HTML Logo by World Wide Web Consortium (www.w3.org). Click to learn more about our commitment to accessibility and standards.

Moving forward with Composr

ocPortal has been relaunched as Composr CMS, which is now in beta. ocPortal 9 will be superseded by Composr 10.

Head over to compo.sr for our new site, and to our migration roadmap. Existing ocPortal member accounts have been mirrored.


IP address appears in Online members but not in logs

Login / Search

 [ Join | More ]
 Add topic 
Posted
Rating:
#82822 (In Topic #17264)
Avatar

Community saint

This has been bugging me for some time. I have an IP address show up about every 30-45 minutes in "Online members". The IP address is blocked at Cloudflare and the user-agent is blocked in .htaccess. Strangely, even though I see this address countless times each day, it never appears in my Apache logs. Even when investigating user by IP, it shows the last visit was March 12 but I see it daily, many times a day. It's a mystery - a real phantom IP address. Any idea how this could be happening.



Bob
Back to the top
 
Posted
Rating:
#82835
Avatar

Proxies.

ocPortal reports what it senses to be the client's IP. I guess .htaccess and Cloudflare do the connection IP.

I've added something to the tracker 0000418: Dual IP address logging and checking - ocPortal feature tracker.


Become a fan of ocPortal on Facebook or add me as a friend. Add me on on Twitter.
Was I helpful?
  • If not, please let us know how we can do better (please try and propose any bigger ideas in such a way that they are fundable and scalable).
  • If so, please let others know about ocPortal whenever you see the opportunity.
  • If my reply is too Vulcan or expressed too much in business-strategy terms, and not particularly personal, I apologise. As a company & project maintainer, time is very limited to me, so usually when I write a reply I try and make it generic advice to all readers. I'm also naturally a joined-up thinker, so I always express my thoughts in combined business and technical terms. I recognise not everyone likes that, don't let my Vulcan-thinking stop you enjoying ocPortal on fun personal projects.
  • If my response can inspire a community tutorial, that's a great way of giving back to the project as a user.
Back to the top
 
Posted
Rating:
#82874
Avatar

Community saint

It's strange because the block at Cloudflare should be stopping it dead in its tracks such that it never hits the server.

Bob
Back to the top
 
Posted
Rating:
#82883
Avatar

Not if that only looks at the connection IP and not what the real source IP is.

Really checking just one isn't ideal, which is why I said that in the tracker topic. The "behind proxy" IP can be forged to anything, yet proxies are also commonly shared by millions of users.


Become a fan of ocPortal on Facebook or add me as a friend. Add me on on Twitter.
Was I helpful?
  • If not, please let us know how we can do better (please try and propose any bigger ideas in such a way that they are fundable and scalable).
  • If so, please let others know about ocPortal whenever you see the opportunity.
  • If my reply is too Vulcan or expressed too much in business-strategy terms, and not particularly personal, I apologise. As a company & project maintainer, time is very limited to me, so usually when I write a reply I try and make it generic advice to all readers. I'm also naturally a joined-up thinker, so I always express my thoughts in combined business and technical terms. I recognise not everyone likes that, don't let my Vulcan-thinking stop you enjoying ocPortal on fun personal projects.
  • If my response can inspire a community tutorial, that's a great way of giving back to the project as a user.
Back to the top
 
Posted
Rating:
#83101
Avatar

Community saint

I'm not sure if this is related or even an ocPortal issue but I need to start somewhere so I am starting where they are reported. I first noticed this the other day but didn't think much of it until I noticed two more entries in the Online Members listing this afternoon with private IP addresses. This is a v7.1.6 installation.

I am not sure what these IP entries are referring to but I have no Linux or Windows devices and my router is locked-down with only enough addresses to connect my devices and they are in the 192.168.0.XXX block.

Any idea on what these entries at private IP addresses could be:



Bob

Back to the top
 
Posted
Rating:
#83102
Avatar

Community saint

If this is on your active website, it looks like someone from your hosting is browsing the "local" network. Private IP numbers shouldn't show up outside of a local network.

Steve
Back to the top
 
Posted
Rating:
#83103
Avatar

Community saint

I guess I'll need to ask eLief. I don't really care if someone from eLief is looking around but it sure does look weird when you see a private address in the listing.

Bob
Back to the top
 
Posted
Rating:
#83110
Avatar

Proxies again. This is the IP of the user accessing the site, which is local. They can reach the site because they are tunnelling through a proxy. So there's the IP of the proxy (which may be shared), and their own local IP (which ocPortal shows).

It's difficult. We could just show the IP of the connection, but I know in the past and possibly still, AOL would push millions of users through the same proxy.


Become a fan of ocPortal on Facebook or add me as a friend. Add me on on Twitter.
Was I helpful?
  • If not, please let us know how we can do better (please try and propose any bigger ideas in such a way that they are fundable and scalable).
  • If so, please let others know about ocPortal whenever you see the opportunity.
  • If my reply is too Vulcan or expressed too much in business-strategy terms, and not particularly personal, I apologise. As a company & project maintainer, time is very limited to me, so usually when I write a reply I try and make it generic advice to all readers. I'm also naturally a joined-up thinker, so I always express my thoughts in combined business and technical terms. I recognise not everyone likes that, don't let my Vulcan-thinking stop you enjoying ocPortal on fun personal projects.
  • If my response can inspire a community tutorial, that's a great way of giving back to the project as a user.
Back to the top
 
Posted
Rating:
#83115
Avatar

Community saint

Thanks for the explanation, Chris.

I'm wondering if Cloudflare is contributing to this specific situation (private IPs) since I never recall having this prior to using Cloudflare.

Bob
Back to the top
 
There are too many online users to list.
Control functions:

Quick reply   Contract

Your name:
Your message: