Composr Tutorial: Using IP addresses to trace users

If you find there is malicious activity on your website, you may feel the need to try and trace this activity back to a real world source, or the very least, to identify a troublesome computer.

This tutorial focuses on IP addresses. A member-focused view is taken in the Policing a community site tutorial.

Tracing users (how IP addressing work)

To trace users, you need to identify the computer performing the malicious action: unfortunately (from this perspective), the Internet is largely anonymous and decentralised, and without any clear legal authority to turn to. To some extent, a computer on the Internet can be identified by virtue of its 'IP address' (Internet Protocol address).

An IP address is a 4 byte piece of data (typically, although the newer 6 byte standard has been forthcoming thing for many years now), represented usually in a human readable form of 4 numbers (0-255) separated by dots.

There are a number of different sources of IP addresses, however the decentralisation of the system can lead to abuse; these sources are:

• ISP (Internet service provider) assigned IP addresses, via DHCP. There is no specific pattern to these addresses. These are provided to computers when they, or their Internet router, sign on to the Internet via an ISP). This is the most usual source of IP addresses, and as these change, it can not be relied upon that a user will retain the same address for long; however, addresses usually are similar, and can be 'wildcarded' by the Composr IP ban feature. It is possible other users might at some point get that address, even though it is not very likely: if you place a ban on a wide range of addresses, such as 14.*.*.*, you are increasing the likelihood of a conflict to a dangerously high percentage, especially if an IP address belongs to a popular ISP.
• ISP (Internet service provider) assigned fixed IP addresses. Some ISPs provide these, often at additional cost. There is no specific pattern to these addresses.
• Local network IP address 10.0.*.* or 192.168.*.* type (non-routable [can't travel across the Internet] and open for anyone's local usage as it does not need to assigned by any authority, which means that something odd is happening if you find one of these).
• Localhost IP address, 127.0.0.1. If you see this, then the request came from the server, or the IP address was added to the Composr database arbitrarily by some code because the true one was not known (often importers do this).

There is a scheme for the allocation and organisation of IP addresses – they are leased in large blocks. The number of addresses in the blocks depend on what 'class' of block is being leased. This is outside the scope of this tutorial, except to make the point that IP addresses belonging to the same computer network (often, an ISP, and hence, the network being all users of that ISP from a certain roughly geographic region) share a common address prefix.

There is a major problem with identifying users by IP address, and that is one of proxy s and gateway s (also known as, NAT [network address translation]). If a network is 'behind' a server that makes Internet requests on their behalf, and relays information back using its own internal algorithms, then all users of this server may be seen under a single IP address. Composr will try and detect the 'true' IP address, based on the information available, but we cannot guarantee this will be the case. AOL is renowned for using proxy servers, and will particularly jump rapidly between IP addresses when the AOL browser is used. For the gateway case, it is more than likely that a large school, for example, would use a gateway, rather than exposing all school computers to the Internet via their own IP addresses (in this sense, a NAT/gateway is a form of firewall).

Composr tracking

Composr tracks IP addresses in a number of ways:

• When a guest makes a post on Conversr , the IP address is viewable by putting the mouse over the listed name of the guest poster (where the username of a real member usually resides). If you click it, it'll do an investigate-user operation on the IP address
• For every page view, the IP address of the page viewer is stored. This allows detection of what areas of the site a viewer has visited, and in what order
• Whenever a submission is made, the IP address is stored. The submitter banning management screen shows these IP addresses in its drop-down list

Tools

Composr provides modules (screenshots below) for working with the collected data, and settings:

• The 'Investigate user' module is the main tool for finding information about an IP address (access it from Admin Zone > Tools > Members > Investigate user)
• The 'Action Logs' module (access it from the Admin Zone > Audit > Actions logs) can be used to quickly find out information from a submit that wasn't immediately available (for example, if a user submitted something without being logged-in and hence was not identified, but if by an IP address scan, they were in fact identifiable). The module can also be used to ban or unban a submitter, based on both member (prevents the member submitting again) and IP address (prevents the IP address being used to access the site)
• The 'Banned IP addresses' (access it from Admin Zone > Security > Banned IP addresses) module can be used to enter IP addresses for banning, along with free-form notes

Note that banned IP addresses are restricted from accessing Composr from a very earlier point. If the .htaccess file is available and writable (Apache-only) then the bans are written in here so that PHP doesn't even need to initialise for a ban to be detected.

Other kinds of banning

Composr (Conversr ) does also support many other types of banning, and other punitive tools. See the Policing a community site tutorial for more information.

A closer look at the Investigate User module

See also

• Security
• Policing a community site
• Basic forum moderation
• Composr member system
• Legal and social responsibilities
• Anti-spam settings
• How the Internet actually works

Feedback

Have a suggestion? Report an issue on the tracker.