Can you grab any IP address on the Internet?

Question

On a personal network (LAN) one can simply grab an IP address. If you choose the same IP address as an existing client, you get problems. There are companies like IANA and ICANN that are in charge of IP address bulks and sells them. But what stops you from just grabbing a random IP address? Is this built on trust? What if somebody were to grab an IP address and conflicting would occur. Is there any way of tracing that IP address to the location of the server using it?

Are companies that actually maintain the physical internet cables checking whether or not the clients connecting are using bought IP address blocks?

Answer 1

There is nothing preventing you from attaching a box configured with someone else's IP address to the internet. However, this won't necessarily cause any issues for anyone else but yourself.

If you steal someone else's IP address outside of the subnet that you are physically connected to, the only thing you will accomplish is not being able to receive any traffic as any router, behaving properly, is going to route traffic to the real owner of this IP address. You might be able to advertise false routes to whatever edge router is upstream from you in the hopes that they would get propagated further in the hopes of getting traffic routed to you based on your stolen IP address, but any marginally competent ISP/upstream provider would never accept routes from its non-enterprise consumers. As far as enterprise customers/other ISPs go, they are bound by specific rules about what routes they can advertise and use with their transit provider or peer, which are monitored 24/7 by Network Operations and Control Teams. Most also have rules about what routes they will accept as valid depending on who advertised them. In short, stealing someone's IP address outside the subnet you are connected to does nothing unless you can also manipulate the upstream routing tables.

That aside if you were to steal an IP address of someone in your same subnet, you would disrupt traffic of both the person who owns it and yourself. With any managed switch or router this will raise alarms as there is a duplicate address on the network and will likely lead to your connection getting blocked in some way.

Answer 2

Similar to mpez0's answer, but I like a good car analogy...

I'm choosing the UK for this, since that's where I live. Imagine you live in a world where people follow road signs without question, and you happen to live right up in the north of Scotland, about as far from London as you can without crossing water. You live in a small town, and one day you decide that you're going to rename your town 'London' since that will obviously have the effect of driving more trade and tourism to your town, right? You even go to the trouble of updating the local road signs to reflect the new name of your town.

What actually happens? Well, you get lots of people from surrounding villages visiting your town following the signs and wondering why they're not in London. But apart from that, nothing changes. Why?

Consider someone who lives in the middle of England. They know that London is in the south, so when they get on the road to go to London, they follow the signs that say 'THE SOUTH' and keep going until the signs get more specific. In other words, their roadsigns still point to the real London. Their 'routing tables' haven't changed. The fact that your town has decided to change its name to London is inconsequential to them. Their local routes are not nearly specific enough to notice the change.

If you decide to change your IP address, routers elsewhere will not suddenly become aware of this fact. The roadsigns will not change.

Answer 3

Consider the analogy of your house address. One day you decide to change your address from "123 First Street" to "1600 Pennsylvania Avenue". What difference does it make outside your own property lines? None - because the rest of the world still behaves as if the physical location of your house didn't change, the name of your street didn't change, the city name didn't change, the zip code didn't change... you get the idea.

Mail, packages, and so on will be "routed" to your house based on its location in the address network of your community. The number of your house (computer), by itself, is only the last and final stop (network hop). Everything along the way has to agree, has to synchronize, and you only control the very end of the path.

You can number your house (or computer) anything you want, but for your network traffic to continue to flow you must do so in sync with your environment. To change your house address, you would have to change its number, AND get the bureaucracy to change the name of your street, AND change the name of your city, AND your zip code. Likewise, to change your IP address to something outside your allocated block, you would have to change its number, AND get your upstream provider to change your allocated block, AND change their routers to route that block to you, AND advertise that via BGP to their routing peers.

In both cases you are synchronizing your change with the outside world so the outside world knows how to find you. Otherwise, the effect is that network traffic can't find you anymore - and the only entity affected by your change of address is you. Which, architecturally speaking, is a good thing!

Answer 4

A given ISP could assign any address to any client. However, addresses are only useful in that they can have packets routed between them and other addresses. An ISP that's assigning addresses outside the range assigned by ICANN will either not get packets routed to/from that address or will cause routing errors elsewhere on the Internet. This is the sort of thing that happens when some of the national Internet censors or filters go awry, or sometimes when top level ISPs misconfigure their routing information.

So, yes, you could set up an internal server with the same addresses as Google.com, army.mod.uk, etc. But you probably wouldn't get packets that were intended for those hosts, at least not from outside your routing scheme.

