Agreed, when I read this my first thought was it'd have to be some sort of IP based authentication, so you'd have to have a way to prove ownership of the target IP itself, however this doesn't really solve the problem of upstream impacts. Your ISP, colo facility or dedicated service provider probably won't be ok with you running these kinds of tests on their network.