Dynamic IPs

[Weltmeister]

Hi all, just a quick question. Hopefully someone will know the answer.

I have reason to believe that someone using ntl broadband is posting under two usernames on several forums, and recently discovered that the two users shared the same IP, in some cases having the same IP on the same day (but never at the same time). I use ntl broadband, so I know that your IP changes roughly every few weeks, and sometimes when you 'reboot' your modem.

I'd like to know if ntl assigns IPs randomly from a 'pool' of IPs, or if they are more regularly assigned - if so, what is the chance of two users in the same area repeatedly alternating between a single IP?

Also, do dialup and broadband customers draw from the same IP pool?

Thanks.

[peachey]

Originally Posted by Weltmeister

Hi all, just a quick question. Hopefully someone will know the answer.

I have reason to believe that someone using ntl broadband is posting under two usernames on several forums, and recently discovered that the two users shared the same IP, in some cases having the same IP on the same day (but never at the same time). I use ntl broadband, so I know that your IP changes roughly every few weeks, and sometimes when you 'reboot' your modem.

I'd like to know if ntl assigns IPs randomly from a 'pool' of IPs, or if they are more regularly assigned - if so, what is the chance of two users in the same area repeatedly alternating between a single IP?

Also, do dialup and broadband customers draw from the same IP pool?

Thanks.

maybe they were posting from the same 'company' and thus had the same sort of communal IP address?

[rdhw]

Originally Posted by Weltmeister

I'd like to know if ntl assigns IPs randomly from a 'pool' of IPs, or if they are more regularly assigned

Generally speaking, a broadband user will always get the same IP address back again, as the system records a pairing between the user's physical MAC address, and the IP address allocated by DHCP. For so long as that pairing is retained in the system, and for so long as the user retains the same physical MAC address, the user will retain the same IP address: this state can last for months if the user is regularly online. If the user is offline for a lengthy period, and the pairing expires, and the local DHCP address pool is heavily subscribed, then eventually the IP address will be leased to another user. And after a major NTL system reconfiguration, it is likely that IP addresses might change for everyone locally.

what is the chance of two users in the same area repeatedly alternating between a single IP?

Vanishingly small, I would think. But if both users are in one home, sharing the broadband connection behind a NAT router (e.g. students in a shared house), then they will both appear to have the same IP address, even though they are different people.

Also, do dialup and broadband customers draw from the same IP pool?

No, the pools for dialup and broadband users are distinct.

[glentoran]

surely in ntls case, the proxy ip comes up when posting on forums etc

[Sociable]

Originally Posted by glentoran

surely in ntls case, the proxy ip comes up when posting on forums etc

No that won't be the case. It is possible to set up a connection via a proxy to fool the IP tracking system but this is completely different from the use of proxies by NTL which do not prevent accurate IP logging.

It would require a degree of effort on the part of someone trying to diguise themselves by setting up such a system though and the very use of a "strange" proxy that didn't link with the registered details for the poster would make discovery of this tactic very easy AFAIK.

Just because some have been able to register multiple accounts on boards like this dosen't mean the admins are not aware. LOL

[Russ]

Originally Posted by Sociable

Just because some have been able to register multiple accounts on boards like this dosen't mean the admins are not aware. LOL

[BBKing]

It's quite possible for a forum to see the proxy IP as the real IP for the end user, it depends how clever it is in reading the HTTP headers passed out - if you don't realise that the IP you're sending the data to (proxy) can be different from the requesting IP (real end user) you can easily think the proxy is the end user.

This has happened in the past, the easiest way to check is to do a DNS lookup on the IP and see whether it is a customer IP (which end in broadband.ntl.com or cable.ntl.com for broadband customers and contain the word 'cust' to indicate a customer) or a server (which end in server.ntli.net).

Dial up and broadband IPs are assigned by different systems and thus have different pools.

[Weltmeister]

Thanks everyone for your advice - it has been very helpful.

I am at work currently but I use this forum and so do a few of my colleagues, the ip we have is our proxy here not the fact we share ip addresses . I know this was mentioned before, but I am living proof of such a scenario.

Originally Posted by Sociable

No that won't be the case. It is possible to set up a connection via a proxy to fool the IP tracking system but this is completely different from the use of proxies by NTL which do not prevent accurate IP logging.

Actually in most cases it will be the proxy address that gets logged as that will is the requesting IP. Most software is not clever enough to dig out the "requested on behalf of" headers.

The web servers log files will also normally show the proxy's IP - I know because it's a real pain when analyzing log files.

[asdf]

Yup, what pem said.

[Sociable]

The distinction I was making was that the use of transparent proxies by NTL does not prevent the admins of this board from seeing the true IP's of members posting from their home PC's.

The impression given by earlier posts in the thread was that people seemed to be saying that every member arriving here using the same NTL proxy would show exactly the same IP but this is not the case. LOL

Yes it is true some sites will get confused by the NTL proxies for the reasons given just not this one or many others. It may well explain though why some sites will reject individual connections if it appears the same IP is using multiple logins because of this aspect of proxy use.

AFAIK this is what is meant by a "transparent" proxy ie it is designed not to mask the true IP because at times it is actually essential the true IP gets detected. The problem has been that this appears to not always be the case and the proxies used are not always as "transparent" as they should be.

This is just a guess though and I'm sure one of the Tech experts can provide a more detailed explanation if my guess is incorrect.

[Stuartbe]

Originally Posted by Sociable

The distinction I was making was that the use of transparent proxies by NTL does not prevent the admins of this board from seeing the true IP's of members posting from their home PC's.

The impression given by earlier posts in the thread was that people seemed to be saying that every member arriving here using the same NTL proxy would show exactly the same IP but this is not the case. LOL

Yes it is true some sites will get confused by the NTL proxies for the reasons given just not this one or many others. It may well explain though why some sites will reject individual connections if it appears the same IP is using multiple logins because of this aspect of proxy use.

AFAIK this is what is meant by a "transparent" proxy ie it is designed not to mask the true IP because at times it is actually essential the true IP gets detected. The problem has been that this appears to not always be the case and the proxies used are not always as "transparent as they should be.

This is just a guess though and I'm sure one of the Tech experts can provide a more detailed explanation if my guess is incorrect.

Hi m8

The proxy ip is usualy in the x-forwarded by header and the real ip in the x-originate header. It depends on the proxy you go through. Some will copy over the browser header and some wont.

You can see a list of the headers by goint to :- http://www.all-nettools.com/en.htm

HTH

[Prof-x]

Ive had problems accessing some forums through ntl proxies. I visited overclockers forums one day to find i was banned so i took winnersh 1 out and all was fine again.

Therefore the ip of these people are either a proxy ip or a ip of a shared connection. Aren't proxy ip's normally 62 for ntl? That could help u a bit more.

[Mr.Moony]

No one has suggested the fantabolous invention of nslookup e.g. if you can see the name ntl in there, its probably an ntl ip (not a guarantee)