Who operates or announces this IP address?¶
title: "Who operates or announces this IP address?" card_id: "IP-071" status: "complete" source_document: "https://docs.google.com/document/d/1wcHHujeMPAJAFekRe1LS5uQ42HVgKY3PoRzSyW3KQHk/edit?usp=drivesdk"
Who operates or announces this IP address?¶
Who operates or announces this IP address?¶
An IP lookup may show several different organisations connected with the same address.
One may be registered for the address range. Another may appear as the network announcing it.
So which one actually operates the address?
Internet traffic reaches an IP address because networks announce routes showing where that traffic should be sent.
Those announcements are associated with Autonomous System Numbers, usually shortened to ASNs.
The network announcing the route is often the internet provider, hosting company or other organisation currently carrying traffic for the address range.
But the organisation registered for the address block and the organisation announcing it aren't always the same.
A large provider may announce addresses on behalf of a customer. A business may hold its own address range but use another network for connectivity.
A hosting company may assign an individual address to a customer while continuing to announce the wider range itself.
Resellers, subsidiaries and managed-service providers can add further layers.
This means that “owner”, “operator”, “registrant” and “announcing network” shouldn't be treated as interchangeable labels.
The announcing network can help show where traffic is currently routed and which network may be involved in delivering the service.
The registration record can identify the organisation responsible for the address range and provide contact information.
Neither result normally identifies the customer who used one individual address at a particular time.
The information is also time-sensitive.
Routing arrangements can change, and address ranges can be transferred or announced by different networks. A current result may not describe the position when an older event occurred.
The practical question isn't simply:
“Who owns this IP address?”
It is:
“Which organisation managed or routed this address at the relevant time, and who is likely to hold the records needed for this enquiry?”
Registration and routing information can identify the relevant network infrastructure.
They don't, by themselves, identify the subscriber, device or person responsible for the recorded activity.