Helping people with computers... one answer at a time.

A MAC address can easily be traced for as far as it travels. The problem is a MAC address doesn't travel far enough to be useful.

I know that all computers have a unique MAC address. But how traceable are they? If my laptop gets stolen, and I know my MAC address, can I get back to it if the person stole it gets connected to internet, even after formatting the machine and thinking that it's safe to connect? Seems like this could stop laptop burglaries if that MAC address thing is traceable.

You're correct ... it could put a big dent in laptop burglaries if MAC addresses were traceable. Or it would at least increase the odds of stolen equipment being recovered.

But they're not. At least, not in any way that could help.

Let's look at why.

A MAC, for "Media Access Control" address is a unique number that's assigned to every ethernet network interface.

In theory, it's unique anyway. In theory, every network card or network interface should have its own unique MAC address that is different from every other network card on the planet.

There are two problems:

  • Occasionally, manufacturers don't ensure that they're unique, so multiple network interfaces can in fact have the same MAC address.

  • The MAC address can be set in software in many network interfaces, meaning that whatever the original MAC address, it can be overridden later.

So the uniqueness that we might want to rely ... can't be relied on.

"So the uniqueness that we might want to rely ... can't be relied on."

But that isn't really the biggest problem.

The MAC address is used by the network to identify which piece of hardware a packet of information is to be sent to. In other words, it's used only on connections from one piece of networking equipment to the next.

That means that when information leaves your computer it has your computer's MAC address, but when it arrives at your router that MAC address is removed. When the information is sent by your router further upstream to your ISP's router, it contains the MAC address of your router. When it moves from the ISPs router to another router on the internet, it contains the MAC address of the ISPs router.

And so on.

Your MAC address never makes it further than the first piece of networking equipment between you and the internet.

There are various alternative solutions that you might want to look into for stolen laptop recovery. While not all survive a reformat of the machine, many thieves actually try to connect a stolen laptop as-is in order to recover or steal the data thereon as well, at which point these tracing tools kick in.

And, of course, you'll want to make sure that the data on your laptop is secure no matter what.

Article C3635 - January 24, 2009 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

15 Comments
jyothish kumar
January 27, 2009 9:31 AM

Great.I never imagined that this is the way things actually work out .Every time i visit your site i always learn something new.

Chris
January 27, 2009 10:02 AM

What you can do is install a tool like dyndns or no-ip on your system. What they do is resolve the wan ip address of the system the software is installed on into a hostname. You can then log into your account and see the IP address last used when the software was running. This can aid law enforcement with the combination of the ISP used by the thief, to track him down. You can even run a tracert on the hostname and get a general idea where they are located by the routers the ping packets hop through.

All this is one of the many things software like Leo is talking about and law enforcement use to track down stolen computers. Chances are though, if it was a professional thief, they would have whipped the drives, software and all, making it virtually impossible.

A hostname will definitely log an IP Address the machine used to connect from so you at least get something if the machine was connected before being wiped.

amit tomer
December 29, 2009 1:16 AM

everytime u have some thing special to tell
but i still confuse why i need mac address when there ip address is still there to identify the unique host on the network at point of time
plz plz plzz
can anybody help me in finding the answer plzz
sir help in this topic

saransh
June 12, 2010 2:08 AM

hiii....

i want to know that whether the websites i visit through my laptop be traced by the company i work for, if they dont know my MAC id.

Depends on how you're connected to the internet. If it's through the company's internet connection, of course they can. If that's a company laptop, I'm guessing they can too. Safest to assume that they can.
Leo
12-Jun-2010

lew
August 16, 2010 4:58 AM

Hi, interesting... " Your MAC address never makes it further than the first piece of networking equipment between you and the internet".

I have to confess up to making an ill-advised comment on a forum post. I know that the blog is being watched by my bosses now. I want to remove the post the same way I put it on - by using my netbook on a public wifi network (free one). I think my paranoia may be just a bit overboard but I don't want them to trace the comment (or removal) back to me - free wifi safe for this purpose? Thanks

Saadhana
September 27, 2010 5:45 AM

I received a mail, which is sent from a system of network from my office. I want to know from which system it was sent.

