AIM trace question

[Nerva]

Is it possible to trace an IM back to its source, e.g. an IP, and thus to the person?

what about emails?

 

[kylebubp]

arp -a in the command prompt, trace their IP.

In emails, get the full header and trace the sender's IP.

 

[Nerva]

Originally posted by: kylebubp
arp -a in the command prompt, trace their IP.

In emails, get the full header and trace the sender's IP.

can you be more specific?

 

[Atheus]

AIM does not connect directly to the person you are talking to, it goes through the servers. The only way to trace it is to transfer a file and get the IP with "netstat -a" or by running a packet sniffer while the transfer is in progress. You can trace an email back to the server it was sent from, but this will likely be useless, especially if it's an anonymous webmail account.

 

[Nerva]

Originally posted by: Atheus
AIM does not connect directly to the person you are talking to, it goes through the servers. The only way to trace it is to transfer a file and get the IP with "netstat -a" or by running a packet sniffer while the transfer is in progress. You can trace an email back to the server it was sent from, but this will likely be useless, especially if it's an anonymous webmail account.

so basically even if i do find out the ip address from the email or the AIM, it will be useless to me?

 

[Atheus]

Originally posted by: 3cho

Originally posted by: Atheus
AIM does not connect directly to the person you are talking to, it goes through the servers. The only way to trace it is to transfer a file and get the IP with "netstat -a" or by running a packet sniffer while the transfer is in progress. You can trace an email back to the server it was sent from, but this will likely be useless, especially if it's an anonymous webmail account.

so basically even if i do find out the ip address from the email or the AIM, it will be useless to me?

No, if you _can_ get the person's IP, you can identify them. It's just that the IP from the email will likely not be their IP, it will be the IP of the email server. If sent from gmail, it will trace to something.google.com.

You could get the person back on IM and convince them to start a file transfer (perhaps pretend to send them the info they asked for) then get the IP from that...

 

[Nerva]

Originally posted by: Atheus

Originally posted by: 3cho

Originally posted by: Atheus
AIM does not connect directly to the person you are talking to, it goes through the servers. The only way to trace it is to transfer a file and get the IP with "netstat -a" or by running a packet sniffer while the transfer is in progress. You can trace an email back to the server it was sent from, but this will likely be useless, especially if it's an anonymous webmail account.

so basically even if i do find out the ip address from the email or the AIM, it will be useless to me?

No, if you _can_ get the person's IP, you can identify them. It's just that the IP from the email will likely not be their IP, it will be the IP of the email server. If sent from gmail, it will trace to something.google.com.

You could get the person back on IM and convince them to start a file transfer (perhaps pretend to send them the info they asked for) then get the IP from that...

ok cool, i guess it's a lost cause then.