If I have someones IP can I send them a message?

[Beamin]

Since you IP is like your phone number (that changes once in a while for home users I know) how would you go about sending them some type of notification? I know that you could possibly notify them by hacking their whole system and doing what ever you want assuming you have the skills and they have a weakness in the system, how could you just send them a message or find out what machine is on the other end?

[iampoor]

Best way to send them a direct message is to DDOS them.

PS: Dont do this

[rrinker]

 In the old days (ha) people would have Finger daemons and Netplan files that could be remotely accessed. Given the uproar over the use of master/slave in bus terminology, you can imagine how upset the SJW types would be over people Fingering others, but that's what you did with Unix. This all still exists, but I don't know if anyone actually uses it any more.

 Nowadays, even most casual home users have their machines on private non-routable IPs behind firewalls with no inbound ports open, since that's pretty much how all consumer level firewall/routers come out of the box. Now, they may not have changed the default password, but that's another story.  So actually reaching someone's machine is a lot more than just knowing an IP address.

[Halcyon]

Chances are very slim to none.

[Ampera]

The question always has to be asked:

Why

Just because something is possible doesn't mean it's worth doing.

[BradC]

Just because something is possible doesn't mean it's worth doing.

That's pretty funny coming from you

[Ampera]

Just because something is possible doesn't mean it's worth doing.

That's pretty funny coming from you

I was thinking the exact same thing, I suppose I have no ground to stand on in terms of doing thing that ought not to be done because they can be done, but I usually don't tip toe on the line of legality.

Then again, as a strange third party view from the first party, if I think it ought not to be done, perhaps it really ought not to be done.

[Leiothrix]

How do you know that an IP belongs to an individual?

At work we have 25,000 users behind one IP.  Well two actually due to the redundant link, but the point still stands.

And if it were possible to send a message you'd already know about it.  Mostly because you'd constantly be getting advertisements popping up.

[darrellg]

net send command if you are in the same workgroup on LAN or VLAN or VPN.

Not since Win XP SP2.

[Halcyon]

The other issue is if the user is using mobile internet (through their phone or tablet for example), it's not uncommon to have hundreds of users on one cell tower sharing an IPv4 address.

[james_s]

I remember joking around with the net send command by placing it in a batch file that called itself. Run that for about 20 seconds and the target would have to either click Ok about 500 times or reboot, even killing the task would allow the next to pop up.

SP2 killed the fun by shutting that down, not surprisingly spammers had discovered and started abusing it.

[TerraHertz]

I remember joking around with the net send command by placing it in a batch file that called itself. Run that for about 20 seconds and the target would have to either click Ok about 500 times or reboot, even killing the task would allow the next to pop up.

SP2 killed the fun by shutting that down, not surprisingly spammers had discovered and started abusing it.

In a more general sense, you can't send messages to IP addresses, because if there was such a feature, spammers would be onto it like flies.

Spammers are why we can't have nice things.

[Red Squirrel]

Best way to send them a direct message is to DDOS them.

PS: Dont do this

Do it in spurts of a few seconds, in morse code.  It will show up in their firewall traffic graphs and they can read it. 

[John Heath]

I remember joking around with the net send command by placing it in a batch file that called itself. Run that for about 20 seconds and the target would have to either click Ok about 500 times or reboot, even killing the task would allow the next to pop up.

SP2 killed the fun by shutting that down, not surprisingly spammers had discovered and started abusing it.

In a more general sense, you can't send messages to IP addresses, because if there was such a feature, spammers would be onto it like flies.

Spammers are why we can't have nice things.

Maybe not a message but you can ping an an IP address to see if it is alive. You can also ping with trace that will show how the ping was routed such as downtown , next main city then target. From a browser you can go to google. You can also type in the IP number of google to the top of the browser and it will go to google. Typing the raw IP saves the browser extra trouble of resolving the name google to an IP  number. With a Wifi radio setup you can plug your computer into it then from a net browser type the router's IP. This will take you to a website to set up the radio. The part that knocked my socks off is the website is not on the net. The website lives in the little wifi radio written into it's firmware. That is so cool. A website that lives in a little black box. Go figure?

