duplicate IP addresses on my Unix server from User connections

[Nick D'Angelo]

Twice today, I noticed that two different machines (PCs with Term EMulation) connected to my Unix server that had the same IP address. I went to the user and logged them off, however the Unix server still shows the user as being logged on but I can not kill the process.

Obviously, this is not a good scenario.

Other important tid bits: we have two (MS) domains that both have DNS servers.

Other than that, I am not sure what to tell you, any ideas/suggestions are most appreciated.

Nickd

[harry d brown jr]

What information did you obtain to determine that you had two different PC's sharing the same IP's?

You said that you logged out the user but some process attached to that user is unkillable. What is that process?

Did you check DNS to make sure that you don't have two pc's sharing the same ip?

live free or die
harry

[doug mielke]

log them back in one at a time and try to kill the process. If they've rebooted ( or otherwise obtained another IP address) this may not help, but you could assign them the old address manualy, log them in to try to get the process killed.

Also, after 20 minutes or so of inactivity, the arp table entry will be deleted, which in itself could clear this up, depending on how the process is hung.

[Helen French]

It might be the same system but runs different applications on the unix server with different user names. Check what process it runs? Trace the network path and see if it's the same.

[harry d brown jr]

Do you possibly have a citrix server with the Term EMulation software on it that the users are executing from there? If so, then yes, you would look like duplicate IP's, though each PC would have a "connection" through a different "port".

Do you have "lsof"?? If so, use it to really see what is in use (to get it --> http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.67/)

live free or die
harry

[Ron Kinner]

It's possible to set up NAT with only one registered IP address. To those on the other side everyone behind the NAT will appear to be have the same IP address. Only the port number will differ.

Ron

[Steven E. Protter]

Unless this is web traffic coming in by NAT, it should not happen.

It is possible for two clients coming from say the same firewall outside your building to connect with the same IP address. This should not be a problem, nor should it create the locked process problem you have now.

More likely there is an overlap between the two Microsoft DNS servers that needs to be corrected. Getting those Microsoft people to admit a problem can be troublesome, but thats the way to go with this issue.

SEP

[Zigor Buruaga]

Hi,

Have you tried "netstat -n grep your_client_ip" to see if it shows anything?
Maybe the user is not really logged on, so look for ghost users ... only an idea.
Check this:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x45ff4fbb72bb8e4cbbb50d7fde76be6c,00.html

Hope this helps.
Regards,
Zigor

[Suresh Patoria]

Hi,

i think user not properly logout

i think that user directly close the window

that time that for perticular user process will running on the system

if want to kill than use the kill -9 << process ID >>

wait for some time

it will take some time to kill all the user process

it's better to user logout properly using exit command

Thanx

[Nick D'Angelo]

All,

If I did a who -u | grep username, the user would show up.

If I did a ps -ef | grep username, there were no processes active for the user.

The kill -9 did not work, it replied that the process did not exist.

Nickd

[Zigor Buruaga]

Hi,

You have ghost users, try to correct the file "/etc/utmp" with the attached script.
Hope this helps.
Regards,
Zigor

[Nick D'Angelo]

It looks like there is a patch that I need to get, PHNE_24829. It references:

3. Incorrect records might be written to /etc/utmpx by telnetd when it exits.