What records might exist for this type of infrastructure?¶
title: "What records might exist for this type of infrastructure?" card_id: "IP-075" status: "complete" source_document: "https://docs.google.com/document/d/1Xb_ShAXRgSu7oFr68obOPmyCRGYW6B4_vmEyvHMvpxg/edit?usp=drivesdk"
What records might exist for this type of infrastructure?¶
Knowing who operates an IP address is only part of the problem.
You also need a realistic idea of what that organisation might have recorded.
An ordinary broadband provider may retain address-allocation records linking a public IP address and time with a customer connection.
If CGNAT was used, separate translation records may connect the public address and source port with an internal customer session.
A mobile provider may hold session and subscriber information associated with its mobile-data network.
A workplace or school may hold DHCP records showing private-address allocations, Wi-Fi authentication records, firewall or proxy logs, user-directory information and device-management records.
A hotel or public Wi-Fi operator may have captive-portal registrations, voucher records, access-point associations or private-address allocations.
The records may be split between the venue and an external company managing the Wi-Fi.
A VPN or commercial proxy service might hold account records, payment information and connection logs linking an incoming customer address with an outgoing service address.
But it might deliberately keep very limited logs—or retain them only briefly.
A cloud or VPS provider may hold records identifying the customer account and virtual resource allocated the address.
It may also record billing, control-panel activity and administrative connections.
Those records don't necessarily describe what happened inside the customer’s server or application.
The online platform where the event occurred may hold a different set of information: account activity, timestamps, session identifiers, source addresses, device information and the content or action associated with the event.
The existence of a possible record doesn't mean it was actually created, retained or recorded accurately.
Logging depends on system design, configuration, retention policy and the observation point.
Before expecting a particular answer, identify what technical relationship the organisation could genuinely observe.
An address provider can often explain allocation. A platform can explain the event it recorded. A local network may connect an internal address with a device.
No one record automatically proves the entire journey from online activity to the person responsible.