[Mr. Scram]

I was thinking the exact same thing, I suppose I have no ground to stand on in terms of doing thing that ought not to be done because they can be done, but I usually don't tip toe on the line of legality.

Then again, as a strange third party view from the first party, if I think it ought not to be done, perhaps it really ought not to be done.

Using or looking at someone's IP address isn't remotely illegal in any country that I know of.

[Leiothrix]

@John Heath--

Sorry, but your message doesn't make a lot of sense.

You can ping a host and all that tells you is if something in the middle responded to an ICMP echo.  A response doesn't mean it came from the host you're after, and a lack of response doesn't mean that the host doesn't exist.

Traceroute is just a ping, it's also meaningless.

Name to IP resolution uses DNS, not google.

Browsing to a random IP may give you a web site, it may not.  The results you get are also likely to be meaningless.  A virtual host will probably give you a landing page, a lot of home internet providers will give you their page instead as well.

I'm not sure what wifi radios have to do with any of this, but they in themselves aren't web hosts.

[TerraHertz]

I'm not sure what wifi radios have to do with any of this, but they in themselves aren't web hosts.

He's talking about wifi router/cable modem user-admin page(s). The router presents them as html, ie a 'web page'.  So the router is in fact a simple web host.

[cdev]

In the old days (ha) people would have Finger daemons and Netplan files that could be remotely accessed....

Yes, I remember that. You could even tell how long it had been since someone had typed a key on their keyboard.

Nowadays, even most casual home users have their machines on private non-routable IPs behind firewalls with no inbound ports open, since that's pretty much how all consumer level firewall/routers come out of the box. Now, they may not have changed the default password, but that's another story.  So actually reaching someone's machine is a lot more than just knowing an IP address.

I think that has changed now in some contexts due to ipv6. They may be routeable using ipv6. At least that seems to be part of the reason for ipv6.

[John Heath]

@John Heath--

Sorry, but your message doesn't make a lot of sense.

You can ping a host and all that tells you is if something in the middle responded to an ICMP echo.  A response doesn't mean it came from the host you're after, and a lack of response doesn't mean that the host doesn't exist.

Traceroute is just a ping, it's also meaningless.

Name to IP resolution uses DNS, not google.

Browsing to a random IP may give you a web site, it may not.  The results you get are also likely to be meaningless.  A virtual host will probably give you a landing page, a lot of home internet providers will give you their page instead as well.

I'm not sure what wifi radios have to do with any of this, but they in themselves aren't web hosts.

The DNS is determined by your computer set up. If left at default your provider will resolve a name "www..com" down to an IP. If you set your preferred DNS to 8.8.8.8 IP then google will resolve the name to an IP. While would Google do this for free? To prevent your provider from altering your request to sell advertising known as a redirect. Google is all about purity in a search which is why they are the best search engine around. To maintain their reputation they offer free DNS at IP 8.8.8.8  to prevent potential corruption of your search. 

[Monkeh]

The DNS is determined by your computer set up. If left at default your provider will resolve a name "www..com" down to an IP. If you set your preferred DNS to 8.8.8.8 IP then google will resolve the name to an IP. While would Google do this for free? To prevent your provider from altering your request to sell advertising known as a redirect. Google is all about purity in a search which is why they are the best search engine around. To maintain their reputation they offer free DNS at IP 8.8.8.8  to prevent potential corruption of your search.

Or they just happen to have set up DNS servers for themselves and let you use them.

[Ampera]

I was thinking the exact same thing, I suppose I have no ground to stand on in terms of doing thing that ought not to be done because they can be done, but I usually don't tip toe on the line of legality.

Then again, as a strange third party view from the first party, if I think it ought not to be done, perhaps it really ought not to be done.

Using or looking at someone's IP address isn't remotely illegal in any country that I know of.

Denial of service attacks are, which is where this thread was going a few posts ago.

[Mr. Scram]

Denial of service attacks are, which is where this thread was going a few posts ago.

One guy made a joke, but I don't think anyone was seriously contemplating it. DoS attacks being illegal has little to do with IP addresses and mostly with it being a nuisance and harmful.

