NAT

how do you know???? come on....ISP administrator and you dont know ???

They should be getting an address from your dhcp server. You can check there tcp/ip properties and check to see if they are dynamic or static. dynamic would be getting an address from the dhcp server and static would mean that someone gave it to them.

NAT's are not really animal or vegetable. they are like prions, see? they are small enuf to get thru the tiniest firewall holes. users scratch a lot when using NAT. that's how you know. once NAT's get settled in your network, it is hard to get rid of them. you don't get them because you keep a dirty network: it is the clean routers that they like. most people think a NAT is transparent but that is just because they are so tiny you can hardly see 'em.
I cleaned out a whole brood with my Network + and Microsoft MCSE books. you just open the books and leave them lying around. i think it is the smell that kills the NAT's. anyhow, good luck.
can i have another brewsky?

BBWWWAAAAAAAAAHHAHAHAHAHAHAHAHAHAHHAAHHAHAA

i need the name of that isp in order to AVOID it at all costs.

now Schultzys answer I like. Especially the brewsky part!!!

What about Cisco books? CCNA CCNP or CCIE Schultz?? do they also get rid of NATs??? inquiring minds wanna know!!!

You can not really tell if somebody uses NAT or not. There are some possibilities, but that may get criminal charges against you if you will try it.

1. Try to run hack attack against IP address. This MAY give you an understanding if it's Windows, UNIX, router or firewall.

a. It's Windows - you have dummy user who is connected directly to cable/dsl/modem and probably they do not use NAT.

b. You have Unix (Linux). If you have all default ports open (i.e. Telnet, FTP, Time), it's probably just PC. If you don't have responses on "well known ports", PROBABLY it's UNIX with Firewall and NAT.

c. Most routers will not respond to your requests. They may even not respond to PING. So, it's nothing you can do. But from another hand you may get responses from the computers behind the router (for example, if user host his homepage).

In theory, you may determine how many computers are connected behind one IP address by watching activity. For example, if you see simultaneous requests to porno.com, disney.com, and amazon.com, most likely it's family of 3 people behind the router.

Most ISPs have no problem with the fact that you have a router with NAT until you call them with connectivity issue. Then they ask you to connect your modem directly to your PC, but it's mostly for troubleshooting purposes.

And coming back to legal aspect of your question. If I would know that my ISP does steps I just described against my IP address, I will leave them immediately and will file a lawsuit against them. Unless it's stated in your clients contract that "...you must have only one PC connected, you must not use NAT, and you can not have firewall and antivirus on your PC", anything you will do will be illegal.

Good luck,

Mike

Inspect the packets coming from that user with a sniffer and see the TTL values. If you see variable values, the odds are that there's more than one computer behind it.