The IP belongs to a mobile network—what changes?¶
title: "The IP belongs to a mobile network—what changes?" card_id: "IP-063" status: "complete" source_document: "https://docs.google.com/document/d/1ufEvr0IxqPhbpavY3Cbsf9J0Mbk-xiSGPhl2kUWuBFY/edit?usp=drivesdk"
The IP belongs to a mobile network—what changes?¶
The IP belongs to a mobile network—what changes?¶
An IP lookup shows that the address belongs to a mobile network.
The basic attribution question remains the same:
Which customer or network session was using the address at the relevant time?
But mobile networks create some additional complications.
Mobile providers manage very large numbers of devices moving between different parts of their network. Addresses and network sessions can change as devices connect, disconnect, roam or move between mobile data and Wi-Fi.
Many mobile networks also use CGNAT.
That allows several customers to share one public IPv4 address at the same time.
In that situation, a public IP address and timestamp may not be enough to identify one customer. The provider may also need the public source port and protocol recorded by the external service.
Time precision is particularly important.
Mobile sessions and CGNAT translations can change quickly. A timestamp rounded to the nearest hour—or even the nearest minute—may leave several possible matches.
If the provider produces a result, it may identify a subscriber account, SIM or network session associated with the connection.
That still doesn't necessarily identify the handset.
A SIM can be moved between devices. A phone can provide a hotspot for a laptop, tablet or another person’s device. Several applications can also generate traffic automatically without the user deliberately opening them.
The account holder may be an employer, parent, family member or organisation rather than the person holding the phone at the time.
Roaming can add another layer because the customer’s home network and the network carrying the traffic may be operated by different organisations.
The public address may therefore identify a mobile-network gateway rather than the physical location of the handset.
A mobile IP result can be a valuable step towards identifying an account, SIM or session.
But it shouldn't be described as proof that a particular handset generated the activity—or that a particular person was using it.
Mobile attribution still requires the same disciplined chain:
connection details, provider mapping, subscriber or session, device, user and, finally, the person responsible.