[Ampera]

Denial of service attacks are, which is where this thread was going a few posts ago.

One guy made a joke, but I don't think anyone was seriously contemplating it. DoS attacks being illegal has little to do with IP addresses and mostly with it being a nuisance and harmful.

I apologize. Personally I am a bit on edge after having to deal with things of these magnitudes, so my humor for these situations is a bit thin.

[IanMacdonald]

The PTR record allows you to determine the host/domain name from the IP address. For home users this may not be particularly meaningful, but for corporates it may well be their email domain. Add one of the often-used email aliases and you can try to send a message. Or, you can check any website at the domain for 'mailto' links.

A high proportion of spam arises through either domain spraying or address harvesting. The former is simply a case of identifying the domain in use (which cannot very well be secret)  and then trying enquiries, info, sales, etc until one is found that doesn't return a bounce message. What this tells you is that using predictable email addresses and returning 'user not found' messages are both bad ideas as they help the spammers to find active accounts.

The other major source of spam is addressbooks being read through malware on computers.

Exposure of email addresses to harvesting mainly arises because webdesign outfits are typically separate entities from the clients whose email addresses are put at risk by the practice. As far as the design outfits are concerned, the resulting spam is somebody else's problem so why should they worry? Mailsystem operators have been saying for years that the 'mailto' hyperlink ought to be deprecated and the functionality removed from browsers, but the W3C won't listen. Although, any email address placed on a webpage is at risk of robot collection unless it is obfuscated in some way.

Our harvesting risk checker can help with identifying vulnerable webpages. We put this together mainly to convince a few 'Harvesting Denier' website maintainers that they were responsible for their client's spam problem and needed to fix the site.

[Red Squirrel]

The funny thing about DoS attacks being illegal was best described by the mother of an Anonymous member who got busted:  It's like hitting refresh on a website a bunch of times.

Kinda silly that it's illegal, when you think about it.   But I guess it's the intent that makes it illegal.  A well orchistrated DDoS attack will take down even the most resilient web server.

[ebastler]

The funny thing about DoS attacks being illegal was best described by the mother of an Anonymous member who got busted

... who, I'm sure, is both the most impartial and most technically savvy expert to consult. 

It's like hitting refresh on a website a bunch of times.

... simultaneously on all of your 10,000 computers... 

[taydin]

All devices that are connected to the internet are behind some kind of firewall. It's either the firewall in the internet gateway (router, modem etc), or the device might be directly connected to the internet and running the firewall itself. If properly configured, the firewall will silently drop all unexpected incoming packets. From the point of view of the sender, that IP address will appear unallocated to any device and thus completely dead.

In order to send that person a message, s/he must somehow solicit that message, which means connecting to an outside service and listening for messages.

[Mr. Scram]

The funny thing about DoS attacks being illegal was best described by the mother of an Anonymous member who got busted:  It's like hitting refresh on a website a bunch of times.

Kinda silly that it's illegal, when you think about it.   But I guess it's the intent that makes it illegal.  A well orchistrated DDoS attack will take down even the most resilient web server.

It's the trouble you cause that generally makes it illegal. There are many things which are part of life when it's done moderately, but are frowned upon in large quantities. The consequences for something as simple as causing noise depends on the quantity of it. If you briefly turn up the speakers to show your friend how loud your system gets, the police isn't going to intervene. If you have a party with consistently loud music, they might fine you or even remove your equipment.

[Monkeh]

All devices that are connected to the internet are behind some kind of firewall.

hahahahaha.

[iampoor]

All devices that are connected to the internet are behind some kind of firewall.

Shodan will disagree with that statement.....

http://money.cnn.com/2013/04/08/technology/security/shodan/index.html

[Red Squirrel]

The funny thing about DoS attacks being illegal was best described by the mother of an Anonymous member who got busted

... who, I'm sure, is both the most impartial and most technically savvy expert to consult. 

That's the part that makes it funny, because she's technically not wrong.  

[taydin]

Shodan will disagree with that statement.....

http://money.cnn.com/2013/04/08/technology/security/shodan/index.html

Point taken ... A device that is intended to be used behind a firewall can certainly be directly connected to the internet, and the article does a good job explaining what will happen in that case.

