Ruling: IP address does not identify person

[plib]

Originally Posted by morantis

If you would have read my post, you would see that the router I accessed was a common Linksys consumer router. And, if you would have read the screenshot you would see the find command was used to determine the file size outside of any other program.

Can you point me to where I could find a Linksys WNR-8200? I can't find it on either the Best Buy or Linksys sites, including their support site. Sounds like a good deal for $30?

[morantis]

Originally Posted by JoeD

Yes I noticed both of those, in fact, that's what led to my couple of questions. How many entries does the log file have (wc -l filename) and does it contain the IP address 67.205.70.12

The "file /var/log/access.log" was just an added extra so we could settle the question of whether the logs you are looking at are using compression or not.

The reason I ask, is I believe the log file you've opened is an incoming connection log rather than an outgoing log. If you can answer those three question above it would help clear things up.

It is both incoming and outgoing, the first several entries are always incoming when I hook up a new router because of all the software I keep running

Oh, and as of this moment the file has 12264933 entries

[morantis]

Originally Posted by plib

Can you point me to where I could find a Linksys WNR-8200? I can't find it on either the Best Buy or Linksys sites, including their support site. Sounds like a good deal for $30?

It is no different from any of the Linksys routers that both have, just make sure you have the right band of wireless and you will be fine, also try Staples

[plib]

Originally Posted by morantis

It is no different from any of the Linksys routers that both have, just make sure you have the right band of wireless and you will be fine, also try Staples

Staples don't have it either. In fact no one Google searches and references seems to have a Linksys WNR-8200?

[JoeD]

Originally Posted by morantis

It is both incoming and outgoing, the first several entries are always incoming when I hook up a new router because of all the software I keep running

Oh, and as of this moment the file has 12264933 entries

Is it compressed? and did you find the IP I mentioned within it?

[morantis]

Originally Posted by plib

Staples don't have it either. In fact no one Google searches and references seems to have a Linksys WNR-8200?

As I said there is no reason to have this specific unit, if you want Linksys any one will be fine.

[morantis]

Originally Posted by JoeD

Is it compressed? and did you find the IP I mentioned within it?

No compression, and I had to reason to search for that IP as I know for a fact that it is both incoming and outgoing.

[plib]

Originally Posted by morantis

As I said there is no reason to have this specific unit, if you want Linksys any one will be fine.

My point is, your unit doesn't appear to exist.

[morantis]

Originally Posted by plib

My point is, your unit doesn't appear to exist.

OK. Thanks, I will let the router know.

[keeska]

That being said, if we ran into your Cisco router and I needed the logs then I would get the needed port from the CSV on my computer for Cisco routers, grab the default SSH port and the default username and password.

Sorry what port are you referring to? Cisco routers do not come with a default username or password. Nor is ssh enabled by default.

Then I would double click on Putty, put the clients IP address in the top field, change the port number to whatever i needed to do so, personally I follow that by altering the font to 14-pt so it is easier to read, click connect, the console windows comes up, I type in the username, hit enter, type the password, hit enter, change to the proper directory,

Cisco routers do not have directories for log files (In fact they usually do not have directories either.). The logs are not stored in the file system.

VI the file and get the info that I need.

This is simply ridiculous. There is no file to edit. VI doesn't run on a Cisco router. Are you even aware of the CLI for a Cisco router? I thought not.

Thank you for proving that your previous statemens are quite possibility made up. Ask someone who knows what a Cisco router is and have them show you how to access it. Maybe you will learn something.

[keeska]

Can you point me to where I could find a Linksys WNR-8200? I can't find it on either the Best Buy or Linksys sites, including their support site.

Researched - Linksys does not sell nor have they ever sold a model number wnr-8200.

[plib]

Originally Posted by keeska

Researched - Linksys does not sell nor have they ever sold a model number wnr-8200.

I know. I was trying to be gentle, but the hole just kept on being dug.

[JoeD]

Originally Posted by morantis

No compression, and I had to reason to search for that IP as I know for a fact that it is both incoming and outgoing.

It is not in any way possible for a log to contain 12 million entries uncompressed and come in with a file size of only 97KB. Average log entry of 70 bytes give or take, would result in a log of 800MB in size.

Why not search for the IP I suggested? It would take a few seconds to type

/67.205.70.12

in the command mode of VI to find it?

Although I'm not sure at this point I'd believe the accuracy of your response, but if you're not on the wind up and honestly believe you have 12 million lines worth of log entries in a 97KB file, you probably owe it to yourself to lookup the IP in the log and run "ls -lh" in the /var/log dir and "wc -l" on each of the two logs in the same dir.

[Elfwreck]

It occurs to me that the easy solution to router-history checking, regardless of the technological options, is to just replace the router every year. Sell the old one on Craigslist and inflict one's troublesome history on some unsuspecting person; potentially, buy a used one and brush off any claims of old piracy with "that's not my history at all."

Dedicated serious pirates might replace their routers twice a year, or quarterly. Or rotate them between a pool of friends. I recommend starting a rumour that routers suffer from "bit fatigue" from travelling the same paths all the time, and the software functions more efficiently if exposed to different hardware and operating systems, to encourage router-trading amongst random elements in the populace. Quick, someone design a funny graphic and release it on tumblr.

More things pirates could do to make router checking less useful for anti-piracy lawsuits:

• Suggest to college students that router-trading is romantic because it shares your history with your beloved.
• Suggest that swapping around all the routers in the dorms is a terrific prank.
• Ask to borrow routers from people going on vacation (tell 'em that yours is "getting full"); offer to lend yours when you're out of town for the weekend.
• Announce that each CPU type has a specific router that's best for it--and since the mfr's won't tell you which one that is, the only way to find out is by experimentation. Suggest that everyone swap routers around for a few months until they've figured out which one works best. Encourage this even among people using the same brand; tell them it'll sort out the different firmware versions.
• Encourage small businesses to upgrade routers often and donate the old ones to local schools. Encourage schools to send routers home with kids as upgrades to theirs.

It doesn't matter how ridiculous some (all) of these things are; what matters is that, if any of them catch on, the ability to reliably use router activity in a courtroom as proof of *anything* is gone.

[Ekaros]

Build your own router. It isn't that hard...

Just need to know quite a lot of stuff and have access to some facilities...