IP Addresses

[WaldoMcFroog]

On a phpBB bulletin board, I have discovered two usernames posting from the same IP address. My understanding is that this conclusively proves the same machine is being used by these two usernames, (though not whether two users might be using the same machine). Am I correct?

Additionally, I have the IP. I've tried running it through Sam Spade to no avail. How can I determine the origin of the IP? Many thanks!

[MargeB]

2 users might be using different machines but via a network with one internet connection.

[kempie]

It doesn't conclusively prove the same machine - multiple users could be routed through an ISP server or proxy server.

What is the IP address?

[OBonio]

A colleague here would appear to have the same IP as me. Origin of the IP.... tracert from a command line might give you a hint. Visual Traceroute might be easier again.

[j2buttonsw]

On the command line try using ping -a <IP address>  (eg ping -a 212.58.224.121) and see what the DNS record for this IP address is (my example is the bbc.co.uk).

[WaldoMcFroog]

I'd rather not give the IP - you never know who's watching, but thanks for all your replies!

[badams]

If a router and/or firewall are being used by a network, all traffic (unless the administrator decides otherwise) will appear to come from one address.  Our network in work has 16 public IP addresses, but has over 300 stations using private addresses behind the firewall.

In this type of scenario, ping -a may not work - it is common practise for the public facing shared IP address not to have a dns entry, and the router will not respond to pings on this address - this is a very basic technique used to reduce the possibility of Denial Of Service attacks.

OBonio, I am surprised that two machines appear to have the same IP address, especially if both work!  This is generally not possible.  It could be done by using VLANs on the network switches, and messing around with the way your internal routers are set up, but usually this would be pretty pointless.  Unless both machines are using IP to communicate with the internet, I suppose your network may be working on IPX/SPX to talk to a Novell server or something, which would mean that the IP address does not matter, however, if IP is working properly on both machines, this would usually give an alert to at least one user to say there is a conflict.

[kempie]

In what way did Sam Spade fail?

Have you tried other lookup sites?

http://www.zoneedit.com/whois.html 

[WaldoMcFroog]

Tried your link Kempie and it too failed. Not sure why!

My belief is that the network this person is posting from is likely to be a small one - the person concerned works in a non-IT related business unlikely to have more than 10 staff.

Am I right in thinking this increases the chances of it being a C type IP address - Network, Network, Network, Local?

[Kerplunk]

It is most likely that the internal (Private) IP range will be a class C, eg. 192.168.1.0.  But the external IP (Public) wil be provided by an ISP so will most likely be a class A address.

[OBonio]

badams - thank you for the protocol overview... not sure I need it, but thanks anyway. You managed to completely misinterpret what I was saying anyway.

What I meant was FROM Waldo's point of view, it would appear that a colleague of mine would have the same IP as me.

By the way, IPX isn't routable and who runs Novell servers nowadays?