Mark
January 23, 2011 7:33 AM

I'm studying for a middleware exam atm, reading about home gateways.
When talking about device discovery and management (DHCP) my lecture notes say "This data will be accessible to the RMS" (ISP's Remote Management System)
Does this not mean that the ISP's sytem can see what devices are connected to my network and therefore trace a stolen laptop if it's connected via one of their clients networks??

Thanks

chandra kant yadav
October 15, 2011 11:08 PM

can i trace a stolen laptop by mac adress . just like a mobile phone can be traced from its service provider mobile number by using imei number

Nope. That's actually discussed in the article you just commented on.
Leo
16-Oct-2011
Jojo
October 29, 2011 4:35 PM

I thought they could be traced. I opened 47 hushmail email accts for my students one morning at Starbucks. When we went to log into them, hushmail said they had blocked my computer (not closed the accts) in case of fraud or spam and to contact them. I did (but they never responded). I went home and tried again. That's 3 different IP addresses that hushmail knew it was my computer. I thought they'd IDed my mac address. If not, what was it.

Mark J
October 29, 2011 5:29 PM

@Jojo
If you accessed the internet through a router the MAC address of your computer would only be visible to the router

http://ask-leo.com/whats_the_difference_between_a_mac_address_and_an_ip_address.html

It possible that this blocking was accomplished through something as simple as a cookie. Try clearing your Saved Cookies and see if that helps.

This article on clearing the browser cache will show the steps needed to do that, just press Delete Cookies where it says Delete Temporary Internet Files (or Clear Cache depending on which browser you use). You might also Delete the Temporary Internet Files anyway, just in case.
http://ask-leo.com/whats_a_browser_cache_how_do_i_clear_it_and_why_would_i_want_to.html

Rutasprofavok
November 4, 2011 12:05 AM

Leo,
The MAC is changed on every router that it goes througg, noy when arrives but when is sending!
just gotta see an IP Packet between two routers.

dean
December 18, 2011 2:20 PM

could say a big corporate company with the right hardware/software access your mac address as so to identify you?

Please read the article - the MAC address never leaves your network. Unless they have access to your network somehow I don't see how they could. I suppose if they planted spyware on your machine anythign's possible.
Leo
18-Dec-2011
Rey Rey
January 20, 2012 10:43 PM

One thing that I believe is an exception to the rule is when one connects to the internet using an ISP's "Hotspot" or Wifi Network (like Xfinity, Optimum Wifi) on the road or some of those "free" connections like the ones in McDonald's, Starbucks, etc. Some of these hotspots require you to have an account and log-in first, while others are free to roam on or give you a time-limited trial. I experimented with the "free" ones (no log-in credentials needed) and realized after going to the same spot several days that my MAC address was totally traceable because obviously the ISP controls their switches and routers (I cleaned all cookies, etc so I know it was MAC-related tracing). If you actually look at the first URL once you start browsing, you will see your MAC address as identifier at the end of the URL, as a way of remembering you the next time you are on their network. Also, the "fine print" disclaimers on these connections (which no one bothers to read) explain that your MAC address is being logged. If you think about it, in theory, if a laptop was stolen and you knew your mac address and someone tried to log on one of these hotspots, the ISP should be able to identify such connection, however I'm assuming that only law-enforcement would be able to obtain such records and as Leo kindly pointed out, equipment manufacturers can't ensure that a MAC is unique...just food for thought...cheers

Ron
January 21, 2012 5:10 PM

Hello Leo,
I have a problem with one comment you made in this article. The MAC address of a networking device has nothing to do with the Media Access Control sublayer of the Data Link Layer of the OSI model. The MAC address is an identifier that is put on every networking device that is made. The MAC sublayer on the other hand deals with how data is put on the physical media.

MAC stands for Media Access Control - ref: Wikipedia.
Leo
22-Jan-2012
Ram
January 26, 2013 4:38 AM

Hi, I have MAC Address of my stolen laptop as well as Service Express code can i trace that stolen laptop by using any tools in online or any web site for know the details of my system working location(portal IDs, gmail ids, facebook, ... etc) that user using my mac id.

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.