4 ms·

And if you think VPN users are too obscure a use case to account for, a specific case I've dealt with is (1) all of AOL coming from one IP in Virginia (yes this

And if you think VPN users are too obscure a use case to account for, a specific case I've dealt with is (1) all of AOL coming from one IP in Virginia (yes this was a while ago) and (2) almost every university appearing as a single IP (on a website frequented by university students)

jgalt212 4y ago
As recently as 2006, an entire country was behind a VPN using a single public IP address. If lore can be believed... https://superuser.com/questions/1013630/why-does-qatar-use-a-single-ip-address-when-800-000-ip-addresses-are-allocated-t https://superuser.com/questions/1013630/why-does-qatar-use-a...
mike_d 4y ago
At a previous job we tracked unique visitors to prevent ad fraud. You'd find not only individual IPs with thousands of users behind them, but also larger populations of users numbering in the tens of thousands behind a small block of 8-16 IPs. The craziest was a large multinational corporation that (I guess for security?) changed their egress IP daily. The first three octets remained the same and the fourth was equal to the day of the month UTC. Really screws things up when you use a 14 day rolling window of previous traffic for comparisons.
kccqzy 4y ago
Universities do that now? When I was in college, if one connects to the visitor network they'd give you a RFC1918 address with NAT and a restrictive firewall, but if one connects to the regular network and authenticates as a student, they give you a publicly routable IP address.
- jesprenj 4y ago
  Depends on a lot of factory. The primary school I was a student at had public IPs at every computer, our national academic and research network operators are encouraging local network operators to avoid private IPs. But the high school at which I'm currently a student, has private IP addresses on every computer and a single external IPv4 for the entire facility. It's not so one sided.
  - lazide 4y ago
    Many will also push http/https proxies regardless of IP addressing schemes, so even if one user bypasses it, anyone using defaults will come from whatever the external proxy IP is.
    - ketralnis 4y ago
      I went to a community college that did transparent HTTP proxying with not just deep packet inspection but caching and "security"-oriented javascript injection. Headers would get reordered, and its parser wasn't perfect so multi-line headers would get broken sometimes. They'd inject JS into pages to scan for... something? Other injected JS? I have no idea. But it was impossible to directly connect to another server without going through their proxy even though from the TCP layer it looked like you were. Lots of difficult to debug issues.
      - lazide 4y ago
        Wow, that’s impressively evil. Right up there with the old ‘rewrite DNS traffic’ trick from ISPs. Any idea what make/model the proxy was?
        ketralnis 4y ago
        Sadly that's well beyond my memory now. It was pretty formative for me though because I learned a lot of networking and programming and unix stuff so that I could write a TCP-over-HTTP tunnel to a home server just to bypass it. So all in all, great success to be honest.
        tonyarkles 4y ago
        Oh man, an old employer had one that did the same HTTP header monkeying. I discovered it because it broke, of all things, the C2 wiki. I thought the wiki was down when sent a link to a coworker but then checked from my home machine (working remote but over Remote Desktop). And then, of course, had to figure out why it would work at home but not at work :D I believe it was FortiGate but don’t quote me on that. It also liked to drop idle TCP connections out of its routing table without sending a FIN or RST. HashiCorp Vault, at the time, only used TCP keep-alive and no additional in-band heartbeat mechanism. Naturally, the firewall dropped the idle connection earlier than the default keep-alive interval (which is long…). Additionally, packets sent to an IP-port combo that it didn’t have in its routing table were black holed, without an RST. We had this painful bug to chase where first thing every morning we could read but not write to Vault for a few minutes and then it work fine for the rest of the day without incident. I left tcpdump running overnight to see it. At night no one was using Vault… first thing in the morning, the first write goes out to the existing (still valid on both sides according to netstat) but just disappears into the ether. Takes a few minutes for the write to timeout (while spamming retries) at which point Vault closed the connection and started a new one. I just about flipped the table over. Edit: and just like that, Twitter delivers https://twitter.com/substitute/status/1597695409903714304?s=61&t=tbga53bRz5TUIvKJdK65Rw https://twitter.com/substitute/status/1597695409903714304?s=...
bigiain 4y ago
Last time I worked on a project that cared/tracked this (~4 years back), all the prepaid cellular data users from one of the big 4 telcos here ended up on CGNAT and appeared to come form a small pool of 4 IP addresses.
- mgbmtl 4y ago
  Just use IPv6, and all mobile users will have unique addresses (although they might rotate, and IP tracking is generally not very reliable, as other mentioned).

