Suppose an attacker connects their computer with an Ethernet cable to a black box computer, which supports both TCP and UDP, over IPv4, over Ethernet. Direct connection, no switches in the loop.

The black box never initiates any communications. Its IP address is fixed.

Is there anything in these communication protocols which allows them to find out what IP address the box has, short of a brute force attack? Some binary equivalent of "Hey, what's your IP address?"? Or something more subtle, but still (ab)usable?

  • Small technicality - to connect two computers directly without a switch you will need a crossover cable, not a regular Ethernet cable. – tlng05 Jun 3 '15 at 20:55
  • you say it never initiates communications, but if it responds in any way (ie has a normal TCP stack) then you will have its MAC address and IP address. – Rory Alsop Jun 3 '15 at 21:14
  • @RoryAlsop I think the question is about how you can get it to send a response if you don't know its IP address to send it a request. – tlng05 Jun 3 '15 at 21:42
  • ...broadcast...no? – Rory Alsop Jun 3 '15 at 21:49
  • @RoryAlsop If you know of a specific type of broadcast message that the black box machine is guaranteed to respond to, I think that would be a pretty good solution. – tlng05 Jun 3 '15 at 22:09

Try a broadcast ping to, you'll need a packet capture running to catch the other IPs on the network, ping will only show the first responder (your localhost address).

If the broadcast ping is ignored or blocked (unrestricted, they can easily cause a ping flood in a network) try pinging each subnet's broadcast, as discussed here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.