2 different user, different locations, same IP?

Discussion in 'privacy problems' started by softtouch, Jul 23, 2007.

Thread Status:
Not open for further replies.
  1. softtouch

    softtouch Registered Member

    Joined:
    Jan 31, 2006
    Posts:
    415
    Don't know where to post, so if this is the wrong place, please move the post.

    How is it possible, that 2 different user in my forum, as different locations within the city, can have the same IP?

    The story:
    One of my administrators mention that he has a lot of problems with his connection, so we monitored it.
    One day, he logged in, and just 30 seconds later, a new user registered, with the SAME IP address. At this moment, my admin got connection problems. He has dynamic IP. I told him to just disconnect and reconnect after 5 minutes.
    He did that and at the moment he disconnected, the new user which had the same IP vanished too.

    Any idea how this is possible?
     
  2. SteveTX

    SteveTX Registered Member

    Joined:
    Mar 27, 2007
    Posts:
    1,641
    Location:
    TX
    Easily possible by someone using a proxy server network, such as tor or xerobank. Multiple users can be connected through a single IP at a time.

    Is this surprising? It shouldn't be. And anyway, IP filtering/session/authorization is a horrible idea for the most part.
     
  3. softtouch

    softtouch Registered Member

    Joined:
    Jan 31, 2006
    Posts:
    415
    I was thinking the same at the first time this happen, but this ISP does NOT use proxy server.
    First, they confirmed that they do not use a proxy and second, whatismyip.com shows the correct IP, not any proxy IP.
     
  4. trickyricky

    trickyricky Registered Member

    Joined:
    Mar 27, 2005
    Posts:
    475
    Location:
    London, UK
    If the ISP assigns dynamic IP addresses to users, which is frequently the case, then several users of the same ISP could possibly be using the same IP address at different times. In that case the true identities of the users could only be obtained from the ISP, which will have logs detailing which addresses were allocated to which users at which times.

    If more than one user has the same IP address at the same time then there's something wrong. Either the ISP's servers have screwed up, or maybe a user has erroneously set a fixed IP address where they in fact really have a dynamic one.
     
  5. softtouch

    softtouch Registered Member

    Joined:
    Jan 31, 2006
    Posts:
    415
    The ISP confirmed that nothing is wrong with their system (of course...).
    The user has not set anything to static IP.
    What else could be the cause? This happen multiple times already. Short time after he log in, the other user also log in.
    It started days ago, the admin logged in and short time later, a guest visited the forum and registered an account, and he had the same IP.
    Now, everytime the admin log in, this user log in too after a couple of minutes, always with the same IP. Even the admin disconnect, reconnect (and get a new IP after re-login) . Short time after, this user login again with the same IP.

    Don't start laughing, but it looks like another has done some wire tapping, even it might not be possible, and waits until a session is established and use this anyhow. Is something like that possible? It might also explain the connection problem my friend experience soon this user is using his IP.
     
  6. SteveTX

    SteveTX Registered Member

    Joined:
    Mar 27, 2007
    Posts:
    1,641
    Location:
    TX
    I have a horrifying explanation...

    If the user is connected via the Tor network, such as through xB Browser, and is using the same Tor exit node to reach the forum, the exit node operator could be monitoring the usage. Now this is pretty unlikely, as the admin would have to be using the same exit node every time.

    Does this new user always have the same IP address as the admin, and logs in with a different account? Does it act as if the guest user is using the admin's computer?

    If you have access to the admin, tell him to clear his cookies. He could have some guest cookie that is logging in with him if your forum is somehow using cookies. All of this sounds pretty far-fetched, though.

     
  7. softtouch

    softtouch Registered Member

    Joined:
    Jan 31, 2006
    Posts:
    415
    No, he has a dynamic IP, every time he log in, he has another IP.
    It happen with all browser, so I don't think its a cookie thing.
    I have at least 50 user from the same ISP in my forum, but it never happened with them, only with the one who has admin right.
    He only has ONE pc at home, and he also log out every time he leave the PC.

    The strange thing is, that this happen ONLY if he log in, a couple of minutes later. And the user with the same IP is active in the forum, browsing galleries or reading posts etc. during the time the admin is doing something else in the forum, so both are active at the same time, with the same IP.

    He's in an IP range 203.x.x.x, if that happen. I told him to switch of the modem, wait 5 minutes and log in again. He did this, got a different IP range (124.x.x.x) and the "stranger" did not appear. But soon he is back in the Ip range 203.x.x.x, the "guest" logs in again after a couple of minutes.
    If he is NOT connected to the internet, the "guest" also do not appear.

    Is there any possibility of a physical access to his phone line/dsl and use this if a valid connection is established? Sounds like science fiction, but this is real and makes me headache.
     
  8. Tarq57

    Tarq57 Registered Member

    Joined:
    Oct 7, 2006
    Posts:
    966
    Location:
    Wellington NZ
    I'm not knowledgeable about this sort of thing, but is it possible he's connecting via wireless, and it's not encrypted, and someone nearby is piggybacking off the signal?
     
  9. softtouch

    softtouch Registered Member

    Joined:
    Jan 31, 2006
    Posts:
    415
    No, he does not have a wireless network...
     
  10. acknsyn

    acknsyn Registered Member

    Joined:
    Aug 10, 2007
    Posts:
    27
    Has the user format his PC just to rule out software possibilites?
    It doesnt sound like a session hijack as the OTHER user is registering an account.
     
  11. SteveTX

    SteveTX Registered Member

    Joined:
    Mar 27, 2007
    Posts:
    1,641
    Location:
    TX
    The simplest solution is that your logs are wrongly recording any guest actions as through his IP address. You may be chasing a phantom that is only a software bug.
     
  12. softtouch

    softtouch Registered Member

    Joined:
    Jan 31, 2006
    Posts:
    415
    No, I am not chasing a phantom at all, because cports reports the same... even the routers log shows the same, 2 times the same IP.
    The forum shows the same IP, cports shows the same and also the routers established connection list shows the same...

    However, this problem seems to be solved for the meantime. Our ISP's here started migrating all the clients to their new NGN (Next Generation Network) and since then (a couple of days ago), nothing happened anymore.

    Its just something which drives me crazy, not being able to figure it out.
     
Loading...
Thread Status:
Not open for further replies.