View source for Help:CheckUser/az

<languages/>
{{process header
 | title    = <span lang="en" dir="ltr" class="mw-content-ltr">CheckUser</span>
 | section  =
 | previous = &larr;{{ll|CheckUser policy|<span lang="en" dir="ltr" class="mw-content-ltr">CheckUser policy</span>}}
 | next     =
 | shortcut =
 | notes    =  <span lang="en" dir="ltr" class="mw-content-ltr">This is a technical manual for the [[Special:CheckUser|CheckUser]] special page with Wikimedia-specific considerations. For the extension itself, see the [[mw:Special:MyLanguage/Extension:CheckUser|CheckUser extension page]] on [[mw:|www.mediawiki.org]] website.</span>
}}

<div lang="en" dir="ltr" class="mw-content-ltr">
'''[[Special:CheckUser|Special:CheckUser]]''' allows a user with a ''checkuser'' flag to access confidential data stored about a user, [[w:IP address|IP address]], or [[w:Classless Inter-Domain Routing|CIDR]] range. This data includes IP addresses used by a user, all users who edited from an IP address or range, all edits from an IP address or range, [[w:User agent|User agent]] strings, and [[w:X-Forwarded-For|X-Forwarded-For]] headers.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
This tool is usually used to counter users creating bad-faith [[w:sockpuppet (Internet)|sock puppet accounts]]. (Note: ''checkuser'' may refer to an access to confidential information, a user with permission to do so, or the technical flag.)
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
== Considerations ==
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=== Wikimedia Privacy and Confidentiality Policies ===
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
Checkusers under the [[w:Wikimedia Foundation|Wikimedia Foundation]] are subject to the [[wmf:Terms of Use|terms of use]], the [[wmf:Privacy policy|privacy policy]], the [[access to nonpublic information policy]], the [[CheckUser policy]] and a [[confidentiality agreement for nonpublic information]]. Revealing stored confidential data about a user is prohibited except on a limited set of cases detailed in the policies mentioned above.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
If possible, the checkuser should attempt to resolve the situation ''without'' releasing any information, or by releasing the minimum possible information. The following information is commonly permissible. This list is ''not'' comprehensive, and cannot replace the checkuser's judgment:
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
* Confirmation that a user is a sockpuppet without noting personal information;
* Information already released by the user;
* The ISP used to edit from, if it is large enough that the information is not personally identifiable;
* The country their IP address geolocates to, which is generally not personally identifiable.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
If the checkuser is at all doubtful, they should give no detail and answer like a [[w:Magic 8-Ball#Design and usage|Magic 8-Ball]].
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=== Mailing list ===
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
Wikimedia CheckUsers have access to the private mailing list ''[[mail:checkuser-l|checkuser-l]]''. They may use this list to discuss or get help, ideas and second opinions.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=== Best practices ===
</div>
* <span lang="en" dir="ltr" class="mw-content-ltr">'''Focus on behavioral patterns:''' CheckUser is not magic wiki [[w:pixie dust|pixie dust]]. Almost all queries about IPs will be because two editors were ''behaving'' the same way. An editing pattern match is the important thing; the IP match is really just extra evidence (or not).</span> 
