Ruling: IP address does not identify person

[morantis]

@joeD, I was not saying that we only 30 clients from those locations, each of those 30 employees will produce several clients each day. It comes out to a little over 85 per day.

@original request...
Let me repeat two vital things. #1 I have no reason to prove a thing to anyone #2 When this is needed to be in the course of business we are being paid to do it.

That being said, if we ran into your Cisco router and I needed the logs then I would get the needed port from the CSV on my computer for Cisco routers, grab the default SSH port and the default username and password. Then I would double click on Putty, put the clients IP address in the top field, change the port number to whatever i needed to do so, personally I follow that by altering the font to 14-pt so it is easier to read, click connect, the console windows comes up, I type in the username, hit enter, type the password, hit enter, change to the proper directory, VI the file and get the info that I need. If you are attempting to get the port number and password from me here then you did not bother to read my post.

[JoeD]

Originally Posted by morantis

@joeD, I was not saying that we only 30 clients from those locations, each of those 30 employees will produce several clients each day. It comes out to a little over 85 per day.

If that's the case, I still cannot see how you can have half a million email addresses within a 37KB file. Unless the file is firstly compressed (which you've not mentioned it been, we're just assuming so) and secondly contains an incredible amount of duplication. Which even with large numbers of repeated domains wouldn't be sufficient due to the need for unique name parts.

In addition, the 87KB apache example seems rather low unless the server is rarely used if it is indeed holding 7 years of access. The apache servers I run hold at most 30 days before their logs are rotated and compressed.

@original request...
Let me repeat two vital things. #1 I have no reason to prove a thing to anyone #2 When this is needed to be in the course of business we are being paid to do it.

We're not talking about cisco routers though, but consumer routers. Many of which don't support SSH, some of which may not even provide telnet access. Nobody is questioning your claim of getting logs out of your router (as there are routers that provide extra space for logging), but your claim of any router.

If you are attempting to get the port number and password from me here then you did not bother to read my post.

Why would I want a port number or password? Not that we'd need you to provide either since you've said they're using default user/pass (which btw is a bad idea, XSS browser exploits have been used to attack routers from within networks and allow outside attackers a foothold, attacks which only worked due to either default passwords been used, or unpatched firmware with known vulnerabilities)

Either way, that's nothing to do with the discussion of log sizes. What we asked for, was the command you ran to access the logs, which you've finally answered, you use a text editor to open the log file (e.g vi). That suggests you're not using "consumer" routers.

Most consumer routers will not have such a utility available. The two consumer routers I have don't even have telnet access, the one non-consumer router I have (bottom end and not a cisco) does have telnet (yes it's insecure ) but is not running anything that allows file system access.

Sure, you don't have to prove anything, but the claims you made taken at face value don't add up. Either you've made a mistake, we've misunderstood, or there's more to it that we're missing. The only way we can find which of those it is by asking you for more specifics. If you're not interested, fair enough.

[Ekaros]

Routers he is talking about appear to be running some flavor of Unix. As they do have file-systems and vi... Such devices with sufficient storage space are very rare for consumer market. Also log files which would have names would be huge and need lot of memory even compressed to be edited...

[Joshua.P]

I don't understand the whole deal with piracy. I mean if movies are making $209 mil in a few weeks whats the big deal?

[Ekaros]

Originally Posted by Joshua.P

I don't understand the whole deal with piracy. I mean if movies are making $209 mil in a few weeks whats the big deal?

Without piracy it would have made trillions in same time, duh!

[Joshua.P]

I know you're joking but, do actors and directors really need that big of a salary? I read somewhere I think RDJ made $50 million from the avengers. Is that really necessary, with all the poverty and bad things happening in the world. Quite frankly I think its ridiculous that people are defending the big studio companies.

[keeska]

A single router doesn't, but, 1, I was referring to the whole path that THAT router handled, that is, the destination private IP and port in the LAN, to identify a particular device

Two possible problems here. First the router would have to also log the MAC address that the IP address was assigned to. Some routesr do and some do not. Even if the router did log address assignments there is no way to prove which device was using that MAC address at that time. For example you may be able to infer that there were two devices using the same MAC address at different times but you cannot prove which one was assigned a specific IP address at a given time.

it's possible (likely I'd think) that the whole path can be put together from information stored in various device on the along the path.

This can be done for active connections. This is how criminmals are tracked. Routing is very dynamic. So the path for one active connection between two IP addresses may not be true for prior or future connections between the same IP addresses. It may be possible to reconstruct the routing table
at a particular hop in the path between two IP addresses for a given time in the past but not very likely. That information is only rarely logged. For billing purposes traffic between networks is monitored and logged but not individual IP addresses.

