In addition to artlung's list:
Banning IPs directly has the problem that it's easy to work around and that you lose the information from the IP address. Better let them register and after they post nuke their account so that they don't really know that you caught them over the IP or set them on silent mode that they think the can post but other won't see their posts.
Especially in Europe a lot of people are on dynamic IP addresses and you would have to ban the whole IP range of their provider to effectively ban them.
There are a few signs that a user might share two accounts and are therefore sock puppets. Moderators can use them when they have the suspicion that someone registered but the process could also be automated.
Does the IP belong to the same city?
Does the header of the browser suggest the same browser and screen-size?
Does the EMail address look like a real EMail address? What happens when you Google the part before the domain name? What happens when you search in facebook for an account of that email address?
Anti-aliasing on the web by Jasmine Novak et al is a paper that suggests that their automated algorithm archives a 90% accuracy for identifying sock puppets based on their habits of word choice and text formatting.
Having cookies that identify users can catch some users.
Authentication through sending an SMS.
Making a website invite only can help. If someone invites a person and that person get banned they can get a warning as well. Demonoid would be an example of a large website that uses the principle.
In Germany the new password that will be introduced will have a feature to authenticate users to websites and therefore provide real sock puppet protection. Unfortunately that's no international standard and therefore not much use.
Citizendium requires an official email address from a workplace or an university to register. That system works well at preventing sock puppets but it also seems to impede registration.
Requiring a healthy facebook account might be one alternative that could also work to expand the kind of authentication that Citizendium uses.
Wikipedia bans access from Tor and Anonymous proxies. If you don't have the resources to implement such a system yourself googling for an IP address can often tell you if the IP address is an open proxy and therefore landed in some spam sandbox.
If you have banned proxies and a user really produces real problems and is persistent you might have to think about going to the police. Defamation is a crime in a lot of countries. I hard from someone who moderates a local social network in Germany who got a court to forbid a certain user to visit the website because the user sexually harassed girls on the website.