[anti-abuse-wg] New on RIPE Labs: Reasons Dynamic Addresses Change

> ok... so first of all the address changes within DTAG and most other
german SOHO DSL providers, from what i heard back then, goes back to the
days of dialup... a couple of years ago they apparently still were
forced by law (or something) to also offer DSL on a 'charge per time
use' basis, and also disconnect virtual channels every once in a while,
something to do with anti-competition to the telephone dialup network..
which apparently is why most german dsl providers still do that.

Ah, thanks for providing the historical context for why German DSL
providers change addresses so frequently. I am skeptical, however, that
there is a law requiring German DSL providers to disconnect virtual
channels 'every once in a while' because I asked several German colleagues
about such a law and they were unable to find one (I would be delighted if
you can point me to one!).

> secondly... if your authentication and telling users apart has anything
to do with layer 3, your authentication method is just crap, not well
thought of, etc.

There are other use-cases for IP addresses as end-host identifiers that I
outlined in my post (such as counting the number of users in a system by
counting the number of distinct IP addresses). I am personally interested
in measuring outages by pinging IP addresses belonging to residential CPEs.
My premise for detecting outages is that an address that sends responses to
active probes is alive and well, and that a previously responsive address
that has stopped responding to probes could be experiencing an outage. This
premise is incorrect when I am pinging a dynamic address that has been
withdrawn from the CPE; thus, I would love to analyze dynamic reassignment
behavior across ISPs.

I agree that using IP addresses for identifying users for authentication
purposes isn't ideal but sometimes, IP addresses are the easiest way to
identify users. Other times, they are the only ways to identify users. For
example, if one is defending against a DoS attack, the most straightforward
and efficient approach is to blacklist that IP address temporarily. How
long that address can continue to remain in the blacklist is the question
that we aim to answer.

> as for wikipedia, it also leaks ips all over the place. (basically
inciting users to ddos each other,although probably a less common result
than with IRC.)

Well, wikipedia is only one example of a well-known company that employs IP
address based blacklists. In private conversation with Google and several
content-delivery networks (including one where I interned earlier this
year), I learned that IP addresses are very much a part of host-reputation
systems. So although IP addresses as end-hosts isn't ideal, it's a common
assumption and our work shows that the assumption can actually even be
valid for weeks at a time in North American ISPs.

Cheers,
Rama
http://www.cs.umd.edu/~ramapad/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20161119/0ffe4c0a/attachment.html>