IP spoofing/altering

I'm having a bit of an argument with someone on whether or not something can be done.  Say a messageboard website is a tcp/ip connection and is statefull.  Is there a way to mask or spoof your ip on the board.  I think it can be done using a proxy server, or maybe a chain of them.  I know this is not software related, but I figured I'd throw it out here ..

grover
Monday, August 30, 2004

Yeah, it can be done using proxy servers.  Period.  I don't think there's anything that can be done to counter this.

pds
Monday, August 30, 2004

thats what i think too....The only way to stop it is to set your filter i would think to block requests from the proxy ip, but you still have to know before hand what that ip is right?  I don't know of any way to automatically determine if an ip is coming off a proxy server

grover
Monday, August 30, 2004

Well yeah, if you have access to a proxy you can use that to forward your connection on. And the IP address logged connecting to the message board will be that of the proxy.

This isn't the same as IP address spoofing, which happens on a lower packet level and isn't really much use, for protocols like HTTP anyway. Essentially, if you spoof the source IP address of a packet to something other than your own, how is the data going to get back to you? They tend to just be used for DDoS attacks and the like, I think. Most routers should stop spoofed packets escaping from their networks anyway.

Matt
Monday, August 30, 2004

Welcome to the trials and tribulations of discussion board ownership.  Do what I did and require registration to post.

muppet
Monday, August 30, 2004

Would registration effect the IP though?  I could be registered on a board, but post on it from multiple computers, so wouldn't the IP differ per computer?

grover
Monday, August 30, 2004

and on top of that, what if you went through the registration process using a proxy

grover
Monday, August 30, 2004

Hey muppet, where's your board?  I'd *really* like to know....

Dutch Boyd
Monday, August 30, 2004

+++Would registration effect the IP though?  I could be registered on a board, but post on it from multiple computers, so wouldn't the IP differ per computer?+++

So?  I'm assuming that you're using IP as a means of identification of a particular user (in particular, an abusive user?).  If you require registration and moderator activation, it's all the same.  Now you identify people by account, which they must log into in order to use your board.  If you require that an account be activated by a moderator, then they can't just register again and again to defeat bans.

muppet
Monday, August 30, 2004

And whats your criteria for allowing/disallowing a registration?

www.MarkTAW.com
Monday, August 30, 2004

well, since in my case it's a private site with no commercial interest, my criteria is pretty much that those who I know from other sources and who I know will not be deliberately disruptive to the community are allowed to post.  In the case of my site it's pretty much a "you've got to know somebody" sort of private club.

Now, I'm working on some public sites where that won't be the case, but they're not yet ready.  I haven't finished working out the details of registering for those, yet.

muppet
Monday, August 30, 2004

http://forum.madebymonkeys.net/ is muppets AFAIK

Some jerk
Monday, August 30, 2004

I changed my mind. Any muppet site would just be dumb.

Dutch Boyd
Monday, August 30, 2004

Muppet has been forthcoming from hte very beginning about his board and has posted several times here about his process of developing it. It's no secret.

Sapporo
Monday, August 30, 2004

Why am I not suprised there are no registered users at muppet's forum...

Bob
Monday, August 30, 2004

That's a test forum, for another project.  The actual forum is at http://forums.madebymonkeys.net

muppet
Monday, August 30, 2004

also, that particular forum is no longer under development.  I've got a completely new CMS in the works in between various other offline projects.  The forum at that URL was written 5 years ago as my learning project for Perl, and it shows.  :-)

muppet
Monday, August 30, 2004

  Recent Topics

  Fog Creek Home