What could the recording system actually see?¶
Every system records a connection from its own position in the network.
That position affects which IP address it can see and what that address represents.
An online platform will normally record the public IP address presented to it when somebody connects.
That might be the public address of a home connection.
But it could also belong to a mobile provider, workplace, hotel, VPN, proxy, cloud service or other shared infrastructure.
The platform won’t normally see the private IP address used by the person’s phone or laptop inside their home or workplace.
It sees the address presented to it across the internet.
A router or firewall has a different view.
It may record traffic moving between private devices inside a network and services outside it.
Depending on the record, it might show:
A private source address.
A public destination address.
The public address used after translation.
Or information connecting the internal and external parts of the traffic.
A record created on a device has another viewpoint.
It might show an address assigned to that device.
It might show the address of a remote system the device contacted.
Or it might show a loopback address used by software communicating within the device itself.
You need to know which one you’re looking at.
There can also be other systems between the user and the service.
A platform may sit behind a proxy, load balancer or other gateway.
The application might record the address of that intermediary rather than the original public source address.
Some systems pass information about the earlier connection through another field. Common names include X-Forwarded-For and Forwarded, although you may see other names depending on the service. These fields may contain one address or a chain of addresses. Don’t assume that any address in the field is the original source until you understand which systems created or added to it.
Others may not record it at all.
If a platform gives you several possible address fields, establish which one was observed from the original connection and which ones belong to its own infrastructure.
Email records need similar care.
An email header may contain several IP addresses showing different servers involved in moving the message.
One of those addresses isn’t automatically the address of the sender’s device.
You need to understand which system added each part of the header and which stage of delivery it describes.
None of this means the records are wrong.
It means they’re observations made from particular positions.
Before interpreting an IP address, establish:
Where the recording system sat in relation to the connection.
Whether the address was recorded as a source, destination or local address.
Whether another service sat between the system and the original connection.
And whether the address was directly observed by the system or supplied through another field.
You should then be able to describe the record precisely.
For example:
“The platform recorded this as the public source address presented during the connection.”
Or:
“The firewall recorded this as the private address of a device inside the local network.”
Or:
“The application recorded the address of its local proxy. The original public source address hasn’t yet been established.”
That is much more accurate than saying:
“This was the user’s IP address.”
The system can only tell you what it observed from where it was sitting.
Once you understand that viewpoint, you can move on to the next question:
What event did the system actually record?