Session Reuse

The application is an ASP app using a Sql Server 2000 back end, w/ IIS 5.5. It uses NT authentication. We use BigIP for load balancing across 4 servers, and have enabled active cookies for state maintenance w/in BigIP. An employee_ID and some other basic identifying info is stored in the cookie.

After significant log file and SQL Server Trace review, I've determined that the application is reusing existing sessions and their stored information when it
shouldn't. What happens is that a user logs in and works for a while under a session id. At some point, a second, new, session ID is created for them. At this point, if another user logs in, they (may) be using the original users first session ID, with all of the original users identifying info. I haven't been able to isolate exactly what causes the new ID to be created in the first place, it isn't consistent. Obviously, this causes all sorts of problems, "turning one person into another" as the users say.

I'm at a loss. With the session ID tracing back to a different user, all the normal ways to ID the logged in user -- like the Logon_User server variable -- trace to the wrong person. I have determined that IIS logs the cs_Username for the user that's really sitting at the computer, the "correct" user. If I could find a way within the ASP code to pick up that cs_Username, I could circumvent the problem by modifying the session state check include file, but I've had no luck.