I assist in running a public WiFi network, and we assign each user an internal IP address on the 10.0.0.0/8 subnet. We sometimes get emails about abuse of network services, but because of the nature of NAT we're never able to figure out what user was abusing that service.
I know of two things that might help:
- X-Forwarded-For headers on outgoing HTTP connections (but that doesn't handle anything other than HTTP)
- Ident, which (correct me if I'm wrong) returns a string identifying a user based on a local port and a remote port
I think setting up an ident daemon would make sense but I don't know of any ident daemons that base identification strings on the local IP address behind a NAT.
Is there an ident daemon that's the right way to go here? Or should I be thinking about other ways to allow abused hosts to help us with abuse queries?
Edit: I should probably mention that we are running a captive portal, so we do know what MAC addresses are tied to what IP addresses. This question is about giving abused services the ability to tell us which of our users behind the NAT was causing problems for them.