Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm just looking through our web logs and noticed a user who logs in and appears to be using two different IP addresses as he browses the website.

ie. some of the request for images and scripts come from a different IP to the one that requested the login page.

Under what sort of setup would this occur?

share|improve this question
I'd bet money he's behind a load balancing proxy or something similar. The answer below makes this sound nebulous or uncommon, but it's very common in larger business and institutional (schools, government, etc) settings. – Chris S Jan 21 '13 at 3:22
up vote 3 down vote accepted

This setup is not common, but it is also less rare than you think. It's possible in some scenarios, I can think of the following:

  • Users having more than one connection at home (for reliability or other reasons) and who use a random one for each connection (possible to set it up that way)
  • Using TOR or other VPN/anonymation services can cause users to suddenly switch IP
  • Some strange corporate/offices environments

It's something that you should definitely take into account. When I was working for a very big website I implemented a SSO (Single Sign-on) system that assumed the IP of two subsequent web requests was the same if the user was the same.

Surprisingly to me at the time, dozens of users complained of things being randomly broken, and after some investigation I discovered that all of them had more than one IP. Granted, we received millions of visitors so the percentage is very very tiny, but those people are out there and they can be "legit".

share|improve this answer
Hmm interesting. Same situation - I'm implementing some security as well assuming that the IP is the same request to request. Thanks for your answer. – Dan Jan 21 '13 at 2:37
Just to name another practical scenario: Mobile devices in weak wifis that are constantly switching between cellular network and the local hotspot. This might not happen so frequently that consecutive requests are coming from different IPs, but in a longer session you will of course see the user originating from different networks. – Karma Fusebox Jan 21 '13 at 3:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.