dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
704
Sentinel
Premium Member
join:2001-02-07
Florida

Sentinel

Premium Member

Odd double IP address

A very odd thing just happened to me. I have a cable ISP and the cable modem is connected to my Zywall 10. From the Z10 it goes to a switch. From the switch one port has my Zyair B1000 WAP and another port has my desktop PC.

Usually I would think that I only have one IP address, that is the IP address dynamically assigned to my Z10 from my cable company. The odd thing that just happened was that my wife was using the desktop and I was using my laptop and we both went to the same forum and in that forum it shows your IP address. My wife and I had different IP addresses!!! How can this be? I checked the Z10 and it only showed 1 IP address for the Z10 in the system properties.

My PCs all have static IP addresses. I have the DHCP server of the Z10 turned off.

I rebooted the Z10 and updated to the new firmware which I was going to do anyway. After doing that I checked the log of the Z10and I saw the following odd log entries...

54 Sat Jan  1 00:00:11 2000 PP0d  INFO  DHCP client gets 0xc0a8640b
57 Sat Jan 1 00:00:27 2000 PP0d INFO DHCP client gets 0xXXXXXXXX
Does this entry mean that I am getting 2 IP addresses somehow?

Edited out the second hex number which was my real IP address :) OOps

[text was edited by author 2003-10-19 18:52:01]

Anav
Sarcastic Llama? Naw, Just Acerbic
Premium Member
join:2001-07-16
Dartmouth, NS

Anav

Premium Member

Kewl trick
Which site that checks ur IP addresses, I am willing to try with two diff PCs here...
jbibe
Premium Member
join:2001-02-22

jbibe to Sentinel

Premium Member

to Sentinel
said by Sentinel:
Does this entry mean that I am getting 2 IP addresses somehow?
The first address is a private address (192.168.100.11). My guess -- it is a DHCP address assigned by your modem. The second appears to be the WAN address assigned by your ISP.

My Surfboard modem assigns addresses starting at 192.168.100.11. The WAN address replaces the private address when it is available.

[text was edited by author 2003-10-19 18:11:46]

Bill_MI
Bill In Michigan
MVM
join:2001-01-03
Royal Oak, MI
TP-Link Archer C7
Linksys WRT54GS
Linksys WRT54G v4

Bill_MI to Sentinel

MVM

to Sentinel
You can double-check your public IP from each box here: »checkip.dyndns.org:8245/

Maybe the "forum" is a special program seeing your LAN (not public) address? Any chance 1 PC is going through a proxy? Are both addresses ISP or private addresses? (private addresses are 192.168.x.x, 10.x.x.x and 172.(16-31).x.x).

I'm not up on the Z10 but those log entries seems to be saying a DHCP client has pulled 192.168.100.11 (a private address) and the second one is a 24.136.x.x address which may be your public IP if you want to edit it out.
Sentinel
Premium Member
join:2001-02-07
Florida

Sentinel

Premium Member

It is my private forum that I have running phpBB for my family only. When I log in as admin I can see everyones IP address that is currently logged into my forum and I saw my wife and I with 2 different IP addresses. Usually we have the same one when we are logged in at the same time since we are both going through my router.

The second IP address was almost the same as the first. My IP address and hers both began with 24.136. but the last two octets differed so they were both WAN(public) IP addresses. As a matter of fact her IP address was one that I have had in the past. My IP address does not change often with this cable ISP but it does change sometimes.

Bill_MI
Bill In Michigan
MVM
join:2001-01-03
Royal Oak, MI
TP-Link Archer C7
Linksys WRT54GS
Linksys WRT54G v4

Bill_MI

MVM

Great! You edited out that IP.

I can only come up with 2 scenarios:

1) You are pulling 2 IPs from your ISP somehow. Could the Z10 be set to something like "DHCP Relay"?

2) Your ISP and/or browser is accessing through a proxy. One is, one isn't, or some combo. This gets complex but there's a check and short explanation here: »www.dnsart.com/myip.php

Anyone with another possibility?
[text was edited by author 2003-10-19 19:15:55]
Sentinel
Premium Member
join:2001-02-07
Florida

Sentinel

Premium Member

That's what I was wondering. I was thinking that somehow my Z10 is pulling 2 IPs but I don't know how or why or how to stop it. I don't know how my desktop is doing it even since it has a static IP address in the 192.168.1.x range.

I will look at the proxy link you have but I have no idea how anything like that could be happening.

ThreeD
Premium Member
join:2001-05-19
Southern Cal

ThreeD to Sentinel

Premium Member

to Sentinel
Could the laptop be on wireless? Possibility of it connecting to a neighbors wireless network and thus not actually going through the router?
Sentinel
Premium Member
join:2001-02-07
Florida

Sentinel

Premium Member

Possible since my neighbor is a PC buff like me but not likely. I have all security turned on on a Zyair B100 card on laptop. I don't even see any other WAPs and even if I did I don't think I would be able to connect since I have 802.1x on and every other encryption and authentication thing on. I think it would highly unlikely that I would be able to connect to his WAP even if it was wide open. Wouldn't all this security stuff be stopping my laptop from connecting to him?

And also when I am on the desktop and I check my IP address using any web based IP address identifier it tells me the same IP address that my laptop has. And the router tells me the same IP address as well.

The only place I see a different IP address is when I log on to the forum using the desktop. It says I am a different IP address. When I log into the forum using my laptop it says the correct public IP address that everything else says I have.

Bill_MI
Bill In Michigan
MVM
join:2001-01-03
Royal Oak, MI
TP-Link Archer C7
Linksys WRT54GS
Linksys WRT54G v4

Bill_MI

MVM

Interesting. It sounds like phpBB may be the culprit? Is it running on your LAN or outside somewhere?

