Question

I have a log table containing user ids, ip addresses and log in datetimes. I need to find out who are the users who pretend to be other users by setting up multiple accounts.

This is my sample log table:

+---------+-------------+---------------------+
| user id | ip address  | log in datetime     |
+---------+-------------+---------------------+
| 17      | 192.168.1.4 | 2012-04-01 00:01:00 |
+---------+-------------+---------------------+
| 21      | 192.168.1.2 | 2012-04-01 00:02:00 |
+---------+-------------+---------------------+
| 11      | 192.168.1.5 | 2012-04-01 00:06:00 |
+---------+-------------+---------------------+
| 1       | 192.168.1.3 | 2012-04-01 00:09:00 |
+---------+-------------+---------------------+
| 3       | 192.168.1.3 | 2012-04-01 00:15:00 |
+---------+-------------+---------------------+
| 8       | 192.168.1.5 | 2012-04-01 00:22:00 |
+---------+-------------+---------------------+
| 9       | 192.168.1.1 | 2012-04-01 00:26:00 |
+---------+-------------+---------------------+
| 13      | 192.168.2.1 | 2012-04-01 00:27:00 |
+---------+-------------+---------------------+
| 2       | 192.168.1.1 | 2012-04-01 00:28:00 |
+---------+-------------+---------------------+
| 33      | 192.168.1.7 | 2012-04-01 00:30:00 |
+---------+-------------+---------------------+
| 27      | 192.168.1.1 | 2012-04-01 00:31:00 |
+---------+-------------+---------------------+
| 22      | 192.168.1.7 | 2012-04-01 00:45:00 |
+---------+-------------+---------------------+

So, here is my question: how to select a list of user ids having the same ip address and with log in time difference of less than 5 minutes?

Answer 1

How about something like this –

SELECT *
FROM log l1
INNER JOIN log l2
    ON l1.ip_address = l2.ip_address
    AND l1.user_id < l2.user_id
    AND l1.login _time BETWEEN (l2.login_time - INTERVAL 5 MINUTE) AND (l2.login_time + INTERVAL 5 MINUTE)