[the_hangman]

Ok I'm SURE this isn't the right place for this, but I had no idea where I would put this.

We had like a bunch of laptops stolen from where I work, and we want to try and get them back. I was thinking that if we could do somekind of a whois on the MAC address, like you would on an IP address (assuming they will be online. They also have a bunch of our cellular wireless cards) then you could find the IP and track it down....

I dunno it kinda sucks

any suggestions?

[Nova Dragoon]

moved to networking

AFAIK, there is no whois DB of mac addrs because they are really only pracitically used on the local network level.

[Piperlester]

In theory, you could track down the laptops. Given that according to the IEEE, there should be no duplicate MAC address ever. But that presents a problem... with so many NIC's out there, it is possible, however unlikely to be duplicates.

The other problem, is once the Ethernet frame is received by a switch (Frame Relay or other style networks), the source/destination MAC address is removed, and replaced with the appropriate transmission protocol header.

If you happened to get a packet from the MAC that you recognized (because the router on your side will replace the MAC address into the Ethernet frame), you'd have to try and track down the IP. That would be assuming they are on a public IP, and not an internal, private LAN, because then you would have to track down their router, and then determine from there where the system is.

As well, most NIC's allow you to change their MAC addresses in the advanced properties of the device. If I stole a laptop, that would likely be the first thing I would change.

Again, it is _possible_, but so unlikely that you'd spend more time and money on tracking them down, than you would just buying new replacements.

Sorry that I couldn't give you a more positive answer.

Cheers!!

This post has been edited by Piperlester: 06 June 2006 - 06:19 PM

[MarkoDaGeek]

Hangman I'm suprised your firm wouldn't have some sort of tracking label or something with the notebooks.

The MAC address is an unrealistic way to try and track down the missing computers, it would be a waste of time and resources. However your firm should have an inventory log of the serial numbers for the stolen notebooks, make sure those numbers are reported to local law enforcement as most stright pawn shops and such will check out serial numbers when buying a big ticket item like that.

[the_hangman]

Yea I spent most of yesterday reading up on all this and I have to say it's probably gone..
For the record, I work for a roofing company with offices all over the united states... we don't even know what office this guy was currently in when he up and disappeared with our stuff. And this company just recently got big enough to have a "corporate" atmosphere and better technology, so I don't think it was ever a priority to worry about stuff like this.
We are looking into security alternatives now though