* <span lang="en" dir="ltr" class="mw-content-ltr">'''Dynamic IP addresses:''' Most dialup and a lot of DSL and cable IPs are dynamic. They might change every session, every day, every week, every few months or hardly ever. Unless the access times are right next to each other, be cautious in declaring a match. After a while, you get to know which ISPs change quickly or slowly.</span>
* <span lang="en" dir="ltr" class="mw-content-ltr">'''Handling proxies:''' If it's a proxy, it might not be a match, depending on the size of the organisation running the proxy (per <kbd>whois</kbd> output). If it's an ISP proxy, it is not so likely to be a match. Investigate the type of proxy used before making a conclusion.</span> 
* <span lang="en" dir="ltr" class="mw-content-ltr">'''AOL users:''' If it's an AOL address, you're out of luck — AOL sends each ''page request'' through a different proxy.</span>
* <span lang="en" dir="ltr" class="mw-content-ltr">'''Open proxy use:''' If a username is using lots of different IP addresses in various countries, they may well be open proxies. Check with an open proxy checker.</span>
* <span lang="en" dir="ltr" class="mw-content-ltr">'''Hosting servers:''' Edits from addresses allocated to [[w:en:Web hosting|hosting facilities]] ''almost'' always indicates the use of compromised hosting servers to nefarious ends. Note, however, that the user may have a legitimate shell account on the machine.</span>
* <span lang="en" dir="ltr" class="mw-content-ltr">'''IPv6 subnets:''' For [[w:en:IPv6|IPv6]] addresses, you may wish to check the user's entire /64 subnet, because it is possible that the user may be using more than one address out of their range.</span>
<div lang="en" dir="ltr" class="mw-content-ltr">
=== Useful tools ===
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
"Unix" here includes [[w:en:Unix-like|Unix-like]], [[w:en:Linux|Linux]] and [[w:en:Mac OS X|Mac OS X]] computers.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=== IP address and domain lookup ===
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
* '''[[w:en:whois|whois]]:''' On Unix, start a [[w:en:terminal emulator|terminal]] and type <code>whois [''IP address'']</code> at the command line. This should tell you who owns the IP, what the range is and may also note what they use it for. On Windows, [http://all-nettools.com/toolbox All Net Tools] has a pretty good web-based whois (which does an nslookup as well).
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
* '''[[w:en:nslookup|nslookup]]:''' On Unix or Windows, <code>nslookup [''IP address'']</code> at the command line will give you the [[w:en:FQDN|fully qualified domain name]] associated with the IP. Note that not all IPs have a [[w:en:domain name|domain name]], so don't worry if nothing comes back. If you're on Windows, the All Net Tools whois also gives you the FQDN.
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
* '''[[w:en:traceroute|traceroute]]:''' With [[w:en:IP address|IPs]] from some [[w:en:Internet service provider|Internet Service Providers]] it may be useful to use the traceroute command and compare the results between two or more IPs. The site [http://all-nettools.com/toolbox All Net Tools] also gives you traceroute function if you don't have it as a [[w:en:Command line interface|command line]].
** '''tcptraceroute:''' A version of traceroute that uses [[w:en:Transmission Control Protocol|TCP]] packets, which get through some firewalls and packet filters that stop [[w:en:Internet Control Message Protocol|ICMP]] packets. You can get [http://michael.toren.net/code/tcptraceroute/ source code for Unix-like systems]; else, most Linux distributions have a package available with it.
</div>