[Ekaros]

The beauty of Internet is one side has only take care of what happens in their area of responsibility and traffic is correctly routed inside it and to outside from it. And this is done by combining lot of individual addresses in blocks(CIDR). Also routing can't be considered constant even during connection, it can change due load-distribution.

ISP can record to which subscriber particular IP was assigned at certain time(not overly intensive operation, they don't change very often afterall). And also certain areas tend to use same IP-ranges for routing purposes. This information can be attained, but due to open WLANs the real responsible party might be impossible to find.

[plib]

Originally Posted by JoeD

Either way, that's nothing to do with the discussion of log sizes. What we asked for, was the command you ran to access the logs, which you've finally answered, you use a text editor to open the log file (e.g vi). That suggests you're not using "consumer" routers.

Most consumer routers will not have such a utility available. The two consumer routers I have don't even have telnet access, the one non-consumer router I have (bottom end and not a cisco) does have telnet (yes it's insecure ) but is not running anything that allows file system access.

I don't know if you're interested in upgrading your consumer routers but if you are I would thoroughly recommend DD-WRT. Mine is a Cisco/Linksys WRT 610N v2. I can't honestly remember what the default firmware has as I only ever loaded it once before I installed DD-WRT but I'm fairly sure it didn't have telnet, or SSH or any of the other many goodies it now runs. On top of the basic DD-WRT I was able to install Optware The Right Way which adds all sorts of capabilities of its own. Essentially the combination takes an inexpensive home router and gives it lower end commercial router capabilities which would normally cost hundreds of dollars.

As long as you're comfortable flashing third party firmware and would like the capabilities I think it's pretty much a no-brainer, though I'd strongly recommend reading the forums and wiki before doing anything with it as some of the home page version recommendations are out of date.

[morantis]

Originally Posted by JoeD

If that's the case, I still cannot see how you can have half a million email addresses within a 37KB file. Unless the file is firstly compressed (which you've not mentioned it been, we're just assuming so) and secondly contains an incredible amount of duplication. Which even with large numbers of repeated domains wouldn't be sufficient due to the need for unique name parts.

In addition, the 87KB apache example seems rather low unless the server is rarely used if it is indeed holding 7 years of access. The apache servers I run hold at most 30 days before their logs are rotated and compressed.



We're not talking about cisco routers though, but consumer routers. Many of which don't support SSH, some of which may not even provide telnet access. Nobody is questioning your claim of getting logs out of your router (as there are routers that provide extra space for logging), but your claim of any router.



Why would I want a port number or password? Not that we'd need you to provide either since you've said they're using default user/pass (which btw is a bad idea, XSS browser exploits have been used to attack routers from within networks and allow outside attackers a foothold, attacks which only worked due to either default passwords been used, or unpatched firmware with known vulnerabilities)

Either way, that's nothing to do with the discussion of log sizes. What we asked for, was the command you ran to access the logs, which you've finally answered, you use a text editor to open the log file (e.g vi). That suggests you're not using "consumer" routers.

Most consumer routers will not have such a utility available. The two consumer routers I have don't even have telnet access, the one non-consumer router I have (bottom end and not a cisco) does have telnet (yes it's insecure ) but is not running anything that allows file system access.

Sure, you don't have to prove anything, but the claims you made taken at face value don't add up. Either you've made a mistake, we've misunderstood, or there's more to it that we're missing. The only way we can find which of those it is by asking you for more specifics. If you're not interested, fair enough.

I personally am talking about consumer routers, and that capabilty has been in every single one I have dealt with. The reason I mentioned the Cisco router is because Rob Lister here continues to ask how to do this with his router. This, of course, would be silly anyway because I believe he stated that he is running dd-wrt, which should have all of that built-in. Even if it does not have SSH on his dd-wrt, it doesn't matter because he completely replaced the software in the router anyway.

[morantis]

Ok, this is the absolute best that anyone could do to prove this one to you guys. This is my home computer, home router, a Linksys WNR-8200, available at Best Buy for like $30. I am enclosing 2 screenshots, the first showing Putty logged onto the router, changed to the log directory and the filesize. The second one showing, with a little discrete blurring of personal info, the vi of the same file, scrolled back to entry number one, in 2007.




There is nothing more that I can say or do, if you guys choose to not believe these things, it really alters my life not one bit.

[JoeD]

One quick point before discussing the screenshots. Whilst you're discussing non-consumer routers, the others in this post are talking about consumer routers. That is likely why there's such a disagreement about the logging capabilities as the two vary widely.

Looking at the screenshot you provide, that looks like an incoming access log, not a access log for every website you've ever visited or connections made to internet computers? I could be wrong on that, and if so have a couple of other last questions which will likely settle it, but I'll leave those for now

If that is the case, then yes, it will be very reasonable for a < 100KB file to include years worth of data since unless you're running self-hosted services, the only odd incoming connections you'd expect to see would be perhaps VNC/other remote access to your internal computers, or SSH'in in from a remote computer. (excluding UPNP) You may only access it once in a blue moon and other than the date/time of access most of the entry will be duplicated. Even without compression the size would be low.

