Does an IP address identify a particular device?¶
Sometimes - but only within the right network records. A public IP address seen by an online service will more often identify a connection or shared gateway than one particular device.
The useful distinction
The IP address tells you about a network point. Other records may then connect that point to a device.
Follow one laptop through the layers¶
Dave opens a web page on his laptop over home Wi-Fi. The website records the router's public address. Dave's router sees a private address for the laptop. Each record describes the activity from a different observation point.
| Evidence layer | Example record | What it may identify |
|---|---|---|
| Online service | source_ip=198.51.100.24 at the event time | The public connection or shared gateway seen by the service |
| Router or managed gateway | Public connection mapped to 192.168.1.37 | A private address on that local network |
| DHCP/Wi-Fi system | 192.168.1.37 assigned or associated with device ID DEV-8A21 | A device association during a stated period |
| Device/account evidence | Browser event, account session or examined artefact | A further link to use or control, subject to its own evidence |
The public address starts the route. The local records are what can narrow it towards a device.
Inside a local network¶
A laptop on home or workplace Wi-Fi may receive a private IP address from the local network. That address can change and may be reused by another device later.
Local router, Wi‑Fi or address-allocation records may connect the private address and time with a particular device. This works only if the recording system could see the internal network.
What an online service sees¶
Across the internet, the same laptop will normally appear under the network’s public IP address. NAT allows many devices to share that address. CGNAT can extend the sharing across several customers.
The public address may therefore cover phones, laptops, televisions, servers and other connected devices. It is not a permanent device serial number.
IPv6 does not automatically solve this. A device may hold several IPv6 addresses, including temporary ones.
How to narrow it to a device¶
Start with the observation point and time, then look for records that bridge the gap:
- local address-allocation records;
- Wi‑Fi association or authentication records;
- firewall, proxy or NAT records;
- device-management and asset records;
- account access records; and
- examination of the relevant device.
For a home connection, the subscriber result may first take you only to the customer connection. For a workplace or public network, the useful device records are often held inside the organisation.
The practical conclusion¶
Describe the result at the level it actually reaches: public connection, local address, network session or device. Then use the next record to move forward.
Established: a record may connect an event to a public connection, a private address or a device association at a stated time.
Still open: who operated the device and who was responsible for the event.