EDIT: Congrats to ThreeD as he came up with a grand 3rd scenario. 4th is a bug in phpBB, I guess.
[text was edited by author 2003-10-19 22:29:45]
Sentinel
Premium Member
join:2001-02-07
Florida

Sentinel

Premium Member

It is running on my website which is hosted remotely by a hosting company.

Bill_MI
Bill In Michigan
MVM
join:2001-01-03
Royal Oak, MI
TP-Link Archer C7
Linksys WRT54GS
Linksys WRT54G v4

Bill_MI

MVM

Well, thinking phpBB is somehow creating a credible IP out of the air is unnerving. Know what I mean? It doesn't seem like a viable answer. I think the laptop is somehow pulling a second IP from your ISP. I'm not much help on wireless but those that are may be able to come up with some ideas and checks.

I'm not sure it means anything unless you are charged for an extra IP or you're really going through a neighbor's system.

You might want to lookup that "extra" IP to see if it's a customer address and not an ISP server (still thinking a proxy may be involved).
[text was edited by author 2003-10-20 07:52:08]

ThreeD
Premium Member
join:2001-05-19
Southern Cal

ThreeD to Sentinel

Premium Member

to Sentinel
said by Sentinel:

The only place I see a different IP address is when I log on to the forum using the desktop. It says I am a different IP address. When I log into the forum using my laptop it says the correct public IP address that everything else says I have.
If I read this correctly, it is the Desktop that is showing a different IP? If the desktop is the IP that is changing and the laptop is showing your normal IP, then that pretty much rules out any issue with the wireless side of the system. (This assumes that the desktop is "plugged into the Zywall" and is not wireless).
jbibe
Premium Member
join:2001-02-22

jbibe to Sentinel

Premium Member

to Sentinel
said by Sentinel:
The odd thing that just happened was that my wife was using the desktop and I was using my laptop and we both went to the same forum and in that forum it shows your IP address. My wife and I had different IP addresses!!! How can this be? I checked the Z10 and it only showed 1 IP address for the Z10 in the system properties.
Al, Did you check today to see if you still show two WAN IP addresses?

Another theory: Assume one user has an active connection when lease renewal occurs and the ISP assigns a new IP address during the renewal. If the second user connects to the same external web site, would the Z10 appear to have two WAN addresses?
Sentinel
Premium Member
join:2001-02-07
Florida

Sentinel

Premium Member

ThreeD,
You are correct. My laptop showed the same IP address that my Zywall says I should have. It was the desktop that had an odd IP and the desktop is hard wired; not wireless.

jbibe,
Last night I unplugged everything hoping this would all just go away. Today I powered everything up fresh and so far everything seems normal. Both machines logged in and both have the same IP address as it should be since they are both going through the Zywall which is the only thing that should really have an IP address anyway.

Your theory regarding the lease renewal thing sounds interesting. My ISP has been changing my IP address a lot lately. I had the same IP address for months and now I have had a new one almost every other day. Could this be the culprit?

At any rate all seems normal now. I'll post again if it happens again as I think this is most interesting and odd. At first I thought it was a security issue. I was wondering if someone at a different IP address was doing something funny.

NetBoot2
I Don't Suffer From Insanity, I Enjoy It
join:2003-04-21
Hazleton, PA

NetBoot2

Member

Well, that sounds interesting to say the least. My guess from what your saying is that it's an ISP issue not clearing it's DNS cache (ISP Reverse/Transverse-NATing) with it's DHCP. Since, your constantly always on, and you have a valid MAC address. Now, the bigger question is how could the ZyWALL pull 2 ip's? Unless there's some kind of bug, since I don't believe the ZyWALL's WAN port can support both WAN and a VWAN. Unless, ZyXEL has something up it's sleve...

Also, another thing comes to mind. I know that my cable ISP gives me 2 dynamic public ips. So, it looks as thou your ISP has some configurations problems. Plus, the fact that your ISP is now giving you new IP's on a regular bases it seems.
[text was edited by author 2003-10-20 16:18:45]
Sentinel
Premium Member
join:2001-02-07
Florida

Sentinel

Premium Member

Yes, I thought it was impossible for the Zywall to have 2 public IPs so that was why I posted here. My first thought was that something was definitely fishy in Denmark with my Zywall.
(no offense to those from Denmark )

NetBoot2
I Don't Suffer From Insanity, I Enjoy It
join:2003-04-21
Hazleton, PA

NetBoot2

Member

If ZyXEL can somehow work with this bug. Then I could be possible in theory to have a WAN and a VWAN and have two public ip address without the need of a second port! That would be great if it is a bug and it can work out to be an advantage. Only down side that I can see is the mac address on the unit. It would require two mac address. Maybe you can forward your problem and find an answer from ZyXEL.
anticowboy
join:2003-10-10
Los Angeles, CA

anticowboy to Sentinel

Member

to Sentinel
I thought the Z10 had Multi-NAT, which lets you do a Many-One-to-One mapping, which maps each local IP Address to a unique Global IP Address. IF this is enabled, it would allow the Z10 to pull an additional IP from your ISP for each unique private IP address.

Check the config page called Address Mapping under SUA/NAT
Sentinel
Premium Member
join:2001-02-07
Florida

Sentinel

Premium Member

I don't know where that is. Can you tell me a little better where I might find that setting? Using telnet or web?

SYNACK
Just Firewall It
Mod
join:2001-03-05
Venice, CA

SYNACK

Mod

NO, only one WAN IP can be obtained automatically. All additional WAN IPs must be static.
Sentinel
Premium Member
join:2001-02-07
Florida

Sentinel to anticowboy

Premium Member

to anticowboy
I found what you were talking about. It was on the web GUI which was why I didn't see it because I usually use telnet. It is blank but I guess it doesn't matter due to what Synack said.