ok... so first of all the address changes within DTAG and most other german SOHO DSL providers, from what i heard back then, goes back to the days of dialup... a couple of years ago they apparently still were forced by law (or something) to also offer DSL on a 'charge per time use' basis, and also disconnect virtual channels every once in a while, something to do with anti-competition to the telephone dialup network.. which apparently is why most german dsl providers still do that.

secondly... if your authentication and telling users apart has anything to do with layer 3, your authentication method is just crap, not well

as for wikipedia, it also leaks ips all over the place. (basically inciting users to ddos each other,although probably a less common result

Ah, thanks for providing the historical context for why German DSL providers change addresses so frequently. I am skeptical, however, that there is a law requiring German DSL providers to disconnect virtual channels 'every once in a while' because I asked several German colleagues about such a law and they were unable to find one (I would be delighted if you can point me to one!). thought of, etc. There are other use-cases for IP addresses as end-host identifiers that I outlined in my post (such as counting the number of users in a system by counting the number of distinct IP addresses). I am personally interested in measuring outages by pinging IP addresses belonging to residential CPEs. My premise for detecting outages is that an address that sends responses to active probes is alive and well, and that a previously responsive address that has stopped responding to probes could be experiencing an outage. This premise is incorrect when I am pinging a dynamic address that has been withdrawn from the CPE; thus, I would love to analyze dynamic reassignment behavior across ISPs. I agree that using IP addresses for identifying users for authentication purposes isn't ideal but sometimes, IP addresses are the easiest way to identify users. Other times, they are the only ways to identify users. For example, if one is defending against a DoS attack, the most straightforward and efficient approach is to blacklist that IP address temporarily. How long that address can continue to remain in the blacklist is the question that we aim to answer. than with IRC.) Well, wikipedia is only one example of a well-known company that employs IP address based blacklists. In private conversation with Google and several content-delivery networks (including one where I interned earlier this year), I learned that IP addresses are very much a part of host-reputation systems. So although IP addresses as end-hosts isn't ideal, it's a common assumption and our work shows that the assumption can actually even be valid for weeks at a time in North American ISPs. Cheers, Rama http://www.cs.umd.edu/~ramapad/