How can I identify a machine with two network interfaces as one?

Question

When I run nmap on different subnets it finds different hosts. They are identified by their ip and if they are one the same subnet as the scanning device also by their mac address. But how can I identify machines as one, that have different interfaces in different subnets?

Answer 1

There are lots of interesting techniques that others are covering in their answers. Many of these are also discussed in Michal Zalewski's book Silence on the Wire. But the easiest method with Nmap is to use the duplicates NSE script. This uses various methods such as SSL certificates, SSH host keys, and MAC addresses to identify addresses that could be on the same system. It's not foolproof, but nothing really is. New techniques may be added in the future as well. Note that this only works if both addresses are scanned in a single Nmap scan.

Answer 2

Nmap manual page says

Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.

I believe that nmap cannot detect them as single machine because nmap host discovery is a layer 3 scanning(Nmap uses raw IP Packets in novel...) and MAC addresses are embedded at layer 2 of OSI Model.

EDIT:

The only identity of a computer on a network is its MAC address and IP address. Trying a luck with these two in your case is meaningless. One possible way that I see is that you make the user interact with a web server and plant some cookie on it. These cookies could be useful for identifying a user. But if the user uses a new browser or clears the cookies, you'd loose you tracking.

You can also write a client-side script to create a file with some randomly generated number at some particular directory in the computer to track the user. The random number can be matched against a DB for identification. But it has its own downsides like the permission issues to write and read data from user's PC. Also the client-side script is visible to user in source code of page. A user may just walk over and delete your file.

I don't believe that there's a straight forward way to achieve your intent but you could use the clubbed knowledge of the ways I mentioned and work your way up. Good Luck! Hope it helps.