anyone know anything about MAC address

the_prophet

Hi there, following on from a previous thread re suspension from work a few weeks back I have challenged certain data that was in my evidence particularly as on some occassions there was no body in the office to access any data and the terminals were turned off. The IT department has come up with the following explanation.... can anyone shed any light on this???
(for clarity there were 4 pc's in the office and myself and a colleague were suspended for unauthorised email access)

"the reports exchange server had contained times when the user was not in the office. This is because the report on the exchange server was using the MAC address of the PC even during the polling phase. When we ran a report from the main server we pulled off all logs for the two machines and this gave us all the activity (MAC Linked) We then stripped out the relevant data. This data though contained actual loggins and polled data logins. All of the data found is correct but it is not possible to tell which of the logins are polled and which are typed by the users, as all users log in under one PC account name"

(the managers emails we were supposed to have accessed had also desk hopped onto our terminals and even had their data configured onto mine)

there seems to be a 'we know you did it but can't prove it' thing going on now.

Any light shedding on this would be so much appreciated... cheers

Chippy_Minton

The MAC address is a number which uniquely identifies the network adapter(s) in your computer. Find out yours by clicking Start - Run - type cmd - OK. In the window that's just opened type:

ipconfig /all

The Physical Address shown is the MAC address of that network adapter.

albertross_2

did you do it?

The polling stuff sounds more like a "you've caught us out and we are on dodgy ground with these accusations" to me.

the_prophet

albertross wrote: »

did you do it?

The polling stuff sounds more like a "you've caught us out and we are on dodgy ground with these accusations" to me.

Hi Albertross, no absolutely not and I have sworn on my child's life to this effect (the highest law in the land!) I was hoping for an apology for the accusation but to be told ' we know its been done but we can't prove it' is very upsetting to me. Its not what I call being exhonerated.

the_prophet

Chippy_Minton wrote: »

The MAC address is a number which uniquely identifies the network adapter(s) in your computer. Find out yours by clicking Start - Run - type cmd - OK. In the window that's just opened type:

ipconfig /all

The Physical Address shown is the MAC address of that network adapter.

cheers for this chippy_minton I have just done ths on my home computer and i can see all the info. So if I was to do this on my terminal at work, would it be the same or a different number from my colleagues terminal??

superscaper

the_prophet wrote: »

cheers for this chippy_minton I have just done ths on my home computer and i can see all the info. So if I was to do this on my terminal at work, would it be the same or a different number from my colleagues terminal??

As chippy has said the number is unique to every network card/adapter. So every single terminal would be different.

Chippy_Minton

If by terminal, you mean a normal PC with a network card, every network card in the world has a unique address so it would be different to your colleague's terminal.

I'm not sure if that's also the case if the terminal is attached to a terminal server.

the_prophet

superscaper wrote: »

As chippy has said the number is unique to every network card/adapter. So every single terminal would be different.

thanks superscaper, so do I understand it right that if information from 2 MAC addresses went to a central server it would be possible to determine which data was specific to each terminal?? but then if a report logger requested the server for information am I right in assuming that the data would then be more difficult to interpret. What the IT department seem to be saying is that when they accessed information from the report logger it was not only accessing information from the server but from the PC's as well. Hence they can't tell what is actual and what the report logger has logged when it was polled.
This is so confusing:mad:
Just supposing my manager accessed her emails on my terminal at say 2.30pm and in the origenal evidence I was given a time of 4.58pm that an email was accessed (The terminals would be switched of and we would be out the doors by this time) would it have taken all that time for the data to have eventually got logged somewhere to be polled....
goodness thanks

Lorian

I did not see you previous post.

Here is my opinion/interpretation of what they say, and don't say. If you are going to need to interpret this information for use in an industrial tribunal or any other form of disiplinary hearing then you need to get confirmation from a local expert who will be willing to give testimony.

the_prophet wrote: »

"the reports exchange server had contained times when the user was not in the office. This is because the report on the exchange server was using the MAC address of the PC even during the polling phase.

Even though the user was not in the office automatic polling of his/her mailbox on the server was the source of some or all of the login records.

the_prophet wrote: »

"When we ran a report from the main server we pulled off all logs for the two machines and this gave us all the activity (MAC Linked) We then stripped out the relevant data. This data though contained actual loggins and polled data logins.

We can tell which PC's were accessing the server by their (psuedo) unique MAC addresses. Once again we cannot tell the difference between automatic polling of the server and user-initiated log-in events. <and by omission they are infer they don't know if anyone, let alone you, were using the machines at the time>

the_prophet wrote: »

"All of the data found is correct but it is not possible to tell which of the logins are polled and which are typed by the users, as all users log in under one PC account name"

We can't prove you did anything wrong. We can't prove you were even there.

IANAL. This is merely my intepretation from a technical point of view. I would also add that the amount of detail they supply here is pityful assuming they are trying to dismiss you.

Oh one other thing, proving a MAC address accessed something is one thing. Proving who was sat at the PC at the time (if anyone, re the polling of the mailboxes) is much more difficult.

Lorian

Sorry, I should add I don't know what previous advice you have been given, if you have been suspended etc. Assuming your job, reputation and reference are on the line here you should seek legal advice and take legal representation with you to any disciplinary meetings.

the_prophet

lorian thanks very much for this, I was under investigation for gross misconduct of email/internet access and have been asked back to work with no action whatsover. However I'm waying up whether to stay or leave and have given them every opportunity to answer my questions. There are still some outstanding which should be answered this week but this information arrived in the post today and is so jargonistic its really out a dampner on the weekend.

any further info from anyone would be most welcome many thanks