[RESOLVED] How easy is it for someone to fake their IP address?

anakadote

I built this website, pretty much just for ****s and giggles, that doesn't require people to register or login but rather uses their IP address to track them and limit them to 1 post per minute. I also block IP addresses that post spam or inappropriate content. I'm not as concerned about the posting limit as I am about the obvious bots that post spam every now and then. Realistically, how easy, and how common, is it for a spamming program to alter/fake their IP address to avoid restrictions on sites like mine?

bradgrafelman

"Alter" your IP address? That statement seems to suggest that someone is maliciously altering TCP packets to spoof a different originating IP address.

It would be much, much, much simpler to take advantage of one of the thousands (millions?) of open ("anonymous") proxies, botnets, etc. etc. There are numerous free services out there that will give you surf the web under a different IP.

anakadote

Yeah, I know, but I'm not talking about surfing the web. I'm wondering if whoever is sending out spam emails, and crawling the web to post spam to web forms can or is altering their IP address as not to be tracked and to avoid systems like mine that block IP addresses. I wasn't inquiring about how I personally can surf the web in private but rather how effective is a system like mine that tracks and blocks IP addresses.

bradgrafelman

anakadote;10966139 wrote:
I'm not talking about surfing the web. I'm wondering if whoever is sending out spam emails, and crawling the web to post spam to web forms

While some proxies may restrict the traffic to only port 80 (e.g. "surfing the web"), many others allow any traffic to relay through them. Thus, "surfing the web" is the same as "sending an e-mail" in the sense that both involve connecting to a remote server and sending/receiving data (a process which can be routed through a proxy to mask the client's actual IP).

anakadote

Gotcha, thanks. So it seems from what you're saying that blocking IP addresses from spammers is only partially effective at best.

bradgrafelman

anakadote;10966141 wrote:
So it seems from what you're saying that blocking IP addresses from spammers is only partially effective at best.

It's a start, and it's definitely better than nothing (it might not entirely prevent an attack from a masked IP, but it could certainly slow the attacker down enough to cause frustration if you start blacklisting all of their available IPs).