[IanMacdonald]

It's hard to clearly define what constitutes most of the IT crimes. DoS is simply excessive use of a facility. With no clear limit on what is non-excessive use, at what point does the crime begin? If Google uses multiple computers to spider a site, is that DoS?

Is foisted software malware?

That's even before we get started on what constitutes spam.

In some jurisdictions it's illegal to 'harvest' email addresses from websiites. Whilst well-intentioned, this law is pointless as the harvesting is done in other jurisdictions. It has also been used as an excuse by design outfits to continue posting mailtos, therefore it may actually be counterproductive, and encourage the very thing it's trying to stop.

[Twoflower]

In case the IP address is a IPv4 most devices are not having a public IP address. That means they're behind a NAT (Network Address Translation). This behaves as a kind of Firewall by nature. The NAT-Device (usually your Router) knows which requests are send out from a local computer and can correlate the incoming answers to the device within your local LAN. For a not requested packed from the Internet the NAT-Device don't know who should receive this packet within the local LAN so it gets dropped.

The only idea to contact someone would be to identify the ISP owning the IP address-range. But you probably need a extremely good argument to get any further than that. But this depends on the country and the laws in that country. In some countries only the police with a warrant is allowed to get the next step to the user of the IP. Also keep in mind the IP changes in some countries from time to time. In Germany for example the normal end user usually gets a new IP every 24h to prevent them to run a server (including having extremely low upload rates for ADSL) Also it that address in an IPv4 it might even happen that the IP was used by several users. With IPv6 that sharing isn't happen any more (hopefully).

The Idea to send Morse code is nice, but how often do you look at your router to see if there's anything knocking? Most Routers don't even have this possibility. Not saying this isn't happen. On the last CCC congress this did actually happened to troll the CCC network team.

[cdev]

If you want people to be able to send you any particular kind of info, or engage in any kind of communication with you, look at the RFCs at http://ietf.org/rfc.html

chances are, its already been thought about by others, hashed out, and that there is an Internet governance-sanctioned way to do it and authenicate it.

That goes for messaging of any kind. 

Why reinvent the wheel?

[IanMacdonald]

On the contrary, the RFCs still advocate the use of 'mailto' links. They do now carry a warning that spam may result, but it is not prominent. Another reason why it's hard to get site designers to stop doing this, since they will invariably say, 'but the RFCs say it's OK so it must be OK...'

The issue is that many of these standards are very old, dating back to when the Internet was largely used by trusted people. When it comes to security, they are naive in the extreme. 

IPv6 is also a very old standard. IIRC it was available as an add-on for Windows 95. The problem again is that anything as old as this was almost certainly not designed with security as a priority. That means there are likely to be a fair-sized collection of nasty security gotchas lurking. Which, I suspect, is why most sysadmins don't want to use it. 

IPv4 is of course even older, but it has evolved to meet modern security needs. IPv6, like the dinosaurs, refuses to change.

[Red Squirrel]

I was surprised to learn just how old IPv6 is.  Makes you wonder why they did not just go straight to that instead of IPv4.  It was thought of practically before the internet really went mainstream.
 
I still need to setup an ipv6 lab some day, I've read up on it but don't know enough about it to actually implement it and feel comfortable.  I still don't like the lack of NAT, because I like having control of my local IP addressing space and not it being dictated by my ISP, but a fix will be to implement NPT.  Your local IPs will stay the same, just your outside ones will change, as normal, but the client prefix portion will always match up.  (at least that's how I understand it)  The nice thing is you can have multiple devices on your network listening on the same port and both will be separately accessible. 

[timb]

It's hard to clearly define what constitutes most of the IT crimes. DoS is simply excessive use of a facility. With no clear limit on what is non-excessive use, at what point does the crime begin? If Google uses multiple computers to spider a site, is that DoS?

Whether it’s criminal or not depends on intent. While the technical mechanisms behind a web spider and DDoS script might be similar, Google doesn’t have the necessary mens rea that a script kiddie controlling a botnet does.

