Why can’t a provider identify one customer from some public IP addresses?¶
title: "Why can’t a provider identify one customer from some public IP addresses?" card_id: "IP-028" status: "complete" source_document: "https://docs.google.com/document/d/1Yca2GZKd58JirfxqVh-vS4z_gncKqD2zs81zoik8Jzw/edit?usp=drivesdk"
Why can’t a provider identify one customer from some public IP addresses?¶
Sometimes a provider can confirm that a public IP address belongs to its network but still can’t identify one customer who was using it.
One possible reason is carrier-grade NAT, usually shortened to CGNAT.
With an ordinary home connection, the devices in the property normally share one public IP address through the router. Although several devices use that address, the provider may still have allocated it to one customer connection at that time.
CGNAT introduces another layer of sharing inside the provider’s network.
Instead of giving every customer a separate public IPv4 address, the provider can allow many customers to use the same public address simultaneously. This is commonly done because the supply of available IPv4 addresses is limited.
The provider’s CGNAT system keeps the customers’ connections separate by translating each connection using additional information—particularly a source port.
This means that a platform may record the same public IP address for activity generated by several different customers at the same time. The public IP address alone may therefore lead back to a group of customers rather than one customer.
To identify the correct translation, the provider may need:
the public IP address;
the precise date and time, including seconds;
the relevant time zone;
the public source port; and
sometimes the protocol, such as TCP or UDP.
Without the source port, the provider may find that several customers were using the address at the specified time. It can’t simply choose one of them.
The precise time also matters because source ports and address translations can be reused. A difference of a few seconds—or a mistake in the time zone—may point to a different connection.
Even when all the necessary information is supplied, a result isn’t guaranteed. The provider may no longer retain the relevant translation logs, the recorded time may be insufficiently precise, or the requested data may fall outside its retention period.
And if the provider does produce a match, that result normally identifies a customer account or connection. It doesn’t, by itself, identify the device, the person using it or the person responsible for the activity.
CGNAT doesn’t make attribution impossible. It changes the information needed to perform it. A shared public IP address without the associated source port may identify the provider’s infrastructure, but not one particular customer.