When you vi access.log or the log.1 (which might be a rotated version of access.log), see if you can find the IP address 67.205.70.12 logged as been accessed by you today.


edit: also for what it's worth, the logs don't appear to be compressed in any way at least going by the lack of file extensions, it's possible vi could be decompressing on the fly, easiest way to tell is run

file /var/log/access.log
file /var/log/log.1

if it reports compressed or not.

If it's not then that would limit how many entries they could contain whilst remaining under 100KB. At a guess I'd say about 70 bytes per log line, in a 97KB file would around 1400 lines of logs. That would be less than 4 site visits per day for a single year, if the logs really did hold entries going back 5 years you're looking at under one web page visit per day.

To determine the number of entries, you could open log.1 (and access.log) in vi then run

:$

to skip to the end and

:set nu

to show line numbers.

or if the router has wc

wc -l /var/log/access.log
wc -l /var/log/log.1

that'll give you the number of lines in both.

One final question, if you do find the IP address I mentioned, look at what the most recent date/time for it and the oldest date/time is in both access.log and log.1

It seems likely to me though that the router is logging inbound connections to your machines, i.e "lan access from remote" rather than outbound connections to sites you visit, which is what we've been discussing in this thread with regards to the original IP identifying a person topic.

[JoeD]

Originally Posted by plib

I don't know if you're interested in upgrading your consumer routers but if you are I would thoroughly recommend

Yeah I've thought about doing it a few times. Although the two low end routers are just used as wifi extenders now. I have a draytek in place for actual routing duties.

Unfortunately, I don't think dd-wrt supports combined adsl modem/routers though, it seems more geared towards dedicated routers, of which non of mine are. It's been a while since I've looked though, should probably check it out again in case they or open-wrt have added support in the interim.

[morantis]

Originally Posted by JoeD

One quick point before discussing the screenshots. Whilst you're discussing non-consumer routers, the others in this post are talking about consumer routers. That is likely why there's such a disagreement about the logging capabilities as the two vary widely.

Looking at the screenshot you provide, that looks like an incoming access log, not a access log for every website you've ever visited or connections made to internet computers? I could be wrong on that, and if so have a couple of other last questions which will likely settle it, but I'll leave those for now

If that is the case, then yes, it will be very reasonable for a < 100KB file to include years worth of data since unless you're running self-hosted services, the only odd incoming connections you'd expect to see would be perhaps VNC/other remote access to your internal computers, or SSH'in in from a remote computer. (excluding UPNP) You may only access it once in a blue moon and other than the date/time of access most of the entry will be duplicated. Even without compression the size would be low.

When you vi access.log or the log.1 (which might be a rotated version of access.log), see if you can find the IP address 67.205.70.12 logged as been accessed by you today.


edit: also for what it's worth, the logs don't appear to be compressed in any way at least going by the lack of file extensions, it's possible vi could be decompressing on the fly, easiest way to tell is run

file /var/log/access.log
file /var/log/log.1

if it reports compressed or not.

If it's not then that would limit how many entries they could contain whilst remaining under 100KB. At a guess I'd say about 70 bytes per log line, in a 97KB file would around 1400 lines of logs. That would be less than 4 site visits per day for a single year, if the logs really did hold entries going back 5 years you're looking at under one web page visit per day.

To determine the number of entries, you could open log.1 (and access.log) in vi then run

:$

to skip to the end and

:set nu

to show line numbers.

or if the router has wc

wc -l /var/log/access.log
wc -l /var/log/log.1

that'll give you the number of lines in both.

One final question, if you do find the IP address I mentioned, look at what the most recent date/time for it and the oldest date/time is in both access.log and log.1

It seems likely to me though that the router is logging inbound connections to your machines, i.e "lan access from remote" rather than outbound connections to sites you visit, which is what we've been discussing in this thread with regards to the original IP identifying a person topic.

If you would have read my post, you would see that the router I accessed was a common Linksys consumer router. And, if you would have read the screenshot you would see the find command was used to determine the file size outside of any other program.

[JoeD]

Originally Posted by morantis

If you would have read my post, you would see that the router I accessed was a common Linksys consumer router. And, if you would have read the screenshot you would see the find command was used to determine the file size outside of any other program.

Yes I noticed both of those, in fact, that's what led to my couple of questions. How many entries does the log file have (wc -l filename) and does it contain the IP address 67.205.70.12

The "file /var/log/access.log" was just an added extra so we could settle the question of whether the logs you are looking at are using compression or not.

The reason I ask, is I believe the log file you've opened is an incoming connection log rather than an outgoing log. If you can answer those three question above it would help clear things up.