That said, Google could still be criminally liable in some situations, for example, if their web spider had a huge security vulnerability in it (which they were aware of, but didn’t fix for whatever reason) and hackers were using it to perform DDoS attacks (which they were also aware of and did nothing to prevent). In that case it could be inferred that Google has criminal intent, based solely on the fact they knew their facilities were being used to commit a crime and made no efforts to stop it.

Here’s an interesting thought experiment:

Case 1) A 52 year old man is trading thousands of hardcore, explicit images and videos of pre-pubescent children with other pedophiles on the darknet.

Case 2) A 16 year girl in sends a topless picture of *herself* to her 18 year old boyfriend.

<Edit>
Assume both of these cases take place in a country where it is illegal to distribute sexual photographs of persons under the age of 18.
</Edit>

These two people have broken the same law. Should the girl be charged? This is why the law shouldn’t be based solely on logic. Emotion, intuition and common sense must add to the equation. Unfortunately this isn’t always the case. (In fact, Case 2 has actually happened multiple times here in the US; these teenagers have had their lives ruined because of overzealous or overreaching prosecutors.)

Edit: Added qualification to my example, because some people don’t understand the purpose of said examples.

[cdev]

We should have asked Beamer whether the person who was to receive the message wanted it. I was going on the assumption they did.

Assuming they do, they can use "TXT" messages in their domain's DNS to make any information available, as long as it is short and ASCII.

[Twoflower]

...
These two people have broken the same law.
...

I really surprised how people think that their own country laws apply to the world. Especially your second example isn't violating the laws in many countries.

[Mr. Scram]

I really surprised how people think that their own country laws apply to the world. Especially your second example isn't violating the laws in many countries.

It's very common, though some nationalities seem to be more inclined to do so than others.

[james_s]

...
These two people have broken the same law.
...

I really surprised how people think that their own country laws apply to the world. Especially your second example isn't violating the laws in many countries.

What surprises me is how pedantic some people can be at times.

He's in the US so those two people did in fact break the same law in the US where the example takes place. That doesn't mean that exact law applies to other countries, but I would bet that any country has a few laws on the books that could lead to similarly ridiculous criminal charges. The example made the point it was intended to make.

[HumbleDeer]

Now, they may not have changed the default password, but that's another story.

Ha, yes! I was able to tap off high speed wi-fi from the bank office just across the street for months until they noticed. I sent random popup messages to people on the network that were connected to the server, as.. well.. I was posing as that server. Had lots and lots of fun. :p

[timb]

...
These two people have broken the same law.
...

I really surprised how people think that their own country laws apply to the world. Especially your second example isn't violating the laws in many countries.

What surprises me is how pedantic some people can be at times.

He's in the US so those two people did in fact break the same law in the US where the example takes place. That doesn't mean that exact law applies to other countries, but I would bet that any country has a few laws on the books that could lead to similarly ridiculous criminal charges. The example made the point it was intended to make.

Thank you!  At least someone understands my point.

...
These two people have broken the same law.
...

I really surprised how people think that their own country laws apply to the world. Especially your second example isn't violating the laws in many countries.

I never said that particular law applied anywhere else. That wasn’t the point. It was simply an example intended to show that you can’t just blindly apply laws to every situation.

Just for you I edited my post to specifically point out the examples take place in a country where distributing those types of images are against the law. Even though that should be plainly obvious based on the context of said examples and the additional comments made later on about how this a real case from the
US.

Good thing there’s no law against pedantry, or you’d be doing some hard time! [emoji6]

[Twoflower]

The problem I have is that I don't have the understanding of such laws as you use as example. Yes it applies to the USA, or at least parts of it. I might be the only one here who's missing the complete set of laws of every country in the world.

I only wanted to stress the point that such examples aren't easy to understand for many people in an international forum like this. Unfortunate this kind of law isn't as universal as the physical laws.

[james_s]

All one needs to know in order to understand the example is that outside of some gray area covering non-sexual artistic or medical depictions, nude photos of someone who is under the age of 18 are considered child pornography. Creating or distributing such images is a serious crime, even when the person creating and distributing is the "victim" themselves.

Surely every developed country has some similar age threshold below which photos of that nature are not legal or socially acceptable.