On tracking forum posts via IP...

[ Follow Ups ] [ Post Followup ] [ The Iguana & Water Dragon Forum ] [ FAQ ]

Posted by Dan on April 15, 2000 at 11:21:50:

In Reply to: O/T to: Cwatbay... posted by Leslie on April 14, 2000 at 23:41:38:

My information comes from doing computer and network security for a living. Companies I've worked for include SAP America, AOL, The Associates and Progress Bank.

First, let's go over some basic "truisms" in network security on open forums.

1) If someone doesn't post their E-mail, in 100% of the cases I've worked on, it's because the person is NOT who they claim to be.

2) Proxie servers for AOL, WebTV, MSN etc. are located locally. In other words, there are a BUNCH of them, one at each local city level. In other words, if you dial into 555-1234 you will always get the same proxy server, and will always be assigned one of the same IP addresses that that proxy uses. Each proxy server is limited to 252 IP addresses. In other words, when you see these addresses, you KNOW that all the posts came from the same local city:

Entered from proxy-526.public.rwc.webtv.net at 209.240.200.106 with HTTP/1.0
Entered from proxy-526.public.rwc.webtv.net at 209.240.200.193 with HTTP/1.0
Entered from proxy-526.public.rwc.webtv.net at 209.240.200.202 with HTTP/1.0
Entered from proxy-526.public.rwc.webtv.net at 209.240.200.54 with HTTP/1.0

The "give away", incidentally, is in the IP address itself - 209 identifies it as a WebTV address. 240 identifies the region (usually the state - this is NOT standard across the board, but most companies try to use it that way so it's easier for them to locate "problem" users). 200 will identify a locallity - usually a city area. And the final 3 digit combination (the 54 is really 054 to the computer) identifies the specific machine. Now, since it's posted via proxy, that last 3 digit number can be different people at different times. What you have to figure out is what the odds of someone in the same local area, on the same internet service (webTV is a fairly small service - 400,000 users total) posting to the same forum are. It becomes ESPECIALLY suspicious when there are 3 or 4 "people" that post from the same local area, but only one of them posts a legitimate e-mail address. And by legitimate, I mean an @aol or @webtv or @msn address, hotmail doesn't count.

The odds are that they are all the same person - simply because it's not all that likely that there would be that many webTV users all posting to the same forum, saying such simpilar things. Please note that there isn't enough information to PROVE anything, but as the great Sherlock Holmes once noted, if you eliminate the impossible, then whatever is left, however improbable, must be the answer.

The absolute bottom line is this:
If you have something to say, then say it - as yourself. There's absolutely no reason to try and mask who you are, unless you are wanting to say something that you are embarrassed for people to know YOU said it - in which case, under the "if you don't have anything nice to say, then keep your mouth shut" theory, it's better to not say anything.

Dan

Follow Ups:

Thank you (more) xta 04/15/00 (1)
- Lemme clarify that 100% thing.... Dan 04/15/00 (0)
your wrong toe 04/15/00 (3)
- You're also not being intentionally inflamatory.... Dan 04/15/00 (2)
  - i was just defending myself before someone called me a fraud... toe 04/15/00 (1)
    - and if i would have read a little more carefully... toe 04/15/00 (0)

Post a Followup

Name:
E-Mail:

Subject:

Comments:
: My information comes from doing computer and network security for a living. Companies I've worked for include SAP America, AOL, The Associates and Progress Bank. : First, let's go over some basic "truisms" in network security on open forums. : 1) If someone doesn't post their E-mail, in 100% of the cases I've worked on, it's because the person is NOT who they claim to be. : 2) Proxie servers for AOL, WebTV, MSN etc. are located locally. In other words, there are a BUNCH of them, one at each local city level. In other words, if you dial into 555-1234 you will always get the same proxy server, and will always be assigned one of the same IP addresses that that proxy uses. Each proxy server is limited to 252 IP addresses. In other words, when you see these addresses, you KNOW that all the posts came from the same local city: : Entered from proxy-526.public.rwc.webtv.net at 209.240.200.106 with HTTP/1.0 : Entered from proxy-526.public.rwc.webtv.net at 209.240.200.193 with HTTP/1.0 : Entered from proxy-526.public.rwc.webtv.net at 209.240.200.202 with HTTP/1.0 : Entered from proxy-526.public.rwc.webtv.net at 209.240.200.54 with HTTP/1.0 : The "give away", incidentally, is in the IP address itself - 209 identifies it as a WebTV address. 240 identifies the region (usually the state - this is NOT standard across the board, but most companies try to use it that way so it's easier for them to locate "problem" users). 200 will identify a locallity - usually a city area. And the final 3 digit combination (the 54 is really 054 to the computer) identifies the specific machine. Now, since it's posted via proxy, that last 3 digit number can be different people at different times. What you have to figure out is what the odds of someone in the same local area, on the same internet service (webTV is a fairly small service - 400,000 users total) posting to the same forum are. It becomes ESPECIALLY suspicious when there are 3 or 4 "people" that post from the same local area, but only one of them posts a legitimate e-mail address. And by legitimate, I mean an @aol or @webtv or @msn address, hotmail doesn't count<G>. : The odds are that they are all the same person - simply because it's not all that likely that there would be that many webTV users all posting to the same forum, saying such simpilar things. Please note that there isn't enough information to PROVE anything, but as the great Sherlock Holmes once noted, if you eliminate the impossible, then whatever is left, however improbable, must be the answer. : The absolute bottom line is this: : If you have something to say, then say it - as yourself. There's absolutely no reason to try and mask who you are, unless you are wanting to say something that you are embarrassed for people to know YOU said it - in which case, under the "if you don't have anything nice to say, then keep your mouth shut" theory, it's better to not say anything. : Dan

Optional Link URL:
Link Title:
Optional Image URL:

[ Follow Ups ] [ Post Followup ] [ The Iguana & Water Dragon Forum ] [ FAQ ]