Help translating/converting IP.

[madasaboxoffrogs]

I'm hoping that someone can help.....

 

We had an issue with our Google Drive, and reports are suggesting that the IP responsible was 2a34:c7f:142f:ad99:1234:eef:9b6b:67ca (digits changed for security purposes obviously)

Everything but this event shows a valid IP....is it encrypted or what? It's too long to be a MAC address. It's a big issue that we really need to get to the bottom of, so any help would be much appreciated.

 

Thank you.

[bald_pig]

That's an IPv6 address

[Rob_D]

Looks like an IPV6 address.

If you put the following into a command prompt

ping -a [color=#333333]2a34:c7f:142f:ad99:1234:eef:9b6b:67ca (or whatever the IP value is)

 

then it should return a network name.

 

 

[/color]

[madasaboxoffrogs]

Thanks - already tried that, says transmit error, general failure.

[brougham]

How about looking up who owns it- https://www.ultratools.com/tools/ipv6Info as you've changed it

[FN-GM]

Looks like an IPV6 address.

If you put the following into a command prompt

ping -a [color=#333333]2a34:c7f:142f:ad99:1234:eef:9b6b:67ca (or whatever the IP value is)

 

then it should return a network name.

 

 

[/color]

That will be the up of the laptop, tablet or whatever and it will be probably switched off.

[madasaboxoffrogs]

Thanks. Found that the IP that it translates to is exa networks - that's our network service provider, so I'm now assuming that someone has remoted into the system this end to do it.....not winning, and dont like it lol!

[Rob_D]

It's not just your external IP (or one of your external IPs)?

As (I assume) the google drive is externally hosted, then might would see all requests from your network as coming from that IP.

[madasaboxoffrogs]

Ok....how would I do that? Thanks.

[madasaboxoffrogs]

Ok, I've traced back to the original provider - sky, and a local area....is there a way that I can trace it further? A lot of malicious damage was done, so I really want to find the culprit!

[localzuk]

Ok, I've traced back to the original provider - sky, and a local area....is there a way that I can trace it further? A lot of malicious damage was done, so I really want to find the culprit!

If it is from an external ISP, then your only recourse is to report it to the police as a crime, and let them do the investigation.

[brougham]

I've not seen Google Drive logs before but I would hope that it would record an event such as 'User somebody logged in from 2a34:c7f:142f:ad99:1234:eef:9b6b:67ca'.

 

Some devices use privacy extensions so it changes the end part on a regular basis. You may need to look for matches for the first 64bits of the address.

[FN-GM]

You should be able to see the username used from the log?