What information must accompany an ISP subscriber request?¶
title: "What information must accompany an ISP subscriber request?" card_id: "IP-077" status: "complete" source_document: "https://docs.google.com/document/d/14xHz7aDbEjAr53beTQyUrBrcCW6syZpPJkSmWO8fsSs/edit?usp=drivesdk"
What information must accompany an ISP subscriber request?¶
An ISP can't normally identify a customer from an IP address alone.
It needs enough information to locate the correct allocation in its records.
The request should include the complete public IP address exactly as recorded.
It must also include the relevant date and precise time.
The time zone or UTC offset needs to be explicit.
“Ten thirty on Friday” isn't sufficient if the provider has to decide whether that means UTC, British Summer Time or another local time.
The available precision should be preserved.
If the original system recorded seconds or milliseconds, don't round the value before sending it.
The request should make clear what the timestamp represents.
Was it the time a login occurred, a connection reached a server or an alert was generated later?
It should also identify the field containing the address.
A source IP, destination IP, forwarded address and internal address don't perform the same role.
If a public source port and protocol were recorded, include them.
They may be essential where the provider uses CGNAT or another shared-address system.
The destination address and port may also assist where they form part of the provider’s matching process, but requirements vary between providers and systems.
Enough context should be supplied to explain the requested match without replacing accuracy with a broad narrative.
The provider needs to understand which technical event and identifier it is being asked to check.
Before sending the request, confirm that the provider controlled the relevant address at the event time.
A present-day lookup may point to the wrong organisation if the address range has since changed hands.
A properly formed subscriber request asks a narrow question:
Which customer connection or account did the provider’s records associate with these exact connection details at this exact time?
The answer may identify a subscriber connection.
It won't, by itself, identify the device, user or person responsible for the recorded activity.