16

When you hit up a site, such as cnn.com, does the TCP/IP packet contain the MAC address of your network card?

Could cnn.com theoretically record my MAC address?

26

In IPv4: Nope. They will see the MAC of the device which forwarded the packet to the server, likely their border router.

In IPv6, the 64 bit "host" part of the full 128 bit address is often automatically generated from the MAC address, and hence might be visible to the server one connects to. See also How to avoid exposing my MAC address when using IPv6?

  • 4
    +1 for correct answer, and bonus reminder of what mac they would see. – Ian Boyd Feb 27 '10 at 2:36
  • @Ian Boyd & @Jonn T So where is the furthest point in the chain that my mac address would be seen? My ISP? – AngryHacker Feb 27 '10 at 2:41
  • 5
    MAC addresses only exist on Ethernet networks. MAC addresses stop at your Cable/DSL modem (so your ISP could see that). Even that will only see the MAC address of what it is connected to, if that's a router it sees the MAC address of the router and not your computer's. – shf301 Feb 27 '10 at 3:17
  • @shf301, true, for IPv4. Not so much for IPv6 (like I edited into the answer). – Arjan Feb 4 '11 at 11:21
  • Of course this answer ignores the possibility of client-side scripts (embedded in the web page) that fetch the information locally and then upload it to the server. Getting a MAC address that way might not work on all browsers, but there's a lot of information that is available. – Ben Voigt Jan 29 '14 at 20:12
-3

And how do you know that CNN is not executing ipconfig /all from the browser java scripts, and collecting the data, then parsing it and recording the MAC?

You can start by purchasing the computer with cash anonymously somewhere. Go to a public Wifi and use that for access.

And finally, somehow lock down your ipconfig commands. This may not do the trick though because a smart enough programs can go straight into a particular memory address and read it. I suspect the MAC address is always placed in the same address of memory and can be retrieved. You need to set up your OS so it will not allow direct access to memory without the highest level of access, then never go to a website while logged in to admin level.

  • 1
    Websites cannot execute arbitrary commands on the computer unless there is a security bug in the browser. – kinokijuf Dec 16 '14 at 18:26
  • 3
    This answer appears to be conjecture, rather than facts, and purchasing a computer for cash has nothing to do with the question. – fixer1234 Dec 16 '14 at 18:31
  • 1
    The same way I know websites aren't executing format C: or download virus.exe on my PC – qasdfdsaq Nov 11 '16 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.