Is your MAC address revealed when you hit up a website?

Question

When you hit up a site, such as cnn.com, does the TCP/IP packet contain the MAC address of your network card?

Could cnn.com theoretically record my MAC address?

Solution 1

In IPv4: Nope. They will see the MAC of the device which forwarded the packet to the server, likely their border router.

In IPv6, the 64 bit "host" part of the full 128 bit address is often automatically generated from the MAC address, and hence might be visible to the server one connects to. See also How to avoid exposing my MAC address when using IPv6?

Solution 2

Actually, the MAC address of the sender node is not part of the IP protocol packets, the IP address is. When an IP packet reaches the last 'hop', the concerned router sends an ARP request to all nodes asking for the MAC address corresponding to the recipient IP address in the headers of the packet. However, if the recipient IP address is found in the ARP cache, this step is omitted. Thus, only the recipient MAC address (unless spoofed), is part of the process, not the sender's.

Comments

[Ian Boyd]

+1 for correct answer, and bonus reminder of what mac they would see.

[gardenofwine]

@Ian Boyd & @Jonn T So where is the furthest point in the chain that my mac address would be seen? My ISP?

[shf301]

MAC addresses only exist on Ethernet networks. MAC addresses stop at your Cable/DSL modem (so your ISP could see that). Even that will only see the MAC address of what it is connected to, if that's a router it sees the MAC address of the router and not your computer's.

[Ben Voigt]

Of course this answer ignores the possibility of client-side scripts (embedded in the web page) that fetch the information locally and then upload it to the server. Getting a MAC address that way might not work on all browsers, but there's a lot of information that is available.

[kinokijuf]

Websites cannot execute arbitrary commands on the computer unless there is a security bug in the browser.

[fixer1234]

This answer appears to be conjecture, rather than facts, and purchasing a computer for cash has nothing to do with the question.

[qasdfdsaq]

The same way I know websites aren't executing format C: or download virus.exe on my PC