 A session ID is usually a randomly generated string to decrease the probability of obtaining a valid one by means of a brute-force search.Many servers perform additional verification of the client, in case the attacker has obtained the session ID.Locking a session ID to the client's IP address is a simple and effective measure as long as the attacker cannot connect to the server from the same address, but can conversely cause problems for a client if the client has multiple routes to the server (e.g.