3

How can you find out the IP address of a single computer inside a college network.

Every computer has the same public IP address on the network. How is it possible, after discovering that the IP is from that college, to find the computer from which the attack/request/etc originated?

Improve this question
4
  • There's more than one way to skin this cat. Is there a particular case example you're looking to figure out? – Iszi Sep 6 '12 at 18:29
  • Why not just ask the university to tell you? – soandos Sep 6 '12 at 18:29
  • 1
    This is a very open ended question - the answer varies radically depending on what kind of data you have access to, what your purpose is in doing the research, and what you plan to do in reaction. – bethlakshmi Sep 6 '12 at 19:58
  • Thank you for the answers. From my understanding, after tracing it back to the college adress, only by asking the college itself to provide additional information, can you pinpoint the actual IP. Thanks again. This answers my question. This was a hypothetical question that always bugged me, since the IP only points to the general location, I always wondered if it was possible for an outside entity to find the source, bypassing the "college IT administration" . – João Gonçalves Sep 6 '12 at 20:04
8

I suppose that our situation is the following: you have detected some undesirable network traffic and you are looking for the perpetrator, so as to, more or less metaphorically, convey to him the inherent unwisdom of his villainous behaviour. The source address of the offending IP packets points to a college; the college uses Network Address Translation so that outgoing traffic from all their students is seen, from the outside, as coming from a single IP address.

(Or, possibly, you are the wannabe evildoer and you want to know what the Long Arm of the Law could do to trace you back. It does not change the technical situation.)

Strictly speaking, the college acts as a kind of anonymizer, since it blocks the actual (internal) IP information. So you should ask the college. They may have detailed logs on network activity, which may help pinpoint the uncivilized individual; for instance, the DHCP logs within the college network could give some information on who had their computer up and running at the time of the indelicacy. There are various sources of such information, which depend a lot on the structure of the internal college network.

Be sure to bring all the information you have on your side; network traces obtained with a network monitor application (like Wireshark or the aptly named Network Monitor) are a must. Also, bring all logs, especially Web server logs, because Web browsers tend to produce a lot of information which can be quite specific to the specific computer which sends the requests (see this page for details).

Improve this answer
1

If you're using an outbound proxy, then a HTTP header might be present

  • HTTP_CLIENT_IP
  • HTTP_X_FORWARDED_FOR can be comma delimited list of IPs
  • HTTP_X_FORWARDED
  • HTTP_X_CLUSTER_CLIENT_IP
  • HTTP_FORWARDED_FOR
  • HTTP_FORWARDED
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.