3 Days Left to Save $250 on SANS Boston 2009! >> More Info
the most trusted source for computer security training, certification and research

Intrusion Detection FAQ: Can I use the MAC address of an Ethernet packet to trace an attacker?

< Previous Question | Back to Intrusion Detection FAQ Home | Next Question >

If the attack originated from a system that has a direct connection to your system with no gateway in between, then you can use the MAC address. But, if a gateway is in the path, then the gateway replaces the MAC address of the sender with its own address. As a result, you can trace the attack to the gateway only. If the gateway has extensive logging enabled, you might consider searching the log file for more information.

Dirk Lehmann
Siemens CERT

< Previous Question | Back to Intrusion Detection FAQ Home | Next Question >

504 was a great course to better enhance my understanding of attack methods and how to better defend my systems
-Dustin Odsa, Indiana University

SEC503 Skyscraper - general

Contact us: (301) 654-SANS(7267)
Monday - Friday 9am-8pm EST/EDT