YAHOO CHIEF ZONE

In most cases all that can be easily determined is who the person's ISP is and possibly the state and city they reside in.

In some cases with static IP address DSL or business DSL services the ISP provides IP allocation records to the American Registry for Internet Numbers (http://www.arin.net), the non-profit organization responsible for managing Internet numbering resources in North America.

As an example SBC used to include customer information in those allocation records, but due to privacy concerns now uses their own information with a customer reference number.

For users who want to afford themselves some additional level of anonymity we suggest you read about internet anonymity, Proxy Servers, and anonymizing services.

Try using this tool to look up your IP address.

How can someone find out who I am?

A little background first.

IP address allocation is handled by The Internet Assigned Numbers Authority (IANA). IANA in turn, delegate authority to Regional Internet Registries (RIRs). The RIRs, in turn, following their own regional policies, further delegate blocks of IP addresses to their customers, which include Internet Service Providers (ISPs) and end-user organizations.

Each of the RIRs handles a specific geographic area:

• ARIN (North America and portions of the Caribbean)
• AfriNIC (Africa)
• APNIC (Asia and the Pacific region)
• LACNIC (Latin America and portions of the Caribbean)
• RIPE (Europe, Middle East, Central Asia)

Each of these organizations allow lookups to be to that data. Different ISP's segment their blocks of IP addresses by region and you can see that in the lookup. The lookup provides the name and address of the organization the block of IP addresses was allocated to. The ISP's can name these blocks if they choose. The naming often indicates a geographic location, for example, IRV-CA, aka Irvine, California.

Here are links to the URLs where you can lookup an IP address. Be aware that if you lookup an Asian allocated IP address in a different region's RIR it will provide a link to the appropriate RIR.

• North America and portions of the Caribbean
• Africa
• Asia and the Pacific region
• Latin America and portions of the Caribbean
• Europe, Middle East, and Central Asia

In general, I start by looking up an IP address with ARIN seeing what geographic location information I can learn from the results.

From there I do a reverse DNS (rDNS) lookup to see what hostname the ISP provides. A hostname is something like www.example.com, or can be more specific to include regional information. By visiting this page you can see your own rDNS/hostname. (We'll add the functionality to lookup other IP addresses soon.) This, again, can provide some additional geographic location information.

From there I do a traceroute which displays the hostnames many of the machines in between two points on the internet. (I'm making this *really* none technical here...) Sometimes the rDNS/hostname of a specific IP address will not reveal any location but the rDNS/hostname of the machine next along the path will reveal some.

That's about all the information that can be obtained without a subpoena. In many cases people reveal small amounts of personal information about themselves on forums, chat rooms, blogs, etc that can be used to build a profile of who you might be.

Try using this tool to look up your IP address.

The explosive growth in mobile devices including mobile phones, notebook computers, and wireless handheld devices has created a need for additional blocks of IP addresses. IPv4 currently supports a maximum of approximately 4.3 billion unique IP addresses. IPv6 supports a theoretical maximum of 2128 addresses (340,282,366,920,938,463,463,374,607,431,768,211,456 to be exact!). Recent advancements in network technology including Network Address Translation (NAT) have temporarily lessened the urgency for new IP addresses, however, recent estimates indicate that IPv4 addresses could be exhausted as soon as 2012.

IPv6 and IPv4 share a similar architecture. The majority of transport layer protocols that function with IPv4 will also function with the IPv6 protocol. Most application layer protocols are expected to be interoperable with IPv6 as well, with the notable exception of File Transfer Protocol (FTP). FTP uses embedded network layer addresses to facilitate data transmission. An IPv6 address consists of eight groups of four hexadecimal digits. If a group consists of four zeros, the notation can be shortened using a colon to replace the zeros.

A main advantage of IPv6 is increased address space. The 128-bit length of IPv6 addresses is a significant gain over the 32-bit length of IPv4 addresses, allowing for an almost limitless number of unique IP addresses. The size of the IPv6 address space makes it less vulnerable to malicious activities such as IP scanning. IPv6 packets can support a larger payload than IPv4 packets resulting in increased throughput and transport efficiency.

A key enhancement over IPv4 is native support for mobile devices. IPv6 supports the Mobile IPv6 (MIPv6) protocol which enables mobile devices to switch between networks and receive a roaming notification regardless of physical location. MIPv6 is a hallmark of the protocol and was specified as a firm requirement during the design of IPv6. The IETF has separate specifications for MIPv6 that detail data structure, messaging, and security requirements.

Auto-configuration is another IPv6 enhancement that is considered a great benefit to network administrators. IPv6 devices can independently auto-configure themselves when connected with other IPv6 devices. Configuration tasks that can be carried out automatically include IP address assignment and device numbering. An IPv6 router has the ability to determine its own IPv6 address using data link layer addressing parameters. The IETF has issued RFC 2462 to set guidelines for IPv6 auto-configuration.

The IPv6 protocol improves upon IPv4 with increased authentication and privacy measures. IPSec security is embedded into the IPv6 specification to manage encryption and authentication between hosts. This built in security framework enables secure data traffic between hosts that is independent of any applications on either host. In this way, IPv6 provides an efficient end to end security framework for data transfer at the host or the network level.

