how to find a computer on the internet?

February 24, 2006 11:26 PM

Can a stolen computer be identified and maybe located over the internet from its network adapter MAC address?

Our Apple Powerbook was stolen a couple of days ago. Is there any after-the-fact way to track it from its MAC address? (I've heard of a Mac equivalent of LoJack, but it wasn't installed before the theft ... next time ...)

posted by anadem to computers & internet (12 answers total)

In general, no. The MAC address is only really used on the local network; once traffic goes out to the Internet at large, it's the IP adress that's important.

Maybe you'd be able to do this in some really contrived situation, but it's tough to imagine.
posted by xil at 11:33 PM on February 24, 2006

No.
posted by delmoi at 12:24 AM on February 25, 2006

Here is what's in the headers for IPv4, IPv6, TCP, and UDP. Since this is what the gateway for any local network passes out to the world, and MAC address is not a field in it, you're out of luck. Sorry about your Powerbook.
posted by Ryvar at 1:26 AM on February 25, 2006

Requisite stolen Mac advice: inform Apple ASAP. There have been a number of cases where people have been reunited with their laptops because they a) reported the serial number as stolen and b) lucked into a thief stupid enough to send the laptop in for servicing/bring it to an Apple Store.
posted by chrominance at 1:55 AM on February 25, 2006

You can't find it over the internet. But, if you work for a large organization like a college or government that has wireless, they might look to see if the MAC address connected to their network. It's been done before. I would report to your local police and your local admin and see what they can do.
posted by about_time at 3:45 AM on February 25, 2006

Sorry about the theft. That sucks. No help now, but for next time, see this and this.
posted by nakedcodemonkey at 9:10 AM on February 25, 2006

I don't know whether this is at all feasible, but at least in theory, you may be able to trace the loction of the laptop with the cooperation of a major search engine company.

Most search engines (Google, MSN, Yahoo, etc) put a uniquely identifiable cookie on your computer. It is possible that they could use your old IP address to find the cookie identity, and then look for requests from that cookie identity.

This will only work however, if someone used the laptop to search the internet (before wiping the hard drive, or deleting the cookies).
posted by Maxwell_Smart at 11:05 AM on February 25, 2006

The MAC address is not the magic cookie that everyone thinks it is. It's only used at the link layer, which means it's only seen by other machines on the same physical network. Once the packet goes through a gateway (e.g. your cable modem) the MAC address is replaced by the MAC address of the gateway, so for the purposes of tracking this is a useless method.

Any laptop theif of even mediocre caliber would wipe the hard drive as the very first thing they do, so I wouldn't really get my hopes up of using any identifiable information on the laptop. The serial number and watching ebay are probably the best things you can use to try to find it, but realistically, I wouldn't get my hopes up.
posted by Rhomboid at 11:24 AM on February 25, 2006

MAC addresses are part of Rogers Cable's DNS names for its end users.
posted by oaf at 1:46 PM on February 25, 2006

But those are the MAC addresses of the cable modems, not of the equipment connected to them such as PCs or laptops.
posted by Rhomboid at 2:45 PM on February 25, 2006

report it to Apple! It's not uncommon for the machine to show up at a dealer for repair.
posted by lester at 4:24 PM on February 25, 2006

... to close this out: by an amazing coincidence the machine has been found. It's being held as evidence but it should be home in a few days.

The cop to whom I reported the loss back in February was called out this weekend for a "suspicious man" who he arrested. The sm had a laptop in his car so the cop checked the serial with HQ and was told it was NOT stolen, but he decided to hold it for safe keeping. Later he remembered our loss report, checked back in his log, and saw the serial was the same. He booted it up and it came up with our names ... we're just so lucky it wasn't even wiped.

I'm too grateful for getting it back to gripe about why the HQ didn't have it on the stolen list. It was a special gift too, so extra good to get back for sentimental reasons. Very cool!

Now to do the things to keep it safe that were kindly recommended above! I've also read of a "lo-jack for macs" which might be worth investing in -- though in future I won't let it out of sight.
posted by anadem at 6:50 PM on April 4, 2006