Subject: [dhcwg] question regarding dhcp

From: "mark and christie smith" <[email-masked]>
Date: Fri, 9 Nov 2001 11:52:59 -0800

Hi, I help to run an active website, which has experienced some confusion as of late. It appears that three webtv users who come to our site all have the same IP number. I spoke with someone at IANA, who tried explaining to me in laymans terms how that could occur.

As I understand it, a company which uses a DHCP server essentially assigns semi-permanent ip numbers to individuals at random. Semi-permanent in that they do change, but depending on the individual company, a person may a number that appears to be static for a period of time ranging 2 weeks to a month or sometimes more.

I was also told that two or more individuals can appear to have the same ip number, if one has enough computer savvy to cloak their ip behind someone else's. He said this is called spoofing, and is usually done only by hackers. He also said it is most often done by people using the same gateway, and that it is highly unlikely that two or more individuals from different regions of the country would have the same gateway server for a large company such as webtv or aol.

Unfortuantely he was unable to provide me with any written documentation, certainly not that a layperson could easily understand, as they do not usually deal with the general public. He suggest I research IP Spoofing and DHCP on the internet.

Could you please verify in writing, or with documentation, what I have been told?

Sincerely,
Christie Smith

---

From: "Hal F. Gottfried" <[email-masked]>
Date: Sat, 10 Nov 2001 09:23:32 -0500

Good Morning,
	I am a member of the IANA at large community and what they told you for 
the most part is correct. There is an article for the layman on IP Spoofing 
on-line at http://www.fc.net/phrack/files/p48/p48-14.html which may help 
you, as long as you understand the basics of TCP/IP.  Bear in mind though I 
don't think that these web tv users are spoofing addresses, because if that 
where the case they would not be getting responses back from the IP packets 
they send out.  I think there may be some DHCP server issues here.

	Spoofing is the creation of TCP/IP packets using somebody else's IP 
address. Routers use the "destination IP" address in order to forward 
packets through the Internet, but ignore the "source IP" address. That 
address is only used by the destination machine when it responds back to 
the source.

	"A common misconception is that "IP spoofing" can be used to hide your IP 
address while surfing the Internet, chatting on-line, sending e-mail, and 
so forth. This is generally not true. Forging the source IP address causes 
the responses to be misdirected, meaning you cannot create a normal network 
connection."  (networkice.com)

	If you would like more help with this problem, feel free to email me directly.

Hal F. Gottfried

_______________________________________________
dhcwg mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/dhcwg