The deployment of IPv6 networks is growing worldwide. Full replacement of IPv4 is expected to take some time, as it remains the most widely used Internet Protocol. The United States, China, and India are leading recent deployments of the IPv6 protocol and have large investments in IPv6 network infrastructure. The United States government has mandated that federal agencies must complete the transition to an IPv6 infrastructure no later than 2008. Software companies are also releasing operating systems that support the IPv6 standard. In 1997, IBM became the first commercial vendor to support IPv6 through its AIX 4.3 operating system. The latest version of Microsoft's Windows operating system, Windows Vista, has full IPv6 support enabled by default.

As a MAC address can be changed, it can be unwise to rely on this as a single method of authentication. IEEE 802.1x is an emerging standard better suited to authenticating devices at a low level.

Mac OS X

Under Mac OS X, the MAC address can be altered in a fashion similar to the Linux and FreeBSD methods:

sudo ifconfig en0 lladdr 00:01:02:03:04:05

or

sudo ifconfig en0 ether 00:01:02:03:04:05

This must be done as the superuser and only works for the computer's ethernet card. Instructions on spoofing AirPort Extreme (2.0) cards are available here. There are not, as of yet, any known ways to spoof original AirPort (1.0) cards.

The AirPort Extreme MAC address can also be changed easily with SpoofMac.

Windows

Under Windows XP, the MAC address can be changed in the Ethernet adapter's Properties menu, in the Advanced tab, as "MAC Address", "Locally Administered Address", "Ethernet Address" or "Network Address". The exact name depends on the Ethernet driver used; not all drivers support changing the MAC address in this way.

However, a better solution - requiring Administrative User Rights - is to pass over the System Registry Keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}. Here settings for each network interface can be found. The contents of the string value called 'NetworkAddress' will be used to set the MAC address of the adapter when next it is enabled. Resetting the adapter can be accomplished in script with the freely available command line utility devcon from Microsoft, or from the adapters context menu in the Network Connections control panel applet.

There is a nice tool to change the MAC address for all cards (even those that can't be changed through the adapter's Properties menu): SMAC MAC Address Changer

Note: to check your MAC address easily on a Windows XP box, go to Run, type CMD, then type "ipconfig /all" without quotation in the command prompt. The number under physical address is the MAC address. If multiple IP are displayed, you should look under the label "Ethernet adapter x", where x is the name of your connection (which is Local Area Connection by default).

Router

The method to change the MAC address of a router varies with the router. Not all routers have the ability to change their MAC address. The feature is often referred to as "clone MAC address". This take the MAC address of one of the machine on your network and replaces the router's existing MAC address with it. Some support the option to manually enter the MAC address.

Static IP addresses are used primarily for servers so that they don't appear to "move" while non-servers are usually assigned dynamic IP addresses. Most dynamic IP address users are users of internet service providers (ISPs) since not all the users of an ISP are online at one time and the ISPs can "get away" with not having enough IP addresses for each user.

In order to use a dynamic IP address, a service such as Dynamic Host Configuration Protocol (DHCP) is used to assign addresses dynamically to devices as they request them. If a static address is used, it must be manually programmed into parameters of the device's network interface. (It is also possible to "fake" static IP address assignments through DHCP by assigning the same IP address to a computer — and no other — each time it is requested.)

An IP address is your computer's equivalent of your postal address and just like the mail service, each computer has to have its own address so that it will only receive the information that is meant for it and not anything that is meant for someone else.

While we are used to writing out streets and house numbers on envelopes, inside your computer IP Addresses are usually represented in what is known as dotted-decimal format such as 124.62.112.7 as this is the system that is understood by computers. As you can see, the address is split into 4 sections known as “octets” and each of the four octets can be numbered from 0-255, providing a total of 4,294,967,296 potentially unique IP Addresses.

Now, while 4.2 Billion might seem like a lot, for many years large amounts of these have been allocated and used by large network such as backbone providers, ISPs and large Universities that made up the early Internet While other groups still have been reserved for special purposes and are not usable, so in practice the real amount is far less than 4.2 billion. The problem that we face today is that with many homes owning more than one computer and with cell phones, PDAs and even fridges being enabled for Internet access these days, IP Addresses are running out.

When I mentioned above that some blocks of addresses had been reserved for special purposes, one of these purposes was for private networking and it is these private addresses that help to relieve the pressure on the remaining address space and make possible many of the cable and DSL routers that people have at home today to share their Internet connection amongst many PCs.

So, what are these addresses and how do they work?

The ranges and the amount of usable IP's are as follows:

10.0.0.0 – 10.255.255.255
Addresses: 16,777,216

172.16.0.0 – 172.31.255.255
Addresses: 1,048,576

192.168.0.0 – 192.168.255.255
Addresses – 65,536

For example, if I had 6 computers that I wanted to network, I might number them from 172.16.0.1 up to 172.16.0.6 and this would still leave over a million more addresses that I could use if I were to buy some more computers or if I was networking a large office and needed lots and lots of addresses.

