33

I've got a list of hundreds of page requests from the same IP and I need to know if these could be requests by different computers.

5
  • 15
    Look into "NAT". If an entire university goes out through one public IP, all those clients will appear to you as one IP address.
    – Sirex
    Aug 31, 2011 at 14:15
  • 23
    as an aside, this is why using the IP address as an identifier for a client ip is often a really bad idea :-)
    – Sirex
    Aug 31, 2011 at 14:26
  • 2
    RE: The 12-hour ban hit large numbers of people in the country because all web traffic in Qatar is routed through a single net address. news.bbc.co.uk/2/hi/technology/6224677.stm Sep 1, 2011 at 12:34
  • 1
    as an aside, this is also why NAT is a really bad idea
    – b0fh
    Sep 1, 2011 at 14:23
  • 3
    @b0fh: Actually, that depends on your situation - if you had, say, a finite address space (e.g. 2^8 addresses), a larger number of simultaneously connected devices (e.g. 2^16), and no usable alternative (all of which would not be an unlikely scenario for an ISP in the late 1990s), NAT would fit the bill quite nicely. Sep 2, 2011 at 13:24

7 Answers 7

59

There is no limit to the number of computers, however there is a limit to the number of simultaneous connections because of the possibility of ephemeral port exhaustion. More computers usually means more connections so there is a practical limit to how many computers will typically share the same IP address. Usually with a very large number of computers, multiple IP addresses will be shared in a pool to be used for NAT.

6
  • 24
    +1 for the spectre of port exhaustion (too often overlooked when NATing)
    – voretaq7
    Aug 31, 2011 at 16:19
  • 8
    +1 for making me imagine a really boring Mass Effect. "Now that you're a Spectre, go reroute all outgoing ports in tower 3 in the Citadel to tower 2, with minimal latency, please."
    – user93327
    Aug 31, 2011 at 20:14
  • Does this mean that it's unlikely to have like 5 identical requests from different "same IP" computers in one second? Sep 1, 2011 at 15:05
  • 4
    @Emanuil Rusev No. There are 65,536 ports, so the NAT router can allow 65,536 connections from 65,536 different computers at the same time. In theory, that's only to a particular IP address; they could have another 65,536 computers using those ports to connect to another IP address. In sum, if you got 100,000 requests from the same IP, then they are probably from less than 100,000 computers. But you can't say much more than that. Sep 1, 2011 at 15:18
  • @SoldOutActivist, ????
    – Pacerier
    Mar 11, 2017 at 2:16
55

As many as can dance on the head of a pin - Or more accurately as many as an administrator wants to hide behind NAT.

13
  • 28
    1,000,000 would be possible, never mind 1,000.
    – Mike Scott
    Aug 31, 2011 at 14:17
  • 9
    Even worse - a complete wireless provider can be behind that. They typcially do not expose public IP addresses. I mean someone like Vodaphone customers can all use a small number of IP's.
    – TomTom
    Aug 31, 2011 at 16:17
  • 6
    One mobile Internet provider in Austria hides all his phones behind one IP. Causing big trouble in some rate-limiting scenarios.
    – mailq
    Aug 31, 2011 at 16:56
  • 2
    @mailq which one is it?
    – orange80
    Aug 31, 2011 at 21:22
  • 3
    @Ian Boyd: The complete identifier for a TCP session is <src ip><src port><dst ip><dst port> and with sufficient state in the NAT table, you can share either src or dst port if the other one is different. It's not usually done that way, though (thus things like "cone-shaped NAT" working most of the time).
    – Vatine
    Sep 1, 2011 at 12:39
13

Besides NAT, they could be behind a proxy. if the proxy is nice to you, you might find more informations in the HTTP-Headers of the requests. Look for X-Forwarded-For headers, which might help you to get closer to your real usercount.

1
  • 1
    And if the proxy is particularly un-nice, the X-Forwarded-For can be faked. That can be done by any normal client too.
    – Pacerier
    Mar 11, 2017 at 2:18
13

Even better, you could have a single computer behind a corporate gateway use a different IP on each hit, because of a load-balancing reverse proxy. Don't use IP as identifier. Just don't.

5
  • Alternative solutions?
    – Pacerier
    Jun 14, 2012 at 17:22
  • alternative solutions? make people login or otherwise identify themselves if uniquely identifying visitors is important. or use anonymous cookies (and even that identifies only the browser session , and not the user - some people routinely clear their cookies between sessions or configure their browser to do so automatically. similarly, some peope do unsavoury/unhgienic things like sharing computers and login accounts). IP address-based "identity" is about as accurate as matching a person in a city of thousands or even millions knowing nothing about them but their hair-colour.
    – cas
    Jun 25, 2012 at 2:58
  • of course "make people login" requires that there is enough value TO THE USER in your site that is worth the bother and potential privacy risk to do so.
    – cas
    Jun 25, 2012 at 2:59
  • @cas "make people login" means that users subject to rate limiting on grounds of past low-quality contributions will just create a new account to evade said rate limit. Sep 11, 2017 at 20:42
  • Large networks use a pool of public addresses for NAT, not necessarily for load balancing put to avoid port exhaustion. The same client can possibly make several connections to the same destination from different public IPs.
    – Zac67
    Oct 24, 2017 at 21:09
10

It's fairly typical for an ISP to give a customer just one IP address. In order for a router to allow multiple users on a private network to utilize this address it uses NAT (Network Address Translation).

2
  • 3
    My ISP doubles down on this effect by giving me one IP address which itself is blatantly, clearly run through NAT. So my connections actually go through two translations.
    – jprete
    Aug 31, 2011 at 20:59
  • See faqs.org/rfcs/rfc5684.html for more horror NAT scenario's.
    – MSalters
    Sep 1, 2011 at 13:24
4

Of course they can.

If you're on a network and you have 1 public IP address, each page request (even if it comes from different computers) still comes from the same IP address.

1

There can be any number of computers on a LAN (It may depend on the physical medium used between them i.e. cables, repeaters etc.), normally there is a single Gateway (at least one is required) to connect to the Internet. These Gateways normally have multiple IPs (both private and public) for the communication.

Now as the LAN can inturn be set of LANs... figuring out the correct client is a herculean task if not impossible... Though you can still get to that by looking to the routing tables of Gateway or by accessing NAT...This Link may help

Most of the times public IP is used by ISPs and Large or Mid size Organizations... That is why using client IP is not considered a wise idea now a days.

1
  • How do you solve the problem of "That is why using client IP is not considered a wise idea now a days"?
    – Pacerier
    Mar 11, 2017 at 2:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .