He can change his local bits all he wants he is still blocked.There are other examples where it is difficult such as blocking some computers on the same /64 segment as others you want to allow however when we look at this problem today all we see most of the time is a NAT for the whole network with a single IP.The address space is bigger and there is more room to hide yet allocation is still hiera