0

Is it possible to prove the identity by ip address of someone that has compromised a router on your network?

closed as unclear what you're asking by Jens Erat, Graham Hill, TildalWave, Xander, Polynomial Nov 28 '14 at 14:43

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Could you please be more clear? When you say router, do you mean router / wifi? Are you talking about a remote or internal attack? – Jeroen - IT Nerdbox Nov 28 '14 at 5:18
  • If he intentionally doing it and he is a attacker then you can not. – P4cK3tHuNt3R Nov 28 '14 at 6:03
1

Prove ? No. Trace back, possibly. Most likely, a determined adversary who is focused on you may have compromised one or more intermediate systems through which they pivoted their attack to obfuscate their movement. You will likely need to go before a bench to subpoena DHCP / PPPOE logs, server logs from intermediate systems, etc.

Call in a pro forensics team like Mandiant or Verizon, and coordinate with LE. Based on the questions you are asking, this is probably above your grade.

Not the answer you're looking for? Browse other questions tagged or ask your own question.