studying at Waterloo (202 = 204 = 206 = 208 = 209)

An interesting sample of how oddly Rogers IP address can sometimes operate comes from a log of an instruction site from the University of Waterloo, here. As you can see, the log covers 24 hours, beginning a few minutes after midnight on 29 April, 2004. There are 1420 entries from 138 IPs; 268 of the log entries come from some of the Rogers IPs that we have been following: 263 hits from 66.185.84.202; two from 66.185.84.204; and one each from 66.185.84.206, 66.185.84.208, and 66.185.84.209.

As I said, almost all the posts are from x.x.x.202. But the five instances where there is a handoff to other Rogers IPs are interesting. Here they are, extracted with their immediate context, and excluding all non-Rogers IPs:

1	66.185.84.202	04/29/04 11:12	"POST /cgi-bin/iq/biology/272b/final04.iq HTTP/1.1" 200 8882
	66.185.84.209	04/29/04 11:13	"GET /cgi-bin/geniq/biology/272b/final04.iq HTTP/1.1" 200 11083
	66.185.84.202	04/29/04 11:16	"POST /cgi-bin/iq/biology/272b/final04.iq HTTP/1.1" 200 9458
---------------------
2	66.185.84.202	04/29/04 16:01	"POST /cgi-bin/iq/biology/272b/final04.iq HTTP/1.1" 200 9471
	66.185.84.206	04/29/04 16:01	"GET /cgi-bin/geniq/biology/272b/final04.iq HTTP/1.1" 200 11069
	66.185.84.202	04/29/04 16:01	"POST /cgi-bin/iq/biology/272b/final04.iq HTTP/1.1" 200 9470
---------------------
3	66.185.84.202	04/29/04 17:18	"POST /cgi-bin/iq/biology/272b/final04.iq HTTP/1.1" 200 9468
	66.185.84.208	04/29/04 18:00	"GET /cgi-bin/geniq/biology/272b/final04.iq HTTP/1.1" 200 11083
	66.185.84.202	04/29/04 18:02	"GET /cgi-bin/geniq/biology/272b/final04.iq HTTP/1.1" 200 11076
---------------------
4	66.185.84.202	04/29/04 22:24	"POST /cgi-bin/iq/biology/272b/quiz1.iq HTTP/1.1" 200 7349
	66.185.84.204	04/29/04 22:25	"GET /cgi-bin/geniq/biology/272b/final04.iq HTTP/1.1" 200 11069
	66.185.84.202	04/29/04 22:25	"POST /cgi-bin/iq/biology/272b/final04.iq HTTP/1.1" 200 12661
---------------------
5	66.185.84.202	04/29/04 22:49	"POST /cgi-bin/iq/biology/272b/final04.iq HTTP/1.1" 200 9463
	66.185.84.204	04/29/04 22:51	"GET /cgi-bin/geniq/biology/272b/final04.iq HTTP/1.1" 200 11076
	66.185.84.202	04/29/04 22:51	"POST /cgi-bin/iq/biology/272b/final04.iq HTTP/1.1" 200 4035

Over the course of the day, some student has been accessing the site more or less continuously, and (as I said) almost all his traffic shows up in the log as coming from x.x.x.202. Nonetheless, on five occasions (numbered 1-5), the stream of x.x.x.202 is interrupted by another IP. In all the cases, the switch comes too quickly from the preceding and following posts to allow us to suppose that these are two different users, as does the consistency of files accessed, which all seem to relate to Biology 272b, which is a course at Waterloo (see here).

The series again illustrates the fluid nature of Rogers IPs. Potentially more interesting, however, is to compare this log with the description here, where we again see shifting IPs between "getting" and "posting".

Hat-tip, Nbob in BCL's comments.