Information Shared during Network Session

[aaaaaaaaaa]

When establishing a network connection (wired / wireless), what identifiable information is shared with the network? I know that the MAC address is provided because it is used to assign an IP address. For Windows platforms, are entries such as computer name or workgroup shared?

I hope this isn't a newb question; I'll feel terrible.

 

[DreamerBrian]

Mac Address, IP address and host name are the big pieces of identifiable information shared with the network. Many other pieces of information are shared, but most of them wouldn't lead the rest of the network directly to a specific node.

Brian

 

[mbentley]

If you are just talking about connecting to any network, looking at how DHCP works will give you a good idea of the basics of what goes on. If you are talking about any other tasks, then the answer can change depending on what all is going on.

 

[aaaaaaaaaa]

+1 for the link. If the computer is on a workgroup instead of a domain, is the workgroup sent in place of the domain within the DHCP request ?

The scenario I am imagining is a DHCP client (computer) connecting to a network and requesting a DHCP lease, as well as web browsing, and performing other regular activities such as IMAP and BitTorrent traffic, and IMing.

If you are just talking about connecting to any network, looking at how DHCP works will give you a good idea of the basics of what goes on. If you are talking about any other tasks, then the answer can change depending on what all is going on.

 

[mbentley]

+1 for the link. If the computer is on a workgroup instead of a domain, is the workgroup sent in the DHCP request in place of the domain?

The scenario I am imagining is a DHCP client (computer) connecting to a network and requesting a DHCP lease, as well as web browsing, and performing other regular activities such as IMAP and BitTorrent traffic, and IMing.

When it comes to DHCP, it doesn't really matter if a computer is joined to a domain or not. However, the information that is transmitted is going to be much different as a computer joined to a domain is going to attempt to contact the domain it is a member of. Also if a computer is receiving its DHCP lease from a machine that is authorized to update DNS records on a DNS server, then your computer's information (IP, hostname) are going to be send to the DNS server to have its A records updated.

In the scenario you mentioned, the computer will be talking to a DHCP server which would provide it's mac address and be assigned an IP, both of which would be logged. As for web browsing, IP and mac address will both be communicated to the gateway (typically a network router) in order for traffic to pass to and from the network. The hostname might be communicated in any of those requests but it isn't likely that the hostname will be communicated past the router assuming you are on a private IP space as the public IPs hostname would be used in that case. Any other information is a bit dependent on the applications used.

 

[aaaaaaaaaa]

@ mbentley, do you recommend a particular source or specification to determine what information is present in network communication on a per application or traffic-type basis?

 

[mbentley]

If you want to know at a very low level of what is being sent through your network card, take a look at wireshark. That will really get you dug deep into what all is being sent. When you first look at it, it is going to be overwhelming. Using filters helps out a ton when trying to see what it being sent.