<div lang="en" dir="ltr" class="mw-content-ltr">
=== Open proxy checking ===
</div>
* <span lang="en" dir="ltr" class="mw-content-ltr">Various online proxy checking tools, such as [[w:nmap|Nmap]], can help you determine if a user is connecting via open proxies.</span>
<div lang="en" dir="ltr" class="mw-content-ltr">
=== Blacklist checks ===
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
* '''Checks for other abuse of an IP:''' [http://www.rbls.org/ rbls.org] gives the status of any IP address on a number of [[w:en:DNSBL|Realtime Blackhole Lists]]. Note that some RBL blocks should be expected, ''e.g.'' many block home dynamic IPs for [[w:en:SMTP|SMTP]], but that's not a problem for a wiki. If a user only uses open proxies or addresses marked as sources of abuse, your suspicions may be raised.
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
* '''Related anon contributions:''' [http://toolserver.org/~vvv/rangecontribs.php rangecontribs] tool gives anon edits from a given subnet (dead link).
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
==Usage==
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
===Basic interface===
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
# Go to [[Special:CheckUser|Special:CheckUser]] (make sure you are on a wiki where you have access).
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
# In the ''user'' field, type in the username (without the 'user:' prefix), IP address, or CIDR range.
#* IP: any [[:w:en:IPv4|IPv4]] (most common) or [[:w:en:IPv6|IPv6]] address.
#* CIDR: you can check a range of IP addresses by appending the CIDR prefix (up to /16 for IPv4 (65,536 addresses) or /48 (1,208,925,819,614,629,174,706,176 addresses) for IPv6). For notation, see [[mw:Special:MyLanguage/Help:Range blocks|Range blocks]].
#* XFF: you can check a '''client''' IP address provided by X-Forwarded-For headers by appending ''/xff'' (for example, ''127.0.0.1/xff'').
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
# Select the information you want to retrieve.
#* '''Get IPs:''' returns IP addresses used by a registered user.
#* '''Get edits from IP:''' returns all edits made by a user (registered or anonymous) from an IP address or range.
#* '''Get users:''' returns user accounts that have edited from an IP or range.
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
# In the ''reason'' field, type in the reason you are accessing the confidential data. Try to succinctly summarise the situation (for example, "cross-wiki spam"); this will be logged. This may be needed by the [[Ombudsman commission|Ombudsman Commission]].
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
<gallery caption="Screenshots">
File:CheckUser1.png|Basic CheckUser interface
File:CheckUser3.png|Example username check
File:CheckUser2.png|Example IP check
File:CheckUser log.png|Example log
</gallery>
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
===Information returned===
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
A typical entry in the checkuser results for a user summary ("get users") is as follows:
</div>
<div style="margin:0 1em; border:1px solid #CCC; background:#EEE; font-style:italic;">
* [[user:Example|<span lang="en" dir="ltr" class="mw-content-ltr">Example</span>]] ([[User:Example|<span lang="en" dir="ltr" class="mw-content-ltr">Talk</span>]] | [[Special:Contributions|<span lang="en" dir="ltr" class="mw-content-ltr">contribs</span>]]) (20:11, {{#time:d F Y|-1 day}} -- 20:12, {{#time:d F Y|-1 day}}) '''[5]'''
*# 127.0.0.37 '''XFF''': 127.0.0.1, 127.0.0.5
*# ''Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.11) Gecko/20070312 Firefox/1.5.0.11''
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
This is formatted to fit a lot of information into a format that can very easily be listed and skimmed, but is difficult to read unless you know what the information provided is. The information is laid out as follows:
</div>
<div style="margin:0 1em; border:1px solid #CCC; background:#EEE; font-style:italic;">
* <span lang="en" dir="ltr" class="mw-content-ltr">username (user links) (time period when they edited from the given IP or range) '''[number of edits from the IP or range]'''</span>
*# <span lang="en" dir="ltr" class="mw-content-ltr">IP address the user edited from, along with any '''XFF (X-Forwarded-For) headers''' used. XFF information provided (can be spoofed)</span>
*# User agent information
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
Each IP/XFF combination used to edit is listed, in order of use.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
The last ten user agents (browser, operating system, system language, and versions) for each user for edits made in the IP or range are listed afterwards.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=== XFF format ===
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
XFF ([[w:en:X-Forwarded-For|X-Forwarded-For]]) headers indicate the series of IP addresses used from the user's computer (first) to the server hosting MediaWiki (last).
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
In this example:
</div>
<div style="margin:0 1em; padding: 2px; border:1px solid #CCC; background:#EEE; font-style:italic;">
aaa.aaa.aaa.aaa        '''XFF''': 10.4.46.42, 127.0.0.1, aaa.aaa.aaa.aaa, 208.80.152.46
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
* The first two addresses (10.4.46.42, 127.0.0.1) are private to the originating network and can't be reached directly from the public Internet,
* The third address (aaa.aaa.aaa.aaa) is the "public face" of the editor, usually a broadband or dialup ISP, a company gateway, (but possibly an anonymizer or a malware-compromised server),
* The last address (208.80.152.46) is one of the Wikimedia squids (sq36.wikimedia.org).
</div>

== See also ==
* [[mw:Help:Special Investigate]]
* [[Steward handbook]]

[[Category:CheckUser{{#translation:}}]]
[[Category:Handbook Wikimedia-specific]]
[[Category:Security]]