Add report: Duplicate IP address

feature
1

Is it possible for a report to be added under DASHBOARD > REPORTS, to list accounts that share the same IP address?

Or, if the processing is too heavy to do large forums, the report could potentially be capped eg: checks all new accounts from the last 3mths.

Discourse identifies such duplicates when looking up a specific user, but it would be useful to see this information across all users. Currently I have no tool to identify this, other than checking individual users one at a time.

I realise that a shared IP doesn’t always mean it’s the same person and that some IP addresses are shared by multiple users on a network, but it would still be very useful.

Possible?

5 Likes
2

You can do a query with data explorer plugin to find users with same ip.

There may be an example in What cool data explorer queries have you come up with?.

5 Likes
3

Thanks Jay. We don’t have the data explorer plugin on our hosted instance.

4

Is there any chance of this being added to the standard Discourse Dashboard reports, without needing the data explorer plugin?

This feature would be useful for most discourse forum staff, as users with multiple accounts is a pretty common forum experience. For me, it would be more useful on a regular basis than most of the existing Dashboard reports.

5

Ask yourself, what is the maximum number of different IP addresses?

I think it would be relatively inexpensive to have count(ips) vs. count(distinct(ips)) to give a general idea of how many accounts have used IPs used by other accounts.

More expensive would be an “on demand” search for particular IPs

Depending on how many accounts / IPs a forum has, finding all non-distinct IPs could be extremely expensive. If my math is close, the formula for finding out how many checks would be needed would be something like
(n*(n+1)/2)-n
where n is the total number of IPs

* eg. for 100, that’s 4950, for 1000 that’s 499500. You get my point.

3 Likes
6

Don’t know what this would involve in terms of system resources, but it would be useful to get a Mod Message and/or have a report that would allow us to get a list of IP addresses with more than one Member associated with that address via either Registration or Last IP.

Currently, the only way to find out about duplicate IP (which doesn’t necessarily mean 1 member having multiple accounts) is to manually check. Which means we only find out when someone is being a problem.

And what can happen (very rarely, but could be recurring issue with motivated troll) is that a person creates a slew of accounts that they “level up” to be able to post but otherwise keep dormant. Very hard/laborious for someone to do this with with enough discipline to use VPNs to keep IPs separate. So at some point during process of leveling up an account in Trust Level, troll will typically mess up at some point and log in with a “real” IP. And if mods can be alerted when this happens, or for this to show up in some report that a group of mods could consult on some regular basis, then it would help a lot in heading off a troll using a bunch of dormant dummy accounts to create a big disruption on their own.

But maybe this would command too much in the way of system resources?

2 Likes
7

There are always more than one way to put together an app, but I can give my experience.

  • I acquired a set of data including IPs associated with a Discourse forum (~250K accts).
  • I wrote PHP code (*note, not Ruby) to parse CSV and insert data into a MySQL database (*note, not PostgreSQL).
  • I downloaded the deprecated MaxMind geolocation database
  • I wrote code to do INET array <-> number conversions and inserted values into the database
  • I matched individual Discourse IPs to corresponding MaxMind Locations (even in limited numbers, eg. 10K accts, this step could take upwards of two hours to run - an expensive range select)

Once I had “base” data, I needed to only update with what was new since the last. It never took more than several minutes to run an [weekly] update.

Once I had the data I was interested in, running queries by location was not slow.

1 Like
8

Thanks for this…sorry I didn’t see this, and thank you, until now. Will pass to our admin and we’ll discuss if it’s worth the work.

We have a few thousand members and we pretty regularly have people making additional accounts. Sometimes with malicious intent, often without any apparent malicious intent. Rarely a significant issue.

Only few times a year do, I think, do we ban someone and have them make additional accounts to be annoying. Up until now, it’s been annoying to deal with, but not that big of a deal. And, so far, they have always lost the will to trade time with us to keep up their bullshit, and either disappear…or maybe create an account and actually lay low and follow the rules and not be a problem. In which case, it’s not really a problem.

1 Like