jgalt212 4y ago

As recently as 2006, an entire country was behind a VPN using a single public IP address. If lore can be believed... https://superuser.com/questions/1013630/why-does-qatar-use-a-single-ip-address-when-800-000-ip-addresses-are-allocated-t https://superuser.com/questions/1013630/why-does-qatar-use-a...

mike_d 4y ago

At a previous job we tracked unique visitors to prevent ad fraud. You'd find not only individual IPs with thousands of users behind them, but also larger populations of users numbering in the tens of thousands behind a small block of 8-16 IPs. The craziest was a large multinational corporation that (I guess for security?) changed their egress IP daily. The first three octets remained the same and the fourth was equal to the day of the month UTC. Really screws things up when you use a 14 day rolling window of previous traffic for comparisons.

kccqzy 4y ago

Universities do that now? When I was in college, if one connects to the visitor network they'd give you a RFC1918 address with NAT and a restrictive firewall, but if one connects to the regular network and authenticates as a student, they give you a publicly routable IP address.

jesprenj 4y ago
Depends on a lot of factory. The primary school I was a student at had public IPs at every computer, our national academic and research network operators are encouraging local network operators to avoid private IPs. But the high school at which I'm currently a student, has private IP addresses on every computer and a single external IPv4 for the entire facility. It's not so one sided.
- lazide 4y ago
  Many will also push http/https proxies regardless of IP addressing schemes, so even if one user bypasses it, anyone using defaults will come from whatever the external proxy IP is.
  - ketralnis 4y ago
    I went to a community college that did transparent HTTP proxying with not just deep packet inspection but caching and "security"-oriented javascript injection. Headers would get reordered, and its parser wasn't perfect so multi-line headers would get broken sometimes. They'd inject JS into pages to scan for... something? Other injected JS? I have no idea. But it was impossible to directly connect to another server without going through their proxy even though from the TCP layer it looked like you were. Lots of difficult to debug issues.
    - lazide 4y ago
      Wow, that’s impressively evil. Right up there with the old ‘rewrite DNS traffic’ trick from ISPs. Any idea what make/model the proxy was?
      - ketralnis 4y ago
        Sadly that's well beyond my memory now. It was pretty formative for me though because I learned a lot of networking and programming and unix stuff so that I could write a TCP-over-HTTP tunnel to a home server just to bypass it. So all in all, great success to be honest.
      - tonyarkles 4y ago
        Oh man, an old employer had one that did the same HTTP header monkeying. I discovered it because it broke, of all things, the C2 wiki. I thought the wiki was down when sent a link to a coworker but then checked from my home machine (working remote but over Remote Desktop). And then, of course, had to figure out why it would work at home but not at work :D I believe it was FortiGate but don’t quote me on that. It also liked to drop idle TCP connections out of its routing table without sending a FIN or RST. HashiCorp Vault, at the time, only used TCP keep-alive and no additional in-band heartbeat mechanism. Naturally, the firewall dropped the idle connection earlier than the default keep-alive interval (which is long…). Additionally, packets sent to an IP-port combo that it didn’t have in its routing table were black holed, without an RST. We had this painful bug to chase where first thing every morning we could read but not write to Vault for a few minutes and then it work fine for the rest of the day without incident. I left tcpdump running overnight to see it. At night no one was using Vault… first thing in the morning, the first write goes out to the existing (still valid on both sides according to netstat) but just disappears into the ether. Takes a few minutes for the write to timeout (while spamming retries) at which point Vault closed the connection and started a new one. I just about flipped the table over. Edit: and just like that, Twitter delivers https://twitter.com/substitute/status/1597695409903714304?s=61&t=tbga53bRz5TUIvKJdK65Rw https://twitter.com/substitute/status/1597695409903714304?s=...

bigiain 4y ago

Last time I worked on a project that cared/tracked this (~4 years back), all the prepaid cellular data users from one of the big 4 telcos here ended up on CGNAT and appeared to come form a small pool of 4 IP addresses.

mgbmtl 4y ago
Just use IPv6, and all mobile users will have unique addresses (although they might rotate, and IP tracking is generally not very reliable, as other mentioned).