Answer 5

If you are a ISP you can steal whole IP-Ranges. The Providers and big company's and the like have so called Autonomous Systemss identified by "AS" and a 16-bit integer value. This systems communicate with other systems. They need a protocol to tell the other systems which IPs they own and what other AS they are connected to, and also some "cost" for the connection. Between AS, this is usually BGP.

Problem is, this is still mostly based on trust. If some provider announces that he now owns the IP-Space of Google and the cost is very low, all the other systems send traffic for google to this provider. This has been done, e.g. with Youtube in an attempt by Pakistanian officials to block it in Pakistan. There is still no real technical solution. This basically still works. Most providers switched from an automatic to an semi-automatic process, where they define some criteria on route changes announced by other providers when they have to be checked by an human. But the internet is just too big to check it all. So they have rules like "if the AS did something bad before, check manually".

So no, you as normal person cannot steal a IP. But if you a large enough provider, you can steal whole IP ranges for at least hours, if not days. If you just do this for very small subnets and try to reroute the traffic to the real target, you might even get away with a man in he middle attack without anyone ever noticing.

There is of course also a wikipedia article!

If you want to play around, a good start is the bgp info tool by hurricane electric. There is also a graphical tool. You can enter the AS-Number of your provider that the he site tells you there and view what peerings your provider uses.

Answer 6

"Could the ISP handle out ISP's it hasn't bought?"

Communication basically happens like this: PC to target machine (either a router or directly to the target - determined by the sending machine through a comparison of its IP address and it's subnet mask; if the target is not on the same subnet it is sent to the router for routing).

If a router receives a packet for routing it makes a similar decision based on all subnets it is directly connected too. It chooses which subnet to send the packet onwards through it's "routing table." Note: The routing table on the client machine was used in the first step - try CMD:"Route Print" on Windows.

At the last router in the process, the one with the target IP address on one of it's attached subnets, the router sends directly to the host via it's MAC address (possibly after RARP usage).

So, IP addresses are used to route between the routers and the routers have some way of knowing how to route based on limited sets of information. The routers share information dynamically about route changes (network subnet availability), but "they can do so in an authenticated way." I cannot comment on if authentication is enforced.

If an ISP 'releases' IP addresses to hosts via DHCP or any other means then the route table data must exist for successful two way communication. It would be trivial to identify a rogue ISP. Even if there was a trust approach happening at different levels censoring routing updates from the ISP would still be trivial.

Answer 7

IP address registration is regulated on a local network by some kind of router. With DHCP, a computer asks if for a IP address from the router and is assigned one. But once you want to leave your local network, your IP is assigned by your ISP. There are ways to spoof the IP address a packet is coming from, but as soon as it reaches one of the ISP's routers, the IP address is replaced with its own. The only thing that stays the same is the MAC address, which too can be spoofed. But since your IP address is replaced at the first router, it limits what you can do.

To give you a short answer, the ISP designates everything on a pipe to be associated with it's registered IP address. It's kind of like me telling you to pick a card and there is only one card. Local and Public IP addresses are completely separate.

For more info you can check this out http://en.wikipedia.org/wiki/IP_address_spoofing

Answer 8

You can "use" any IP address for the packets you send out, but the limitation is actually about packets that you'll receive.

"Buying" an IP address range means that a bunch of other people will configure their routers so that packets sent to that IP address range get forwarded a step closer to you, eventually reaching a device that you yourself control. It's all about maintaining a lot of routing tables with a lists saying (a bit simplified) "xxx.yyy.. get sent to the left, xxx.zzz.. get sent to the right".

"Simply grabbing" an arbitrary address will result that if you want to contact www.google.com, you'll send an initial packet to them, but the response packet will get forwarded to the actual intended owner as properly configured, and you won't see it. If you grabbed an address belonging to your neighbour at the same ISP, then the ISP's router nearest to you will be configured to send all such messages to your neighbour, and not you. If you grabbed a random address, then most likely it would be sent to another corner of the world, and the reply wouldn't even get close to your ISP.

It's just as with postal mail, if you live in Pyongyang but want to start receiving mail addressed to "1600 Pennsylvania Ave NW, Washington, DC 20500, United States", then you'd have to convince (at least one of) postal services between the sender and address owner to send such messages your way. This is possible if all the senders are in an internal company network; but that probably wasn't the question.

Answer 9

The Dynamic Host Configuration Protocol (DHCP) function of the router an individual is connected to allocates an IP address within a specific range. You can't just ask for a specific IP address. As far as I know an individual can't "spoof" an IP address.