These blocks of addresses can be used by anyone, anywhere – even if your neighbor is using the exact same addresses this won't cause a problem. This is possible because these addresses are known as “non-Routable addresses” and the devices on the internet that move data from one place to another are specially programmed to recognize these addresses. These devices (known as routers) will recognize that these are private addresses belonging to your network and will never forward your traffic onto the Internet so for your connection to work; you will always require at least one real address from the general pool so that your home router can perform what is known as “Network Address Translation”.

NAT is a process where your router changes your private IP Address into a public one so that it can send your traffic over the Internet, keeping track of the changes in the process. When the information comes back to your router, it reverses the change back from a real IP Address into a private one and forwards the traffic back to your computer.

Private addresses and NAT is what makes your home router work and by using them, anyone is able to connect as many computer's as they wish to the Internet without having to worry about running out of addresses and this gives everyone many more years until all the available addresses are used up.

IP addresses consist of four numbers separated by periods (also called a "dotted-quad") and look something like 127.0.0.1.

Since these numbers are usually assigned to internet service providers within country-based blocks, an IP address can often be used to identify the country from which a computer is connecting to the Internet.

Because the numbers may be tedious to deal with, an IP address may also be assigned to a Host name, which is sometimes easier to remember. Hostnames may be looked up to find IP addresses, and vice-versa.

At one time ISPs issued one IP address to each user. These are called static IP addresses. Because there is a limited number of IP addresses and with increased usage of the internet ISPs now issue IP addresses in a dynamic fashion out of a pool of IP addresses (Using DHCP). These are referred to as dynamic IP addresses. This also limits the ability of the user to host websites, mail servers, ftp servers, and DNS servers. Dynamic DNS services can be used to provide DNS records for servers running on dynamic assigned IP addresses.

In addition to users connecting to the internet, with virtual hosting, a single machine can act like multiple machines (with multiple domain names and IP addresses).

An IP address can sometimes be used to determine the user's general location.

Web proxies

A common proxy application is a caching Web proxy. This provides a nearby cache of Web pages and files available on remote Web servers, allowing local network clients to access them more quickly or reliably.

When it receives a request for a Web resource (specified by a URL), a caching proxy looks for the resulting URL in its local cache. If found, it returns the document immediately. Otherwise it fetches it from the remote server, returns it to the requester and saves a copy in the cache. The cache usually uses an expiry algorithm to remove documents from the cache, according to their age, size, and access history. Two simple cache algorithms are Least Recently Used (LRU) and Least Frequently Used (LFU). LRU removes the least-recently used documents, and LFU removes the least-frequently used documents.

Web proxies can also filter the content of Web pages served. Some censorware applications — which attempt to block offensive Web content — are implemented as Web proxies. Other web proxies reformat web pages for a specific purpose or audience; for example, Skweezer reformats web pages for cell phones and PDAs. Network operators can also deploy proxies to intercept computer viruses and other hostile content served from remote Web pages.

A special case of web proxies are "CGI proxies." These are web sites which allow a user to access a site through them. They generally use PHP or CGI to implement the proxying functionality. CGI proxies are frequently used to gain access to web sites blocked by corporate or school proxies. Since they also hide the user's own IP address from the web sites they access through the proxy, they are sometimes also used to gain a degree of anonymity.

You may see references to four different types of proxy servers:

• Transparent Proxy - This type of proxy server identifies itself as a proxy server and also makes the original IP address available through the http headers. These are generally used for their ability to cache websites and do not effectively provide any anonymity to those who use them. However, the use of a transparent proxy will get you around simple IP bans. They are transparent in the terms that your IP address is exposed, not transparent in the terms that you do not know that you are using it (your system is not specifically configured to use it.)

• Anonymous Proxy - This type of proxy server identifies itself as a proxy server, but does not make the original IP address available. This type of proxy server is detectable, but provides reasonable anonymity for most users.

• Distorting Proxy - This type of proxy server identifies itself as a proxy server, but make an incorrect original IP address available through the http headers.

• High Anonymity Proxy - This type of proxy server does not identify itself as a proxy server and does not make available the original IP address.

IP Location, Map, and Details

This tool provides details about an IP address. It's estimated physical location (country, state, and city) and a map.
Lookup IP

This toll helps to determine the source IP address of an email based of the headers of the email. Also displays the estimated location on a map.
Trace Email

This tool provides a traceroute from our server to the requested IP address. This can be used to help to attempt to come up with a general location of an IP address.
Traceroute

This tool provides a mapped graphical representation of a traceroute from our server to the requested IP address.
Visual Traceroute

This tool will check to see if your IP address is listed with more than 100 DNSbl's as a machine that mail should not be accepted from.
Blacklist Check

This tool provides the hostname of an IP address. (ie 192.168.1.1)
IP to Hostname

This tool provides the IP address of a hostname (ie www.yahoo.com)
Hostname to IP address

If you are using a proxy server use this tool to check and see if any information is being exposed.
Proxy Tester