Gotta start somewhere ... how many of us are really out there?

[Alex Zbyslaw]

Nikolas Britton wrote:

> On 8/2/06, Alex Zbyslaw <xfb52 at dial.pipex.com> wrote:
>
>>
>> But the question then goes back to: can you make any kind of count out
>> of cvsup servers?  Someone already said they thought you couldn't.
>>
>> At the end of the day, I think that unique IP address is as close as
>> it's possible to get to host count.  It will undercount NATed hosts and
>> networks with single cvsup/portsnap distribution points, and will
>> overcount variable IP addresses.  The latter, I think matters the least
>> as long as you do your stats over a short enough period (e.g. 1 month).
>> That wouldn't overcount much and deliberate faking would be hard and
>> limited (how many IP addresses can one faker get access to?).
>
>
> The problem with cvsup (I use cvsup.) is the error margin. The closer
> we get to release dates the more I use cvsup, It's a side effect of
> running -STABLE. anyways... back to the fakers...
>
> Lets think about the usage patterns of a "typical" faker vs NAT:
>
> Faker:
> * All from one IP address.
> * Sequential requests.
> * Scripted, so each request should be timed perfectly with the one
> before and the one after it.
> * Thousands of requests.
>
> NATed Boxes:
> * All from one IP address.
> * Parallel requests.
> * Not scripted, requests should be more random.
> * Hundreds of requests?

But if what you are counting is IP addresses then you faker has achieved 
nothing.  You're not counting connections, but IP addresses.  Yes, you 
undercount NATed and yes you undercount when distribution points are 
used, but I don't see any easy way to fake, at least not on the scale of 
a URL.  Yes, if you happen to have 200 IP addresses, you could probably 
assign each in turn to your BSD box and cvsup, but this seems less 
likely to me, and is inherently limited.

Sometimes I cvsup three times a day - in which case all are likely to 
come from same IP.  Sometimes I cvsup once a month or less, in which 
case looking at statistics only over the last month will tend to flatten 
any effect from variable IPs.

It's far from perfect, but unless you want each installation to have its 
own license number and a "GenuineFreeBSD" program which enforces unique 
license numbers somehow, I don't think there is a perfect answer.  I'm 
guessing no-one in their right might does want this kind of enforcement ;-)

--Alex