1

I've been reading up on browser fingerprinting and device identification. Today I'd like to focus on the network side of things.

Assuming I was interacting with a website on multiple occasions, but I used a different device each time, by which means would they be able to identify that the requests had come from the same network?

My list so far (I know there are many more but I'd like to learn more about which ones are most likely to be used/that I'm most likely to run into).

  1. IPv4 address
  2. IPv6 address(Not yet sure how IPv6 works, can it be used for fingerprinting?)
  3. The MAC address of my router (can sites obtain this data and track me with it?
  4. Exit/entrance nodes?
  5. How far back can packets be traced? I assume they cant physically geolocate me without my consent, but would the origin of the packets always be the exact same for my region, or would my ISP mix it up? What if the router/modem is powercycled to reassign a new dynamic IP?

And what else?

  • We'd need to know about your network - if it's a standard home connection, all your different devices would appear to be coming from a single IP address, which kind of negates the rest of the question. – Matthew Jan 9 '17 at 16:51
  • The presumption I'm working with is that I use 1 device at a time per unique IP, (once i finish device use I powercycle the modem), so no 2 devices would ever share the same IP. – user1299028 Jan 9 '17 at 16:59
  • 1
    Powercycling the modem is generally not sufficient to ensure that "no 2 devices would ever share the same IP"; at best, you might receive a different IP from the same narrow range so you should expect repeats; but many ISPs will have the same external IP for your connection across those reboots. Howerver, it's simple to verify how that works for your connection, just try restarting, reconnecting and check your IP address, so you should simply do so. – Peteris Jan 9 '17 at 17:03
  • Powercycling is not the only measure taken, that was just a truncated explanation for efficiency purposes. I powercycle, check my new IP, and record it in a log of IPs used. – user1299028 Jan 9 '17 at 17:23
  • 1
    Your mac address does not get broadcasted to external websites, if it did there would be websites equivalent to ip-chicken or whatsmyip. They only way you can get mac address if you're sniffing on the internal network (you can get mac address if you just sniff the air, near the router) and just grab mac address probing back to the router. edit; you can mask tor traffic by making it looking like multiple people are using tor. Or be like me and have a yagi antenna (foot long) connect to starbucks wifi from 100 feet away. – andyADD Jan 10 '17 at 6:36
1

In order to serve content to you, the end web server must know where to send the information. Depending on how the individual packets are being routed, this could be with the IPv4 or IPv6 protocols. Each protocol use their own addressing systems, but still have "IP Addresses".

The website can not have any knowledge of how packets between you and the server come about. Internet paths are dynamic, so routing can change from one web page to the next. A trace route can be preformed, and the utility will give one of many paths for a website to reach it's destination client (you).

Beyond that, a website has access to some of your browser's information. For instance, your browser version and being able to read and write cookies. Interestingly enough, some individuals have made claims that websites can track users though screen resolutions. This seems quite unreliable so probably not of much use.

Browser information can vary between devices, cookies are not shared between devices unless the website writes the same data in cookies.

A VPN (Virtual Private Network) connection can eliminate a direct path between a web server and client. There are many services available, some even offer a website version.

Tor is a heavily modified form of VPN, which requires it's own reading.

As an added bonus, here is some log information from my web server. It shows basic information about some potential offenders: Where they are connecting from, what time and date, how and what they requested, and what the server's response to that request was.

46.165.254.129 - - [09/Jan/2017:00:32:33 -0500] "GET /muieblackcat HTTP/1.1" 404 210
46.165.254.129 - - [09/Jan/2017:00:32:33 -0500] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 404 226
46.165.254.129 - - [09/Jan/2017:00:32:34 -0500] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 404 226
173.245.50.247 - - [09/Jan/2017:10:48:50 -0500] "GET /robots.txt HTTP/1.1" 404 208
222.186.51.194 - - [09/Jan/2017:14:25:04 -0500] "GET /phpmyadmin HTTP/1.1" 404 208
46.165.221.74 - - [09/Jan/2017:17:56:48 -0500] "GET /muieblackcat HTTP/1.1" 404 210
46.165.221.74 - - [09/Jan/2017:17:56:48 -0500] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 404 226
46.165.221.74 - - [09/Jan/2017:17:56:48 -0500] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 404 226
46.165.221.74 - - [09/Jan/2017:17:56:48 -0500] "GET //pma/scripts/setup.php HTTP/1.1" 404 219
46.165.221.74 - - [09/Jan/2017:17:56:49 -0500] "GET //myadmin/scripts/setup.php HTTP/1.1" 404 223
46.165.221.74 - - [09/Jan/2017:17:56:49 -0500] "GET //MyAdmin/scripts/setup.php HTTP/1.1" 404 223
108.162.215.203 - - [09/Jan/2017:21:12:51 -0500] "GET /robots.txt HTTP/1.1" 404 208
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.