6

Is there a way to trace back who was using a public dynamic IP address previously?

Would it be possible to find out the MAC address of the host using the IP address at a given time? (e.g., can you interrogate gateways to find this historical data?)

Or is it as good as gone once the IP address has been reassigned?

Improve this question
2
  • 1
    @schroeder which technologies (if any) on a public network should I be looking into for this kind of thing?
    – Crizly
    Jul 19, 2015 at 1:30
  • 2
    Network-level data like that isn't public. You'd have to obtain the logs from the ISP's. I updated my answer below.
    – schroeder ♦
    Jul 19, 2015 at 2:44

3 Answers 3

Reset to default
12

Internet service providers do typically keep a detailed record of which dynamic IP address is assigned to which customer at any given time. However, in general they will only give out this information to law enforcement if they receive a court order, to protect privacy.

As for MAC address, the ISP probably also knows the MAC address of the home router used at that IP address (assuming this is a residential Internet connection). However, most likely they will not know the MAC addresses of any devices behind that router, as MAC addresses are only visible within the same LAN. These MAC addresses may or may not be logged by the home router, depending on brand/configuration.

Improve this answer
2
  • 1
    But MAC addresses are nearly useless to identify the computers themselves. You can use builtin ways in Windows to change your MAC address. You can use commands in Linux to change it. Heck, even VMs can be set with different MACs! So, the O.P. shouldn't worry about it, and this should be added to the answer, in my opinion.
    – Ismael Miguel
    Jul 19, 2015 at 3:41
  • 1
    Even if MAC addresses were 100% accurate and unique how would they help? How do you map a MAC address to the owner?
    – user541686
    Jul 19, 2015 at 5:47
6

The DHCP server logs will have a record of what MAC address was issued with what IP address in the past. I do this in my own corporate network to look for anomalies.

But your question is about public IP addresses. The same principle applies, and this data is not public information: you'd have to get access to the logs of the networking devices.

So, for the average person (not a government agency) you cannot determine who had an IP address last unless you had some form of logging that you yourself controlled.

Improve this answer
-1

A simple answer would be to submit a request to your ISP with a law enforcement agency's document for the public IP address.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .