The optical fiber cable that supplies a business is used for clients and staff.

The business has an online enquiry form for bookings on its web page. It also provides free WiFi access to clients and staff via a router in the main office. A password is required but is not specific to any user. In other words one password gives anyone access.

If a person using this WiFi connection in the office accesses the public web page of the company and submits an enquiry through the reservations enquiry form, can the actual computer used be traced back, whether from the online enquiry form or any other way without having access the "offending" computer.

No IP cloaking was used. There are five company computers permanent connected and powered on 24/7 which are also connected to the WiFi. The enquiry could have easily come from one of them.

  • 1
    You should give the source for your questions and state what research you've done and not just ask us to do your homework for you. – Neil Smithline Aug 31 '15 at 0:42

If this is a typical WiFi installation, chances are that the DHCP leases still hold, and you can verify which of the five computers submitted the rogue enquiry by checking its IP address. You just need to check the DHCP assignment table on the router itself.

If it was a passersby, then you can perhaps still recover some information if the router has some sort of log, for example:

--- from DHCP log, assuming the router has one 2015-05-17 17:22:12 DHCP ASSIGN to 08:00:27:9b:d4:a9 2015-05-17 17:29:15 DHCP ASSIGN to 1a:00:f3:12:44:02 ...

--- from the web server log - - [17/05/2015:17:23:19 +0200] "POST /services/enquiry HTTP/1.1" 200 2252

From the above you can deduce that the culprit had entered WiFi range at 17:22 and know his MAC address (those six octets 08:00:20... above). From the first three octets you can often deduce something about the hardware; for example 00:A0:40 is an Apple device, so possibly (?) an iPad or iPhone.

(This leaves you the problem of remembering who was in the hall (or thereabouts) in the given timeframe holding an iPad and acting suspicious, however).

In such cases, the device MAC does not usually change and can be verified at a later time. So if you get a DHCP match and it is one of the fixed computers, just write down the MAC. If they're portable PCs, they often have the MAC on a label at the bottom, and you can check those while pretending to note down the Windows license number for accounting purposes. Or just snap a picture with a smartphone - they're on 24/7, but I believe they aren't under that close a surveillance that you can't raise one and snap a pic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.