O'Reilly logo

Mastering Windows Network Forensics and Investigation, 2nd Edition by Scott Pearson, Ryan Johnson, Steve Bunting, Steven Anson

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Discovering IP Addresses

IP addresses are stored in the registry, which should come as no surprise by now. In fact, you can find not just the current IP address but also recently used IP configurations. They are stored in the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

Under this key, you will find many subkeys that are given GUID names. Under these GUID-named keys you will find various interface configurations for IP addresses that have been configured on the machine. They exist for either static (fixed or assigned by the network administrator) or dynamic (assigned on the fly by a DHCP server) IP addresses. You can determine which type by examining the settings for the interface.

Figure 9-57 ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required