1

My network admin might have a record of my default MAC address tied with some mischievous doings as well as my currently used address that they've likely collected after I started accessing using their controlled logins. I initially thought that they would not be able to trace the activities back to me. However, I've recently noticed that only the school's machines can use Ethernet to access the network and that the identification process most likely has nothing to do with MAC addresses, since changing one of the machine's defaults and using one of those on mine produced the same results. Ethernet recognizes the school's machines but not mine.

What other possible ways are there to uniquely identify machines, aside from reading their MAC addresses?

  • 3
    I didn't understand what you were asking until the very last sentence. It needs some formatting and restructuring. But I'd also like to see answers to this. – Dom Nov 29 '17 at 18:03
  • @Dom that's because I did not ask until the very last sentence. What preceded just provided context. – Joe Nov 29 '17 at 18:11
  • VLAN could be involved ... – Hagen von Eitzen Nov 29 '17 at 22:37
3

There are several other ways to fingerprint a device, as shown in a recent paper. The general fingerprinting vector is predictable random number generators unique to different wireless cards. This is a rather advanced attack, and most likely not used by your university. More likely, it is your system's hostname which is being recorded. The hostname is broadcasted when negotiating a dynamic IP address using DHCP. Lastly, TCP/IP fingerprinting, while not the same layer as Ethernet, can still be used to identify a connected device.

It is also possible that authentication occurs in another layer, such as IEEE 802.1X, IEEE 802.1A, or even a VPN connection. You should check if your computer is using any of this for authentication.

  • What if the computers are doing some sort of authentication at layer 2 (802.1x)? This is far more likely. – multithr3at3d Nov 29 '17 at 23:11
  • That's a good point. I updated my answer to reflect that. – forest Nov 29 '17 at 23:17
  • @forest I think they're using authentication by hostname as you suggested. I tested it this morning. I changed my PC's hostname to one being used by a machine at school and I was able to access the network. – Joe Nov 30 '17 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.