I'm searching for a solution to work on a Windows machine with multiple NICs/networks. While working within the network of a customer I tend to get a lot of problems. I need an internet connection for several things like git/sourcesafe/development system etc. but clients often can't offer internet access. So the solution is to use a mobilephone to connect to the internet and ethernet to access the client network/database.
Windows seems to be pretty random here. Sometimes everything works, some mintues later it trys to access the internet over the clients gataway or access the database via the internet. So I end up deactivting/activating NIC's all day long.
Is there some easy way to use the ethernet connection only to access the clients network and the mobile for everything else?
From what you described I think this might help: turn off DHCP for the interface that connects to your customers network and set a static address for that (without a gateway). Then configure your other interface to use DHCP. This should set ONE default gateway (your phone) and all traffic will run through it, except endpoints in your customer's net.
BTW: You can only have one default gateway at a time, of course, but in your case the gateway that was set the latest won, so to speak.
I have a somewhat basic understanding of network programming (and networking concepts in general) from taking a networking course in university a few years ago.
I remember being able to create a simple chat application, where the chat server is used as a central directory aware of which clients are currently online, but once a client knows another client it wants to chat with, the actual messages between them don't need to go through the server. I remember we could only test this over a bunch of LAN machines.
This C# chat program also has several comments mentioning that the program does not work over the internet: http://www.geekpedia.com/tutorial239_Csharp-Chat-Part-1---Building-the-Chat-Client.html
My question is why do these applications not work over the internet when "commercial" chat applications can. Surely, there is some way to make my computer accessible to the outer network even if its IP address is not valid outside the network of the ISP.
I see no problem with the linked-to code. The server doesn't even bind to a local address, which means it will listen for connections on all ip-addresses on the computer. There is however a comment for in the server article where the user changed the TcpListener object creation to bind to a specific address, which means clients only can connect to that specific address.
In the original server design, with using TcpListenet with only a port number, there should be nothing preventing its use on an Internet connected computer, unless there is a firewall blocking access.
Were you aware of networkComms.net and in particular the short chat example demonstrating the functionality here (It's less than 15 lines of code)? This was written specifically for people writing server-client apps in c# and given most of the problems you might come across will already have been solved and it might save you some time. This library is completely plug & play and has no issues working over the internet (as long as you can setup the necessary port forwarding where necessary).
Generally if both of your targets are behind NAT (so no true external ip addresses) and you are unable to configure port forwarding you need to look at 'TCP / UDP hole punching', quite an advanced technique.
Here is my situation. I am part of a project creating a P2P charity website, where users connect and can give money to one another. Because of the nature of the site, we know scammers are going to be rampant. We have several preventative measure ideas, and one idea that came up was tying an IP address to the user's account. The reason for this would be to be able to detect when someone from the same IP address creates several accounts.
Would this be reliable? Why, or why not? I have been googling and found many conflicting ideas on the subject. Thanks for any help you can give.
No, it is not reliable. Because:
Residential customers who aren't specifically paying for a static IP address will often see their addresses change frequently. I'm on AT&T DSL and I see my IP address change roughly twice per month on average
People legitimately sharing an internet connection, whether they're using different workstations in the same office with a T1 line, or they're all connected to the same Wi-fi hotspot at Starbucks, will all have the same IP address.
Related to the above, people who are mobile, such as people who use laptops to connect to Wi-fi at coffee shops, airports, hotels, etc, will have a different IP address for each location they visit.
Even people who stay in one place with a static IP address can spoof your system by using a proxy server or a proxy tool like Tor. This makes IP restrictions trivial to bypass.
No.
Many connections are behind NAT (One public gateway IP address for many people), or use DHCP (frequently changed IP addresses).
An IP address is one of the worst ways of identifying a user.
There is a dicussion board I am part of that bans sock puppets ( that is, multiple accounts by the same user ). They have no means of automatically detecting them, becasue there is no means of definitively identifying them. IP addresses are captured, because they can be used to help identify sock puppets, but I know that the process of identifying these is laborious, manual, and error-prone.
This is only undertaken when there is suspicion that someone is using sock puppets for malicious or disruptive purposes. In your case, there is no real answer other than careful and manual monitoring of usage habits, using the information that you gather about users to attempt to identify suspicious habits. But you also have to accept that 80% of sock puppets will go undetected, and do what you can to warn other users of the possibility.
Your bigger issue, incidentally, may be Munchausen by Internet which we were also caught by.
No, not least because:
IP Addresses can change over time, thanks to DHCP leases expiring.
People access websites from many different locations including home, work, coffee shops, etc.
When behind a NAT firewall or a proxy server, many people can share the same IP address.
Will you have many people registering who are entitled to receive money? I'd suggest a manual verification process using real people if at all possible. If nothing else, you can claim to be exercising due diligence if there's a human involved.
No: for example, any company proxy will only have one external IP address, so everyone registering from within the network will appear to have the same IP address.
Recent legal case perhaps worth reading up on : http://yro.slashdot.org/story/11/05/03/2020205/An-IP-Address-Does-Not-Point-To-a-Person-Judge-Rules
Totally unreliable...
Somebody on dial-up will have a different IP address every time they "dial-up".
DSL users will have a different IP address every time they reset or reconnect their account unless they pay for a static IP.
Many users on a particular LAN will be sharing one public IP address.
A particular user can login from home, work, public hotspot and have a different IP from each location.
I do development for an ASP service, and we have recently went through a required 3rd party security audit to obtain status allowing us to host data for a certain government agency. So if I may share some of the information I gleaned turning the trainings, perhaps it would help.
