Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

PHP - Identifying Individual Users Under Same Router (main IP address)

Tags:

php

Is it possible to find the IP address of (or otherwise identify) each user on the same "router" or "main IP address"?


Update, clarifying question:

Use-case: I'd like to be able to track whether each of N individual computer users on a possibly common network has landed on a page.

Currently, using other PHP IP detect snippets on S/O, this seems to only identify all N individual computers on the network as coming from the same IP address. This does not help solve the problem of identifying whether these come from different users on the same network, or if it's the same user on the network hitting the page several times.

--

Note: cookies are likely disabled.

like image 853
ina Avatar asked Mar 26 '15 01:03

ina


2 Answers

There is NO definitive way to guarantee user uniqueness on the Internet.

There is no way of telling the difference between a bot and a real user.

Given current trends in computer vision and the captcha avoidance training, it would appear that captcha's are no longer effective tools for identifying bots.

Behind any PAT(Port Address Translation) combined with NAT, the network structure hides the internal computers. There may be USERAGENT variations, specifying unique computers internally(assuming they were not faked).

But, a set of twenty computers cloned from the same OS source, and behind a PAT, will appear almost identical,the ports will be different, given the randomization of source port mappings and when compounded by the PAT translations, will still appear to an Internet web PHP server as a single computer.

Whether or not the user is the same one, the information cannot be established:

Cookies will only allow the identification of specific computers tied to specific browsers and specific users. If a user wanted to triple or quadruple... themselves, they are able to run different browsers(IE, Safari, FireFox, Chrome, and Opera) or multiple Logins on the same computer(not to mention curl, wget and the many other access methods). It still fails to distinguish single users posing as multiple ones.

There are other network factors such as Tor exit points and proxy servers that further complicate the paradigm.

Given that humans tend towards the same browsing patterns, given enough data, this could be established as a probability that the users are the same, but even this probability could never be certain.(not to mention the random bot patterns).

Logins have more of an effect on the "User Problem", if you require each user to have a verified email login, you have more of chance of a single user per login, especially if you exclude the common public email domains like hotmail.com and gmail.com and many more. Private domains are almost impossible to corroborate with distinct users. The percentages of trust increases with a well established/known private domain(mit.edu as an example).

In way of a conclusion, this goal of single user identification cannot be reasonably attained to any certainty from clients over the Internet.

There are mitigation techniques available, but, none is foolproof.

like image 175
Strom Avatar answered Oct 13 '22 01:10

Strom


Not consistently. When NAT is involved it's best to avoid relying on IP addresses as identifying a specific client; instead consider using cookies to store a session ID for each client and using that information to distinguish between hosts (or user agents) which share a single IP.

like image 37
STW Avatar answered Oct 13 '22 01:10

STW