1

In a forensic analysis I analyzed the event logs of the affected machine and saw various RDP sessions from XYZ IP address. However to prove that the source IP was not spoofed is it possible that I could find the MAC address of the PC from where the RDP session was initiated?

4

If the IP address of the suspected RDP source is within your managed network,

and if within your network, all your IP addresses are attributed through a correctly tracked process of IP managment: DHCP or radius or 802.1X,

and if this IP address attribution mechanism is correctly logged on a protected log server: through syslog,

then you can get a valid MAC address of the suspected RDP source and most probably the physical Ethernet socket or the physical 802.11* access point through which it was connected,

else you can't get any MAC address.

For example, to focus on a possible reply to your question, if the IP address of the suspected source of the RDP attack is outside of your managed network, then you can't get any MAC address.

Be aware that if the attacker was aware of your policy of IP address managment, then the valid MAC address of the attacking PC might have been changed so as to get an access to your network with a registered MAC address.

4

No.

  • There is no guarantee the other machine has a MAC address at all.

    Following the IP over everything principle, the connecting partd may be sitting in a tree using IP over avian carriers - and pidgins do not have MAC addresses.

  • You may only get a MAC address of an IP in your local network at the time the connection in done, as the mapping can change over time by assigning a new IP to that interface and is only available to your local network. If you want to do this, it's

    arp -an
    

    Please keep in mind that:

  • If the IP address is spoofed, a TCP handshake will fail. No no actual connection can be made.
  • What about network interface mac address? – Airbourne Apr 6 '16 at 7:17
  • My question is if the network interface has a MAC address then? And we are in a local network. E.g. IP 192.168.2.1 has a0:cc:0f:ab:20 then will I be able to get it in any way possible? – Airbourne Apr 6 '16 at 7:25
  • The arp -an is of little use outside of an attack in progress. – dan Apr 6 '16 at 9:04
  • 2
    Key point: if the RDP was working, then the IP address wasn't spoofed. – dan Apr 6 '16 at 9:05
  • 2
    The TCP threeway handshake. It cannot be completed with a spoofed packet. – Tobi Nary Jun 4 '17 at 16:46
2

However to prove that the source IP was not spoofed is it possible that I could find the MAC address of the PC from where the RDP session was initiated?

An IP address is at the network layer while the MAC is at the data link layer (see OSI model). The IP address is the same when the data travel through the various networks while the MAC address changes on each network boundary. Thus if the IP address belongs to a different network it will have the MAC address of the router which provided connectivity between these networks.

Even if the IP address belongs to the local network it does not mean that the RDP session originated there. It might just be a system used as the endpoint of some SSH or SOCKS tunnel and the RDP session originated at the other side of this tunnel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.