see data to same levels as described there, but with the ability to pinpoint local machines too.
    4. If they can hack ISP, analytics, advertising or social media providers, or business network, assume can see everything under the corresponding entry.
    5. If they can install browser toolbars, treat as analytics provider, but with full knowledge.
    6. If they can't install anything, can't monitor network traffic, and can't hack other system, they probably can't see anything. They can still be dangerous though.

The MAC address of your computer is only used in your subnet, it won't pass beyond your router. Unless some software sticks it into documents you edit on your device.

If you have a static IP address, "normal" people can indeed start searching for it, be it with search engines like Google or in Webserver's access files that can be read by them.

If you have a DSL connection that gets a new IP at least once day, your ISP knows where you've been.

You can make it harder to be tracked if you used TOR. You can still be caught tho, if tracking software is installed on your device.


MAC address is an issue. Some, but not all (including many popular) devices do not allow you to easily change your MAC address. While MAC address of a hard-wired device should not ordinarily be visible outside of your local network, MAC and other identifiers for wireless connections (cellular, Bluetooth, Wi-Fi) are available to network operators and to others within range with the right equipment (trivial in the case of Wi-Fi), making it possible to connect (some) of your physical movements to specific times and places.

Open Wi-Fi is a particular concern here, as are cellular connections, particularly to unencrypted sites. Even encrypted sites can't hide their IP address or domain names (if you are using the network operator's DNS), so while full URLs may not be known, certainly server IP addresses can be. Tor, VPNs, etc. can't remove the local geotracking issue, but they can minimize the risk for linking device identifiers with detailed traffic content.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.