0

If you don't have a botnet and you needed to use an application with a new IP address on each page load, how would you achieve that? How many different IP addresses can a person have? What does it depend on?

Improve this question
2
  • 2
    To answer your semi-non-technical question; the average american probably has access to about 4 IPs; home net, work net, phone, SO's phone. With little effort, that number can be doubled, and with some effort, it's basically unlimited.
    – dandavis
    Commented Nov 17, 2020 at 20:50
  • 5
    What is your actual problem? This sounds a bit like an X-Y-problem, where you have jumped to the conclusion that you need to limit users based on IP...
    – vidarlo
    Commented Nov 18, 2020 at 8:16

3 Answers 3

Reset to default
6

As many as you would like. It's basically a question of paying for them. With IPv4 it's expensive, but still trivial. I can probably access a few hundred for a few dollars through a VPN provider.

With IPv6? As many as you would like - for free. I currently have a /48 (2^80 addresses) at my personal disposal...

Improve this answer
4
  • Thank you for your reply. Can I force users to use ipv4? I am very ignorant about the networking, sorry. And another thing, how does Reddit or any social site prevent users for upvoting their own posts with different IP addresses?
    – evening
    Commented Nov 17, 2020 at 20:38
  • 2
    @evening - Force users to use IPv4 by not supporting IPv6. Votes are limited by account not IP. My account cannot up-vote my own Q/A regardless of source IP.
    – phbits
    Commented Nov 17, 2020 at 20:56
  • @phbits How do you force users to use IPv4? I can't seem to find anything so far. Does it need to happen on web server level like nginx?
    – evening
    Commented Nov 17, 2020 at 21:11
  • 1
    You can have nginx only listen on an IPv4 socket. Or, don't configure your server to use IPv6 at all, or don't allow traffic through the v6 firewall.
    – multithr3at3d
    Commented Nov 18, 2020 at 4:02
5

Based on your previous question it looks you don't really need to know how many IP addresses a user can have in general. Instead you want to know how malicious users can access a publicly reachable service from many different IP addresses in order to bypass IP based rate limits. Such IP based rate limits are often enforced by services to avoid web scraping, mass generation of accounts or similar actions which violate the terms of service of the specific site.

Bypassing such IP based rate limits is typically done by using pools of proxies. With proxy pools every access to the target is routed over a proxy and the current proxy is often changed in order to avoid rate limits. Access to these pools is sometimes free for limited use or bad quality (i.e. not all proxies will work) but usually sold. These proxy pools can provide a huge amount of different IP addresses, which makes a pure IP based rate limiting unusable.

Since services often also exclude specific IP ranges like VPN or Tor exit nodes there are specific "residential proxy" pools. These residential proxies are sometimes users who are kind of willingly but maybe unknowingly provide proxy functionality by installing software like a free VPN. But these services might actually be also based on botnets, unknowingly to both the infected victim and the user of the proxy pool. For more information see Resident Evil: Understanding Residential IP Proxy as a Dark Service.

Improve this answer
2

IP address pools: As many as you want

IP addresses are managed by the IANA, which sells blocks of them to ISPs and companies. Usually, ISPs allow business customers to buy IP addresses and address blocks from them, meaning that you could buy for example a /24 subnet and get for example all IP addresses from 203.0.113.1 to 203.0.113.255. How you assign these IP addresses is all up to you. All that means is that you have the ability to assign yourself these IPs as you see fit and your ISP will route traffic for you.

But how do I change my IP address on each page load?

This is the question you're actually asking. The answer is: Use TOR. TOR allows you to change the exit node you're communicating with, giving you a fresh IP address each time.

Are there downsides to this? Yes, absolutely. Websites can easily tell that you are using TOR and can prevent you from using them if they detect your traffic is coming from a TOR exit node.

Improve this answer
12
  • 3
    With aliases, you can have one NIC and multiple IP addresses...
    – ThoriumBR
    Commented Nov 17, 2020 at 20:30
  • 1
    IANA doesn't exactly sell IP addresses. They allocate (for effectively free) them through the RIRs, but thats kind of irrelevant for IPv4 because they are exhausted. So you have to pay someone else to transfer their allocation to you. So when people talk about buying IPv4 addresses, they are paying someone else who has an allocation, not IANA.
    – user1937198
    Commented Nov 17, 2020 at 20:32
  • Its probably confusing to use the terms sell and buy to refer to both IANA address allocations, and ISP address rentals, when these are very different transactions.
    – user1937198
    Commented Nov 17, 2020 at 20:40
  • Thank you for your reply. Can I force users to use ipv4? I am very ignorant about the networking, sorry. And another thing, how does Reddit or any social site prevent users for upvoting their own posts with different IP addresses?
    – evening
    Commented Nov 17, 2020 at 20:43
  • @evening Votes are based on accounts, not IP addresses. You could create lots and lots of accounts, but it'll become very obvious that these are sockpuppets.
    – user163495
    Commented Nov 17, 2020 at 21:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .