R U being watched?-wifi a honeytrap

Other than by MAC address and hostname what are the
other definitive ways to identify the specific computer
that is being used to connect to a public AP? Or, to
identify it's precise location so as to either block connections
from that location, or create a user profile from a specific
machine? Most already know how to change a Mac address, but other
things are not so changeable.

MikeS wrote:

> Other than by MAC address and hostname what are the
> other definitive ways to identify the specific computer
> that is being used to connect to a public AP? Or, to
> identify it's precise location so as to either block connections
> from that location,

If you've got multiple access points you could see which one it was
associated with. If not, no. I've never seen an AP that can report the
direction/distance a client is. There are authentication mechanisms that
can be added to wireless networks, but I assume you want to keep the AP
public, otherwise you would have already taken that route.

> or create a user profile from a specific
> machine? Most already know how to change a Mac address, but other
> things are not so changeable.

The browser will send a User-Agent string that gives varying information
depending on the browser used, but like the MAC this can be changed. The OS
used can be identified by its IP fingerprint. If you've got access to the
machine in question, you could install something on it that will identify
it on the network.

--
<http://ale.cx/> (AIM:troffasky) ((E-Mail Removed))
19:01:13 up 102 days, 21:12, 4 users, load average: 0.11, 0.14, 0.10
Sexy ladies, and nasty boys, all freaky freakin', to the robot noise

Thank you for the reply. Can you comment further on what "IP fingerprint"
is and how it is manifested and detected?

alexd <(E-Mail Removed)> wrote in news:(E-Mail Removed):

> MikeS wrote:
>
>> Other than by MAC address and hostname what are the
>> other definitive ways to identify the specific computer
>> that is being used to connect to a public AP? Or, to
>> identify it's precise location so as to either block connections
>> from that location,
>
> If you've got multiple access points you could see which one it was
> associated with. If not, no. I've never seen an AP that can report the
> direction/distance a client is. There are authentication mechanisms
> that can be added to wireless networks, but I assume you want to keep
> the AP public, otherwise you would have already taken that route.
>
>> or create a user profile from a specific
>> machine? Most already know how to change a Mac address, but other
>> things are not so changeable.
>
> The browser will send a User-Agent string that gives varying
> information depending on the browser used, but like the MAC this can
> be changed. The OS used can be identified by its IP fingerprint. If
> you've got access to the machine in question, you could install
> something on it that will identify it on the network.
>

MikeS wrote:

> Thank you for the reply. Can you comment further on what "IP fingerprint"
> is and how it is manifested and detected?

Further to the other suggestions, 'ntop' will attempt IP fingerprinting
[amongst other things] and give you a pretty web interface to look at the
results in, but it would require quite a bit of work to get it up and
running.

--
<http://ale.cx/> (AIM:troffasky) ((E-Mail Removed))
21:10:32 up 103 days, 23:21, 3 users, load average: 0.22, 0.12, 0.07
Sexy ladies, and nasty boys, all freaky freakin', to the robot noise