What could the recording system actually see?¶

A system records traffic from its own position in the network. The address in the record describes that viewpoint; it does not necessarily describe the device or person at the beginning of the journey.

The simple model¶

Imagine looking at a road through one camera. The camera can record what passes its position, but not everything that happened further along the road.

A service, router, device, proxy and mail server are different observation points. Each may record a different address for the same activity.

Common observation points¶

System	What it may see
Website or online platform	The public address presented to the service
Router or firewall	Local and public addresses, destinations and translation details
Device	Its own local address and the remote address it contacted
Proxy, gateway or load balancer	The connection arriving at that intermediary
Email system	Addresses added by mail servers at different delivery stages

An online platform will not normally see a laptop's private address inside a home. It sees the address presented across the internet. That may belong to a home connection, mobile network, workplace, hotel, VPN, proxy or cloud service.

Systems in the middle¶

A platform may sit behind a content delivery network, reverse proxy, load balancer or gateway. The application may therefore record the intermediary's address.

Some systems pass an earlier address in a field such as Forwarded or X-Forwarded-For. Treat that value as meaningful only when the service can explain which trusted system added or validated it.

See why a CDN, reverse proxy or load balancer may appear for the deeper mechanism.

Ask what the field means¶

For each address, establish whether it is:

• source or destination;
• public or private;
• before or after network translation;
• local to the recording system;
• directly observed; or
• reported by another system.

If several addresses appear, choose the one that answers the question you are asking.

A worked description¶

The platform recorded a public source address presented during the login. The application sits behind a reverse proxy, so the proxy address appears in the application connection field; the earlier address is held in a trusted forwarded field.

That is more useful than saying simply “the IP address was recorded”.

What this changes¶

Once the observation point is clear, you can decide which organisation or record holder to approach. The address may identify:

• the subscriber connection;
• shared provider infrastructure;
• a VPN, proxy or cloud service;
• a local device; or
• another system in the route.

It is still a technical lead, not an identity conclusion.

Continue with what event the system actually recorded.