Dynamic IPs
 

Hi all, just a quick question. Hopefully someone will know the answer. :)

I have reason to believe that someone using ntl broadband is posting under two usernames on several forums, and recently discovered that the two users shared the same IP, in some cases having the same IP on the same day (but never at the same time). I use ntl broadband, so I know that your IP changes roughly every few weeks, and sometimes when you 'reboot' your modem.

I'd like to know if ntl assigns IPs randomly from a 'pool' of IPs, or if they are more regularly assigned - if so, what is the chance of two users in the same area repeatedly alternating between a single IP?

Also, do dialup and broadband customers draw from the same IP pool?

Thanks. :)

Re: Dynamic IPs
 

maybe they were posting from the same 'company' and thus had the same sort of communal IP address?

Re: Dynamic IPs
 

Generally speaking, a broadband user will always get the same IP address back again, as the system records a pairing between the user's physical MAC address, and the IP address allocated by DHCP. For so long as that pairing is retained in the system, and for so long as the user retains the same physical MAC address, the user will retain the same IP address: this state can last for months if the user is regularly online. If the user is offline for a lengthy period, and the pairing expires, and the local DHCP address pool is heavily subscribed, then eventually the IP address will be leased to another user. And after a major NTL system reconfiguration, it is likely that IP addresses might change for everyone locally.
Vanishingly small, I would think. But if both users are in one home, sharing the broadband connection behind a NAT router (e.g. students in a shared house), then they will both appear to have the same IP address, even though they are different people.
No, the pools for dialup and broadband users are distinct.

Re: Dynamic IPs
 

surely in ntls case, the proxy ip comes up when posting on forums etc

Re: Dynamic IPs
 

No that won't be the case. It is possible to set up a connection via a proxy to fool the IP tracking system but this is completely different from the use of proxies by NTL which do not prevent accurate IP logging.

It would require a degree of effort on the part of someone trying to diguise themselves by setting up such a system though and the very use of a "strange" proxy that didn't link with the registered details for the poster would make discovery of this tactic very easy AFAIK.

Just because some have been able to register multiple accounts on boards like this dosen't mean the admins are not aware. LOL

Re: Dynamic IPs
 

:)

Re: Dynamic IPs
 

It's quite possible for a forum to see the proxy IP as the real IP for the end user, it depends how clever it is in reading the HTTP headers passed out - if you don't realise that the IP you're sending the data to (proxy) can be different from the requesting IP (real end user) you can easily think the proxy is the end user.

This has happened in the past, the easiest way to check is to do a DNS lookup on the IP and see whether it is a customer IP (which end in broadband.ntl.com or cable.ntl.com for broadband customers and contain the word 'cust' to indicate a customer) or a server (which end in server.ntli.net).

Dial up and broadband IPs are assigned by different systems and thus have different pools.

Re: Dynamic IPs
 

Thanks everyone for your advice - it has been very helpful. :)

Re: Dynamic IPs
 

I am at work currently but I use this forum and so do a few of my colleagues, the ip we have is our proxy here not the fact we share ip addresses ;). I know this was mentioned before, but I am living proof of such a scenario.

Re: Dynamic IPs
 

Actually in most cases it will be the proxy address that gets logged as that will is the requesting IP. Most software is not clever enough to dig out the "requested on behalf of" headers.

The web servers log files will also normally show the proxy's IP - I know because it's a real pain when analyzing log files. :mad:

Re: Dynamic IPs
 

Yup, what pem said.

Re: Dynamic IPs
 

The distinction I was making was that the use of transparent proxies by NTL does not prevent the admins of this board from seeing the true IP's of members posting from their home PC's.

The impression given by earlier posts in the thread was that people seemed to be saying that every member arriving here using the same NTL proxy would show exactly the same IP but this is not the case. LOL

Yes it is true some sites will get confused by the NTL proxies for the reasons given just not this one or many others. It may well explain though why some sites will reject individual connections if it appears the same IP is using multiple logins because of this aspect of proxy use.

AFAIK this is what is meant by a "transparent" proxy ie it is designed not to mask the true IP because at times it is actually essential the true IP gets detected. The problem has been that this appears to not always be the case and the proxies used are not always as "transparent" as they should be.

This is just a guess though and I'm sure one of the Tech experts can provide a more detailed explanation if my guess is incorrect.

Re: Dynamic IPs
 

Hi m8

The proxy ip is usualy in the x-forwarded by header and the real ip in the x-originate header. It depends on the proxy you go through. Some will copy over the browser header and some wont.

You can see a list of the headers by goint to :- http://www.all-nettools.com/en.htm

HTH

Re: Dynamic IPs
 

Ive had problems accessing some forums through ntl proxies. I visited overclockers forums one day to find i was banned so i took winnersh 1 out and all was fine again.

Therefore the ip of these people are either a proxy ip or a ip of a shared connection. Aren't proxy ip's normally 62 for ntl? That could help u a bit more.

Re: Dynamic IPs
 

No one has suggested the fantabolous invention of nslookup e.g. if you can see the name ntl in there, its probably an ntl ip (not a guarantee)

Re: Dynamic IPs
 

I think you will find that a Transparent Proxy is one that is invisible to the client, not the server. In other words the client does not know the proxy is there - it thinks it is talking direct to the server. The server will (as posted above) generally think the request is coming from the proxy, not the client.
That is why most "what is my IP" links give the NTL proxy IP and not the client IP. (e.g. http://www.whatismyip.com/ )

Re: Dynamic IPs
 

Re: Dynamic IPs
 

Guess someone that uses the same version of vBulletin (Version 3.0.0 Beta 7) could clarify what the position is not that i'm concerned either way. LOL

All I know is that I use sites that correctly see my true IP and AFAIK this is one of them that is all I was saying.

Re: Dynamic IPs
 

Yes.

Re: Dynamic IPs
 

Maybe you are going through one of the more well behaved proxies?

I know that sometimes my IP appears as my Ip or sometimes as the proxies IP. Depends which proxy I use.

Then again, some people don't even have any proxy, transparent or forced.

Re: Dynamic IPs
 

for some reason though some "what is my IP" links give the client IP and dont detect the transparent cache at all. i.e. in all-nettools you just get the client ip and you came via and no remote addy or host.

Re: Dynamic IPs
 

yep..

Just to add - they may be going through an anonamiser - there are a number of sites that allow you to use them rather like a proxy in order to keep your real IP hidden (and most are pretty effective..) :naughty:

Re: Dynamic IPs
 

Yes, some have been written to detect if a proxy is in use and display the correct IP. hence why I said "most" rather than "all". :)

Re: Dynamic IPs
 

It is very possible as the attached image shows, but it is also possible for a forum to record the actual IP together with the proxy IP.