PHP - Is possible to find if user is browsing from beind a Router and get Router Info

First, are you talking about finding out information about users visiting your website? Keep in mind that this implies an intrusion into their privacy (you can try it with yourself though ;))

Is it possible for PHP to know if the user is accessing the web from behind a Router?

No you cannot. Only when you know that e.g. you have a lot visitors from one company and they all have the same IP address, they might be behind a router but it could also be a proxy.

And if yes, how can i get some information about that router, like:

Router Name, Brand, Serial Number, ...

If you have the IP you might be able to discover various things about a host with tools such as nmap. You might be able to find out the brand of a router and host system but definitely not serial number and such stuff. nmap is not PHP though.
Note: The use of such tools without permission to do so is illegal in some countries. In any way, the use of such tools without permission is morally questionable .

Users connected in the same network.

As I mentioned in the first question, if you have different users with the same IP address they might be in the same network. They could also be in different sub-networks. Anyway you cannot get their local IP addresses.

Can PHP also find the Local IP Address for the visitor in that Network?

See previous answer.

You see, everything is very vague and mostly based on assumptions. You cannot get reliable information and I am very glad that we are not totally transparent yet.

Once we all use IPv6, the whole story is a different one.

+1 for *but it worries me a little*... This was my first thought too.

Felix Kling 2010-04-01 23:42:43

But if you are behind a router and type your router IP in your Smartphone browser you end up on your Router Admin Panel.

Fábio Antunes 2010-04-02 00:10:03

@Fábio Antunes: So? What is your point? This is the internal IP of the router and the admin panel will (hopefully) only be accessible from the local network.

Felix Kling 2010-04-02 00:18:14

@Felix: Hopefully you said, and you're right, hopefully. Most Router admin panels are accessible from the Internet just by tipping your Internet IP into your browser. And now consider that most of its owners don't even change the manufacturer security settings. In this moment you could access: http://85.242.9.184 and change my wlan router settings if i haven't changed the security setting.

Fábio Antunes 2010-04-02 02:28:18

By comparing User-Agent headers from multiple sessions originating at the same IP, you can probably detect the presence of many routers (if the same IP reports a Mac browser and another on Windows Vista, there's probably NAT involved).

Ben Voigt 2010-04-01 23:42:18

@Ben Voigt: Interesting point. But could also be proxies.

Felix Kling 2010-04-01 23:45:46

Proxy can be differentiated from NAT based on the TTL behavior (as compared to e.g. pinging the same address). But determining that is beyond the capabilities of PHP I suspect (of course it depends on the web server and any additional functions it provides to get low-level packet information).

Ben Voigt 2010-04-01 23:54:26

@Ben Voigt: Ok I have to confess I have not thought about that in such a detail. But I'm always happy to learn something new as I'm also interested in network security. Thank you for your input :)

Felix Kling 2010-04-01 23:58:29

@Ben Voigt: Sorry for my ignorance about the subject, but you sound to have many knowledge about networks. Can you share a bit more what you know, specially about TTL (don't know what it is) behavior. Thanks :D

Fábio Antunes 2010-04-02 00:23:59

TTL is designed to fight infinite routing loops. It's a number inside the IP header (so it exists in TCP, UDP, ICMP packets among others). Every router that forwards a packet must reduce the TTL (usually by one, but subtracting more is permitted). When the TTL reaches zero, the packet is thrown away. It's used for traceroute, since in many cases the router throwing away the packet will send a message back to the sender. Now, a NAT is a kind of router, it replaces the source and/or destination address and port numbers, but the TTL comes from the original sender.

Ben Voigt 2010-04-02 00:28:09

(continued) A proxy maintains separate connections to client and server, so when it sends out a request it's a packet created by the proxy with a fresh new TTL determined by the proxy independent of the client. Of course you could confuse the difference by configuring a NAT to use a fairly low TTL for outgoing packets (i.e. ICMP reply) and clamp NAT-ed packets to the same TTL, my proposed test would then incorrectly call it a proxy.

Ben Voigt 2010-04-02 00:30:49

(continues) A proxy could also pretend to be a NAT using per-connection TTL settings. Just setting the proxy software's TTL lower than ping replies would be sufficient to fool my proposed test. But in the end, proxies and NATs are both routers, just at different levels (in OSI model, NAT is Layer 3-4 router and proxy is Layer 7).

Ben Voigt 2010-04-02 00:38:22

@Ben Voigt: No worries I forgot that you mentioned to ping the IP address and compare the TTL behavior. Thank you.

Felix Kling 2010-04-02 00:40:26

@Ben Voigt: Considering that routers repeat the same packet, though increasing connection stability and network traffic. Any attempt to track they're TTL would be overwhelming, i think.A packet every time he goes through a router, isp, ... He takes a tag from everyplace he as gone through right?

Fábio Antunes 2010-04-02 00:51:58

@Fabio: No, the TTL is stored inside the packet. The router decreases the TTL on its way through. Deciding whether to forward or discard the packet is a very simple check, whether the TTL is still positive or not. So no it's not an overwhelming burden on the router.

Ben Voigt 2010-04-02 00:54:09

@Ben Voigt: But isn't supposed the packet be protected and only able to be read by its end user? Thats what i remember from basic Network lessons back at school. Unless that they are wrong of course. So how would the router read the TTL and then decrease/increase it to send it again.

Fábio Antunes 2010-04-02 00:59:23

@Fabio: The only "protection" is that the packet is supposed to take the shortest path to its destination, which minimizes the number of people who can meddle with it. And the routers are responsible for ensuring that. Some protocols may add a signature to protect (by detecting changes) the payload, but they'll _always_ exclude the IP header simply because it _will_ change. Any attempt to guard the IP header against modification will simply cause incompatibility with something like 99% of all networks (in fact any network with a router) because decreasing the TTL is mandated by the IP spec.

Ben Voigt 2010-04-02 01:51:28

My guess. School sucks. I should trade school time for SO time.@Ben Voigt: Thanks Ben for your time and patience i will look into this. Thank you.

Fábio Antunes 2010-04-02 02:11:44

ansaurus

tags:

views:

answers:

PHP - Is possible to find if user is browsing from beind a Router and get Router Info

related questions