Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've got a list of hundreds of page requests from the same IP and I need to know if these could be requests by different computers.

share|improve this question
15  
Look into "NAT". If an entire university goes out through one public IP, all those clients will appear to you as one IP address. –  Sirex Aug 31 '11 at 14:15
21  
as an aside, this is why using the IP address as an identifier for a client ip is often a really bad idea :-) –  Sirex Aug 31 '11 at 14:26
2  
RE: The 12-hour ban hit large numbers of people in the country because all web traffic in Qatar is routed through a single net address. news.bbc.co.uk/2/hi/technology/6224677.stm –  Boris Treukhov Sep 1 '11 at 12:34
1  
as an aside, this is also why NAT is a really bad idea –  b0fh Sep 1 '11 at 14:23
2  
@b0fh: Actually, that depends on your situation - if you had, say, a finite address space (e.g. 2^8 addresses), a larger number of simultaneously connected devices (e.g. 2^16), and no usable alternative (all of which would not be an unlikely scenario for an ISP in the late 1990s), NAT would fit the bill quite nicely. –  Piskvor Sep 2 '11 at 13:24

7 Answers 7

up vote 56 down vote accepted

There is no limit to the number of computers, however there is a limit to the number of simultaneous connections because of the possibility of ephemeral port exhaustion. More computers usually means more connections so there is a practical limit to how many computers will typically share the same IP address. Usually with a very large number of computers, multiple IP addresses will be shared in a pool to be used for NAT.

share|improve this answer
23  
+1 for the spectre of port exhaustion (too often overlooked when NATing) –  voretaq7 Aug 31 '11 at 16:19
8  
+1 for making me imagine a really boring Mass Effect. "Now that you're a Spectre, go reroute all outgoing ports in tower 3 in the Citadel to tower 2, with minimal latency, please." –  Sold Out Activist Aug 31 '11 at 20:14
    
Does this mean that it's unlikely to have like 5 identical requests from different "same IP" computers in one second? –  Emanuil Rusev Sep 1 '11 at 15:05
3  
@Emanuil Rusev No. There are 65,536 ports, so the NAT router can allow 65,536 connections from 65,536 different computers at the same time. In theory, that's only to a particular IP address; they could have another 65,536 computers using those ports to connect to another IP address. In sum, if you got 100,000 requests from the same IP, then they are probably from less than 100,000 computers. But you can't say much more than that. –  Richard Gadsden Sep 1 '11 at 15:18

There can be any number of computers on a LAN (Ya! It may depend on the physical medium used between them i.e. cables, repeaters etc.), normally there is a single Gateway (at least one is must) to connect to the Internet. These Gateways normally have multiple IPs (both private and public) for the communication.

Now as the LAN can inturn be set of LANs... figuring out the correct client is a herculean task if not impossible... Though u can still get to that by looking to the routing tables of Gateway or by accessing NAT. . .This Link may help

Most of the times public IP is used by ISPs and Large or Mid size Organizations... That is why using client IP is not considered a wise idea now a days.

share|improve this answer

Even better, you could have a single computer behind a corporate gateway use a different IP on each hit, because of a load-balancing reverse proxy. Don't use IP as identifier. Just don't.

share|improve this answer
    
Alternative solutions? –  Pacerier Jun 14 '12 at 17:22
    
alternative solutions? make people login or otherwise identify themselves if uniquely identifying visitors is important. or use anonymous cookies (and even that identifies only the browser session , and not the user - some people routinely clear their cookies between sessions or configure their browser to do so automatically. similarly, some peope do unsavoury/unhgienic things like sharing computers and login accounts). IP address-based "identity" is about as accurate as matching a person in a city of thousands or even millions knowing nothing about them but their hair-colour. –  cas Jun 25 '12 at 2:58
    
of course "make people login" requires that there is enough value TO THE USER in your site that is worth the bother and potential privacy risk to do so. –  cas Jun 25 '12 at 2:59

Besides NAT, they could be behind a proxy. if the proxy is nice to you, you might find more informations in the HTTP-Headers of the requests. Look for X-Forwarded-For headers, which might help you to get closer to your real usercount.

share|improve this answer

Of course they can.

If you're on a network and you have 1 public IP address, each page request (even if it comes from different computers) still comes from the same IP address.

share|improve this answer

It's fairly typical for an ISP to give a customer just one IP address. In order for a router to allow multiple users on a private network to utilize this address it uses NAT (Network Address Translation).

share|improve this answer
3  
My ISP doubles down on this effect by giving me one IP address which itself is blatantly, clearly run through NAT. So my connections actually go through two translations. –  jprete Aug 31 '11 at 20:59
    
See faqs.org/rfcs/rfc5684.html for more horror NAT scenario's. –  MSalters Sep 1 '11 at 13:24

As many as can dance on the head of a pin - Or more accurately as many as an administrator wants to hide behind NAT.

share|improve this answer
27  
1,000,000 would be possible, never mind 1,000. –  Mike Scott Aug 31 '11 at 14:17
9  
Even worse - a complete wireless provider can be behind that. They typcially do not expose public IP addresses. I mean someone like Vodaphone customers can all use a small number of IP's. –  TomTom Aug 31 '11 at 16:17
6  
One mobile Internet provider in Austria hides all his phones behind one IP. Causing big trouble in some rate-limiting scenarios. –  mailq Aug 31 '11 at 16:56
2  
@mailq which one is it? –  orange80 Aug 31 '11 at 21:22
3  
@Ian Boyd: The complete identifier for a TCP session is <src ip><src port><dst ip><dst port> and with sufficient state in the NAT table, you can share either src or dst port if the other one is different. It's not usually done that way, though (thus things like "cone-shaped NAT" working most of the time). –  Vatine Sep 1 '11 at 12:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.