First, IP addresses can be used to assist in what you are trying to accomplish, but they are definately not good by themselves. An example would be the wireless at McDonalds. Everyone at McDonalds is connected to the same wireless and are using the same public IP address through a NAT, which translates from a local address (i.e. 192.168.0.xxx) to a public address for all computers located behind it. The NAT keeps entries so it knows what traffic is allowed to come back into the network, and which computer it is going to.
We found that a good security measure is to use an encrypted session key that is included with all GET/POST submits. That session key contains a GUID which is a lookup to the current session. So even if someone breaks your session encryption, they still need to guess at a GUID in order to find a valid session. On top of that, by tracking IP addresses, if it changes suddenly, we can immediately invalidate the session (we also have whitelisting in case someone is load balancing multiple internet lines, which can cause the IP to change frequently). A cookie can also be used in place of the IP address tracking, as two people behind the same NAT can potentially hijack each other if they can find a way to steal the other person's session key.
Encrypted cookies are also a good way to enforce security. But make sure you are using a framework that is tried and tested, as they have already closed the known vulnerabilities for you. Believe it or not, our security company told us that .NET has emerged as one of the top secure frameworks that they know of. I almost fell out of my chair when I heard that.
Personally I don't think it'll be reliable.
The main reason will be for those using a shared IP. That includes most users connecting from inside a business and home users connecting through the same WIFI hub.
It's more than likely for multiple users to be coming to your site with the same IP address.
Adding to that the fact that IP addresses change over time and you're already losing track of your users.
It's also worth remembering that oftentimes multiple users will be using the same physical computer. Are you wanting to have only one member of a household able to signup etc?
It could be somewhat useful as part of a defense-in-depth approach, but I wouldn't call it "reliable".
If you want to identify users, you can use a cookie. One solution uses a combination of cookies, local storage, flash, and other state information that can be stored in a browser: http://samy.pl/evercookie/
Nothing is 100% reliable. These cookies can be erased by a determined user, or in some browsers with one click. Ultimately, in many countries outside of the USA, a user has the right not to be tracked.
As an alternative for the future: New Intel® Business Processors Deliver Leading Security, Manageability and Performance
As long as the connection between the browser and the CPU isn't interviened which I believe there is more risk of with a browser than a desktop application.
i want to read MAC address of machine from Adobe AIR. I am using flex 3 and AIR 2.
how can i do this
the main purpose is i want to install that product in only one machine
var ni:NetworkInfo = NetworkInfo.networkInfo;
var interfaceVector:Vector.<NetworkInterface> = ni.findInterfaces();
Taken from the Network Info sample in the desktop version of Tour de Flex.
As far as I can tell, you cannot do it with Flex/AIR alone - you can however use the NativeProcess API to communicate with a Java/C program that can do this for you.
If you want to limit your application to just one machine, why don't you just install it manually without giving away the setup file - is it a remote machine? Even in that case you should be able to do a remote installation, right?
The answer "track the combination of IP address and user ID" won't satisfy my (very similar) needs. If the (laptop) computer is moved across WiFi domains, its IP address will change. If the computer is on a commerical IP provider, the IP address can often change without warning or notice.
My users don't want to deal with such problems. They don't even want to know that these problems exist!
The binding of MAC address and user ID can be done at installation time. It's not perfect, but it's pretty good.
Of course what we need is an implementation of public-private key...
Oz
I am making an EventLog which will log the transaction log in my website. The details of the log will include the Public IP from where the transaction has orginated and also the local IP address (under the public IP).
I have found ways to obtain the Public IP Address, but i am unable to find out the local IP or machine IP from where the transaction is made.
A large number of entries will be done by people using the same connection. ie 5 or 10 computers connected to the same connection.
I need to find the machine IP (192.168.0.1 for 1 system 192.168.0.2 for the next) of the machines making the transactions and also the Computer name...
Is this possible
To clarify, you want the private IP address of a client when the client is connecting through a router? Then no, there isn't a way to do this.
Are you doing this purely to distinguish between different users?
Can you use another method like cookies?
If your client connects from behind a NAT or firewall you cannot reliably get his address or computer name. If you need such information then your protocol should request them as part of the request and the client machine should voluntarily provide them. There is no way to validate the information provided (short of deploying a trusted cryptographic infrastructure, ie. you establish a strong trust in the client machines themselves).
Sadly, the answer is no. No modern browser will present that private address in the HTTP transaction. The client's router which performs the NAT (Network Address Translation) offers only the public client IP address when making the IP connection.
Not likely. See a short discussion in http://javascript.about.com/library/blip.htm
Well yes we are doing this just to differentiate between the computers to know who is doing the entries...
Since you guys say that tracing the IP is not very reliable are there any other methods that i can use to do the same thing
I just need to know from which computer each entry is entered.
Any suggestions would be welcome
You are making the false assumption that there is a way to know from which computer each entry is entered. Nobody has the job of ensuring that this information exists. Often, it will not exist.
The only way to make sure each computer is uniquely identified is for you to identify it. You can do this through client certificates, for instance. In general, if you want each computer to have a unique identifier, then you need to create a unique identifier, then put it on that computer. You then need the computer to send that identifier back.
There is no other unique identifier for computers.
This is probably way beyond what you're looking for but it makes for an interesting read: Remote physical device fingerprinting
This allows you to uniquely identify a remote physical device without its cooperation, across NAT or whatever else you can imagine.