The IP belongs to a workplace, school or other organisation—what changes?¶
title: "The IP belongs to a workplace, school or other organisation—what changes?" card_id: "IP-064" status: "complete" source_document: "https://docs.google.com/document/d/1Q99jGQOgPp5s-Ac8vPahTXU23SLOUsRLet0R1QnhOds/edit?usp=drivesdk"
The IP belongs to a workplace, school or other organisation—what changes?¶
The IP belongs to a workplace, school or other organisation—what changes?¶
An IP lookup shows that the address belongs to a workplace, school, university or other organisation.
That changes the attribution route.
The public address may represent the organisation’s internet gateway rather than an individual customer connection.
Hundreds or thousands of users and devices can share that gateway.
The organisation may use NAT, web proxies, firewalls, VPN concentrators or other systems that make many internal connections appear under one or a small number of public IP addresses.
Resolving the address through the internet provider may therefore identify only the organisation or its network service.
That doesn't identify the employee, student, visitor or device responsible for the recorded activity.
The next useful records are more likely to exist inside the organisation.
A DHCP log may show which device was allocated a particular private IP address.
Wi-Fi records may show which device or account authenticated to an access point. Network-access systems may record usernames, device certificates or managed-device identities.
Firewalls and proxy servers may connect an internal address or authenticated account with an external destination.
Device-management and asset records may show who was issued a particular laptop or phone.
But these records have to be joined using the correct timestamps and network fields.
The private address used inside the organisation may have changed. Several people may use one machine, and one person may use several devices.
Accounts can be shared, compromised or left signed in. Device-allocation records can also be out of date.
Remote working creates another complication.
Traffic from somebody at home may pass through the organisation’s VPN and appear to come from the workplace’s public address, even though the device was physically elsewhere.
The organisational IP address is therefore the entrance to a local attribution process.
It may lead to internal network, authentication and device records that narrow the activity to a system or account.
It doesn't, by itself, identify the person who performed the activity.