Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The mac address would be that of the router, I presume. But could I distinguish the ip addresses of the computers behind the router, or could I only see a global ip address that belongs to the router?

share|improve this question
The mac is thatthat of YOUR router - MAC addresses are not part of IP and do not get forwarded outside the physical segment, which normally ends at the next switch / ethernet port. SO, you do not even have a MAC address. – TomTom May 11 '12 at 10:40
up vote 4 down vote accepted

Using Scapy you can graph IP ID fields patterns to know how many distinct IP stacks are behind a NAT, but you may generally not be able to discover the IP behind the NATdevice. Here's a link to the page referencing it.

share|improve this answer
And what about dynamic ip addresses? Would scapy not be confused by that if they were completely random? – user120729 May 11 '12 at 8:58
I've updated my answer to make it more clear. – Maxwell May 11 '12 at 9:08
If the devices behind the router use a proxy, Scapy etc. will fail. If neither NAT nor a proxy is used, Scapy will not be needed, as you can identify the hosts by their IP. – Sven May 11 '12 at 9:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.