2 different user, different locations, same IP?

Don't know where to post, so if this is the wrong place, please move the post.

How is it possible, that 2 different user in my forum, as different locations within the city, can have the same IP?

The story:
One of my administrators mention that he has a lot of problems with his connection, so we monitored it.
One day, he logged in, and just 30 seconds later, a new user registered, with the SAME IP address. At this moment, my admin got connection problems. He has dynamic IP. I told him to just disconnect and reconnect after 5 minutes.
He did that and at the moment he disconnected, the new user which had the same IP vanished too.

Any idea how this is possible?

 

Easily possible by someone using a proxy server network, such as tor or xerobank. Multiple users can be connected through a single IP at a time.

Is this surprising? It shouldn't be. And anyway, IP filtering/session/authorization is a horrible idea for the most part.

 

I was thinking the same at the first time this happen, but this ISP does NOT use proxy server.
First, they confirmed that they do not use a proxy and second, whatismyip.com shows the correct IP, not any proxy IP.

 

If the ISP assigns dynamic IP addresses to users, which is frequently the case, then several users of the same ISP could possibly be using the same IP address at different times. In that case the true identities of the users could only be obtained from the ISP, which will have logs detailing which addresses were allocated to which users at which times.

If more than one user has the same IP address at the same time then there's something wrong. Either the ISP's servers have screwed up, or maybe a user has erroneously set a fixed IP address where they in fact really have a dynamic one.

 

The ISP confirmed that nothing is wrong with their system (of course...).
The user has not set anything to static IP.
What else could be the cause? This happen multiple times already. Short time after he log in, the other user also log in.
It started days ago, the admin logged in and short time later, a guest visited the forum and registered an account, and he had the same IP.
Now, everytime the admin log in, this user log in too after a couple of minutes, always with the same IP. Even the admin disconnect, reconnect (and get a new IP after re-login) . Short time after, this user login again with the same IP.

Don't start laughing, but it looks like another has done some wire tapping, even it might not be possible, and waits until a session is established and use this anyhow. Is something like that possible? It might also explain the connection problem my friend experience soon this user is using his IP.

 

I have a horrifying explanation...

If the user is connected via the Tor network, such as through xB Browser, and is using the same Tor exit node to reach the forum, the exit node operator could be monitoring the usage. Now this is pretty unlikely, as the admin would have to be using the same exit node every time.

Does this new user always have the same IP address as the admin, and logs in with a different account? Does it act as if the guest user is using the admin's computer?

If you have access to the admin, tell him to clear his cookies. He could have some guest cookie that is logging in with him if your forum is somehow using cookies. All of this sounds pretty far-fetched, though.

 

No, he has a dynamic IP, every time he log in, he has another IP.
It happen with all browser, so I don't think its a cookie thing.
I have at least 50 user from the same ISP in my forum, but it never happened with them, only with the one who has admin right.
He only has ONE pc at home, and he also log out every time he leave the PC.

The strange thing is, that this happen ONLY if he log in, a couple of minutes later. And the user with the same IP is active in the forum, browsing galleries or reading posts etc. during the time the admin is doing something else in the forum, so both are active at the same time, with the same IP.

He's in an IP range 203.x.x.x, if that happen. I told him to switch of the modem, wait 5 minutes and log in again. He did this, got a different IP range (124.x.x.x) and the "stranger" did not appear. But soon he is back in the Ip range 203.x.x.x, the "guest" logs in again after a couple of minutes.
If he is NOT connected to the internet, the "guest" also do not appear.

Is there any possibility of a physical access to his phone line/dsl and use this if a valid connection is established? Sounds like science fiction, but this is real and makes me headache.

 

I'm not knowledgeable about this sort of thing, but is it possible he's connecting via wireless, and it's not encrypted, and someone nearby is piggybacking off the signal?

 

No, he does not have a wireless network...

 

Has the user format his PC just to rule out software possibilites?
It doesnt sound like a session hijack as the OTHER user is registering an account.

 

The simplest solution is that your logs are wrongly recording any guest actions as through his IP address. You may be chasing a phantom that is only a software bug.

 

No, I am not chasing a phantom at all, because cports reports the same... even the routers log shows the same, 2 times the same IP.
The forum shows the same IP, cports shows the same and also the routers established connection list shows the same...

However, this problem seems to be solved for the meantime. Our ISP's here started migrating all the clients to their new NGN (Next Generation Network) and since then (a couple of days ago), nothing happened anymore.

Its just something which drives me crazy, not being able to figure it out.