PtokaX forum

Stuff => Offtopic => Topic started by: blackwings on 05 December, 2004, 03:27:20

Title: some questions about Sygate and MAC adresses
Post by: blackwings on 05 December, 2004, 03:27:20
I have Sygate and I see that Sygate can block MAC adresses. So when I see that I get attacked in the security log, can I block the remote MAC adress? The Sygate log different MAC adress of the different attackers, so it seems like it isn't my own router MAC adress or one of my ISP servers MAC adress. But could it be possible that it really is a MAC adress of one of my ISP servers, I mean, the way the differnet hackers connect to me , maybe they go through different servers of my ISP to get to me = I see in the Sygate log different remote MAC adresses. So is it the attackers MAC adress I see or is it one of my ISP servers MAC adress I see??


Anyway, I wasn't really worring about the hackers.  What I was thinking of was a smart way to "more" permently ban people. My idea is to block the IP to the person I want to perm ban in Sygate, then use !kick on him and when he tries to reconnect, he gets blocked + Sygate log the MAC adress that he has. Then I block the MAC adress in Sygate = More permantly banning than just banning the IP+username in ptokax

Anway, that brings us back to the first thing I said. If it isn't the hacker/users remote MAC adress, that it is one of my ISP servers MAC adress, so if I block a MAC adress to one of my ISP servers, that would maybe mean that I will block a large part of the internet = it's really bad if it was like that :(

(right now when I'm writing this I'm very tired, so I'm really sorry if what I'm wondering is hard to understand, but please bare with me ok? :)  )

Title:
Post by: Cypher on 05 December, 2004, 18:00:30
whats the point on banning a mac address when mac addresses can easily be spoofed?
Title:
Post by: NotRabidWombat on 05 December, 2004, 18:21:02
MAC addresses do not resolve over routers.

-NotRabidWombat
Title:
Post by: blackwings on 05 December, 2004, 22:54:03
QuoteOriginally posted by NotRabidWombat
MAC addresses do not resolve over routers.

-NotRabidWombat
which mean that it isn't the hackers mac adress I see in the log?
Title:
Post by: BoJlk on 06 December, 2004, 00:33:08
MAC address are changed after beeing routered.

/edit
only the ISP servers/router with the hacker work thru know the MAC address.  :(

witch could be spoofed.

Quoteblackwings: "block the IP to the person I want to perm ban in Sygate, then use !kick on him and when he tries to reconnect, he gets blocked + Sygate"

I used the same technique Blockin an IP thru FireWall, but allmost all Users has a Dynamic Addresses, so it's relevant till he get a new IP address.
Title:
Post by: blackwings on 06 December, 2004, 05:45:03
QuoteOriginally posted by BoJlk
MAC address are changed after beeing routered.

/edit
only the ISP servers/router with the hacker work thru know the MAC address.  :(

witch could be spoofed.

Quoteblackwings: "block the IP to the person I want to perm ban in Sygate, then use !kick on him and when he tries to reconnect, he gets blocked + Sygate"

I used the same technique Blockin an IP thru FireWall, but allmost all Users has a Dynamic Addresses, so it's relevant till he get a new IP address.
damn and I just thought I have found a great way to "more" permently ban users to my hub :P
Title:
Post by: BoJlk on 06 December, 2004, 16:06:02
yep...i'm out of ideas allso

Maybe plop will have an idea?
Title:
Post by: plop on 06 December, 2004, 17:56:53
QuoteOriginally posted by BoJlk
yep...i'm out of ideas allso

Maybe plop will have an idea?
on some rare isp's the dns is linked 2 the account, so nomather what IP they dns stays the same.
but it's a lot easier 2 configure a network by linking the dns 2 the IP.
but you can forget about using MAC addy's.

plop