A terrible violation

[roberson]

Mar 30, 2018 5:32:14 GMT @mcgruffthecrimedog said:

That post was meant to describe LE's limitations when it comes to tracing ip addresses. Even if you were to send LE an ip address that you deemed suspicious, LE would need enough facts to cause a judge to believe that there is probable cause that the ip address is connected to crime, in order to get a warrant they could serve on the ISP. You can resolve an ip address down to a really general geographical area and to an ISP without a warrant (anyone can do this), but not much more.

Tracert isn't really used for "tracing" the geographical location of an ip address -- the "tracing" that is done is more for technical diagnostic issues. Tracert just maps the connection going from your ip address to the ip address you're querying; it doesn't have anything to do with geography. If you did tracert on just a regular person's ip address (not a server), the first hop would likely be your router, then it would hop through some other servers associated with your ISP, then it would hop through some servers associated with the other person's ISP, and then it would just time out when it arrived at the ip address you inputed. Really no useful information would be gleaned from doing a tracert.

And Wireshark is used for monitoring packets as they cross networks, not for tracing ip addresses. That's the software that is used to "sniff" and monitor wireless traffic. It's sometimes used by the bad guys to steal info on unsecured wireless networks.

I think it's pretty clear that LE is not going to serve up warrants on IP addresses sent to them without good cause. That was the point of illuminating the vast limitations in such a scheme: that it's abundantly inadequate to provide LE with enough due cause to serve a warrant to an ISP and retrieve customer records. 

And the software I had back in the day WAS much like tracert. Yes, tracert is used for diagnostics. Every tier 1 Windows tech knows that much. So is Ping and the linux and Mac equivalents. But tracert does have hops, which are essentially infrastructure locations, which of course have physical, real-world locations. Anyone can run a tracert and see this. It's not magic. It's going down the pipe to the destination. The software I had would correlate these locations to the real world placements, all against a map. So it was very much like tracert, simply more sophisticated and of course could not resolve down to individual homes. 

As for WireShark, it's a packet sniffer, true, which is sort of the point. Basically the idea is to sniff packets as they come in, looking/filtering for particular information. WireShark is also a suite of TCP/IP tools. I imagine, given it's complexity, it can probably do what the website I listed can do. I can't see why not, although I don't have use or experience with it. Regardless, that's exactly why I listed the website: to illustrate the ability of the software I once owned and might expect WireShark to provide natively. 

In any case, the entire idea is a nonstarter. Legally, technically, practically. Ethically. 



EDIT: so here's some information on using ICMP packets to tracert using WireShark:

en.wikiversity.org/wiki/Wireshark/ICMP_Trace

Not seeing that it can do what my old software did, but there was nothing special about that or that website I posted.

Hell the software I had was twenty years ago! And now you can do it HTML, Javscript and some web framework. 

Here's another graphical tracert tool:

www.monitis.com/traceroute/

Free Network Trace Test

Are you having network problems? Troubleshoot network related issues with Monitis Visual Traceroute!

Monitis visual traceroute is a free diagnostic tool that displays the path the Internet packets take across IP networks to reach a specific destination on a network. Enter the domain name, or IP address, of the web server you want to test and the tool will perform a trace route from different cities and countries around the world.

You will get a report identifying the approximate geophysical location of each hop and visualizing the route on Google maps. The easy to read report will help you detect bottlenecks, quickly track down and then solve problems.

[arlington]

I think the EAR is taking a dirt nap somewhere and not monitoring anything. But who knows.

[Deleted]

Mar 30, 2018 3:07:00 GMT drdoogie said:

I think we all notice certain posters that make us wonder. I know that I am on at least one poster's short list. (It ain't me.)

I had one poster hint around that I might be EAR . And , it’s not me either ! I was born in 1975 so the only thing besides living in Sacramento I had in common with the EAR in 1976 is we probably had the same penis size . 😆 Also , I don’t think I wore a size 9 shoe since 5th grade .

[chainsawjames]

If he’s still alive, he’s on here.

[Drifter]

The idea that the guy is lurking on the forum has been a repeated theme of posters ever since the forum was created almost 5 years ago.

We can't rule out the possibility that he's here. But there is no evidence to suggest that he is.

The forum has grown exponentially and it's just not possible to check all IP addresses of people, as they come and go. We have over two thousand members. And the number of "guests" varies daily from a thousand to over three thousand.

There are myriad technical computer problems that would confront anyone who wished to investigate IP address. Even if those tech problems could be worked out, then there would be potential legal problems with LE pursuing such a lead.

I'm afraid that proposal in the original post, while well meaning, is not terribly realistic.

Drifter

[carnage]

And not to stereotype either, but why assume even if he's alive he'd be using a computer to the degree where you'd go to online forums. My parents and in-laws computer use is minimal and they're in the same age bracket. It's news and pay for things. Again, not saying people around the age of 70 DON'T do that, but it's just as possible he could watch TV all day. He doesn't strike me as a guy to keep up on the latest tech trends.

[trabuco]

Only ip addresses where efforts are made to hide, disguise, etc. If that is possible.

[socialassassin]

McGruff you are always a wealth of knowledge and information, thank you for sharing your knowledge and explaining in a way that everyone can understand. Much appreciated.

[chainsawjames]

He probably started this forum lol.