In a forensic analysis I analyzed the event logs of the affected machine and saw various RDP sessions from XYZ IP address. However to prove that the source IP was not spoofed is it possible that I could find the MAC address of the PC from where the RDP session was initiated?
If the IP address of the suspected RDP source is within your managed network,
and if within your network, all your IP addresses are attributed through a correctly tracked process of IP managment:
and if this IP address attribution mechanism is correctly logged on a protected log server: through
then you can get a valid MAC address of the suspected RDP source
and most probably the physical Ethernet socket or the physical
802.11* access point through which it was connected,
else you can't get any MAC address.
For example, to focus on a possible reply to your question, if the IP address of the suspected source of the RDP attack is outside of your managed network, then you can't get any MAC address.
Be aware that if the attacker was aware of your policy of IP address managment, then the valid MAC address of the attacking PC might have been changed so as to get an access to your network with a registered MAC address.
There is no guarantee the other machine has a MAC address at all.
Following the IP over everything principle, the connecting partd may be sitting in a tree using IP over avian carriers - and pidgins do not have MAC addresses.
You may only get a MAC address of an IP in your local network at the time the connection in done, as the mapping can change over time by assigning a new IP to that interface and is only available to your local network. If you want to do this, it's
Please keep in mind that:
- If the IP address is spoofed, a TCP handshake will fail. No no actual connection can be made.
However to prove that the source IP was not spoofed is it possible that I could find the MAC address of the PC from where the RDP session was initiated?
An IP address is at the network layer while the MAC is at the data link layer (see OSI model). The IP address is the same when the data travel through the various networks while the MAC address changes on each network boundary. Thus if the IP address belongs to a different network it will have the MAC address of the router which provided connectivity between these networks.
Even if the IP address belongs to the local network it does not mean that the RDP session originated there. It might just be a system used as the endpoint of some SSH or SOCKS tunnel and the RDP session originated at the other side of this tunnel.