When a piece of network equipment is determined to be stolen or missing, a hardware tracing tool mounted within the network detects the distinctive hardware fingerprints of the missing hardware within Internet traffic and extracts the device's IP address to trace the location of the missing equipment. As Internet messages or data packets cross through servers containing the tracing tool, the data packets are decompiled to retrieve unique identifier indicia (hardware fingerprints), such as a computer's MAC address, for example. The extracted fingerprints are then compared with fingerprints stored in a database of missing hardware using a hashing or mapping function, and the server system is alerted to a match. The IP address of the device transmitting the matching indicia is then extracted to determine the location of the missing or stolen network hardware. In this way, a method of tracing missing network hardware is provided that does not increase the cost of network equipment or unnecessarily effect network bandwidth.