The record contains several IP addresses—which one matters?¶
The record contains several IP addresses—which one matters?¶
A network record may contain several different IP addresses.
That doesn’t necessarily mean that several people or devices were involved. The addresses may describe different parts of the same communication.
The first distinction is usually between the source and destination addresses.
The source IP address identifies where the recorded traffic appeared to come from at that observation point.
The destination IP address identifies where it was being sent.
If somebody connected to an online service, the service’s address may appear as the destination. Resolving that address would identify the service’s infrastructure—not the customer who connected to it.
But the field labelled “source IP” shouldn't be accepted blindly either.
The system may have received the connection through a router, proxy, VPN, load balancer or another intermediary. In that case, the source address visible to the recording system may belong to that intermediary rather than the originating connection.
Some records include both internal and external addresses.
An internal address—such as one beginning 192.168 or 10—may identify a device within a particular local network. It can't normally be resolved through an internet provider because the same private addresses are reused across millions of networks.
The accompanying public address may identify the internet connection through which that local device communicated.
NAT records can contain addresses from before and after translation. These may be described as original, translated, pre-NAT, post-NAT, inside or outside addresses.
Application and web-server records may include fields such as “client IP”, “remote address”, “forwarded for” or “X-Forwarded-For”.
These can help show an address reported by an earlier system in the connection chain. However, their meaning depends on how the service is configured and whether the intermediary that supplied the value is trusted.
A forwarded-address field shouldn't automatically be treated as the true originating address. In some circumstances, values can be supplied or manipulated by the connecting client.
The relevant IP address therefore depends on the question being asked.
Are you trying to identify the connection that contacted a service? The server’s source or trusted client-address field may matter.
Are you examining traffic leaving a local network? The internal source address may identify the local device, while the translated public address identifies the external connection.
Are you trying to identify the system contacted? The destination address may be the relevant one.
Before using any address, establish what the field is called, which system recorded it, where that system sat in the communication and whether any translation or intermediary was involved.
When a record contains several IP addresses, the correct one isn't necessarily the first—or the one labelled “source”. It is the address that genuinely answers the particular question being investigated.