RE: Filtering by client IP address for Web App Sessions

We have been monitoring traffic to sites in Israel and some other
countries too. It is not uncommong anywhere to have clients swap IP
address during a single session. However it seems to us that 24 higher
bits of address appears to be constant.

Amichai Shulman
CTO




Imperva, Inc.
22 Hachilazon St.
Ramat Gan


(972)-3-6120133 x103 Office
(972)-3-7511133 Fax
(972)-50-6544451 Mobile
shulman@imperva.com
 
 
 
 
 
 
 
 
 
 
 


-----Original Message-----
From: Evans, Arian [mailto:Arian.Evans@fishnetsecurity.com] 
Sent: Wednesday, February 23, 2005 5:13 PM
To: webappsec@securityfocus.com
Subject: Filtering by client IP address for Web App Sessions


Question for those outside of the US of A:

In Europe, Asia, etc. do you have:

1. Any significant user population of your web applications comprised of
AOL (America online) users?

2. Are there many ISPs or large organizations using megaproxies that
swap client source IPs across entire classes of netblock (e.g. -like AOL
does)?

I've been telling people for years that you can't filter by source or
even last octet netblocks and lately have been wondering if I'm dense
and this is a US-centric bias of mine thanks to the ISP behaviors I've
had to deal with over the years.

Feedback appreciated,

Arian