I want to confirm whether Jmeter's IP Spoofing only works on local networks and not for public?

Question

Suppose I want to hit Server A on the internet, I have a public IP aa.aa.aa.aa and local IPs bbb.bbb.bbb.bbb, ccc.ccc.ccc.ccc. When hitting Server A, what will be recorded in the server log is only ip aa.aa.aa.aa, is that right?

In my case, the server I tested, used a mechanism of maximum 3 hits per IP for login. So I wanted to practice this IP Spoofing to bypass that mechanism.

I have read the article IP Spoofing With JMeter: How to Simulate Requests from Different IP Addresses and when practicing it - adding IP in the interface, entering it into csv, then calling IP in the Source Address field - but the result still does not work.

And when I looked again, I found the answer that "if you're behind the NAT and the target system is on the Internet - it will see requests coming from one address only.", source. So I don't think IP Spoofing can be used.

Is there any other option other than asking the developer to turn off the mechanism? Because I want to test the server under the most realistic conditions as possible.

Answer 1

If the server is in the Internet and your machine has only one public IP address - the target server will "see" only one public address from your machine.

If you want to send requests from 3 different IP addresses you will need to find somewhere 3 machines with 3 public "white" IPs, the easiest is to kick off cloud machines using one of cloud VM providers such as:

• Amazon EC2
• Microsoft Azure
• Oracle Cloud

Also JMeter supports distributed mode of execution when one master machine orchestrates multiple load generators running the same test plan. Originally it's designed for conducting the higher loads in case when single machine cannot conduct the required throughput due to resources limitations but in your case you can use it for creating the load from different IP addresses.