In the context of the article, the "it" in "whenever it is used to access the internet." refers to the computer that you're using, not your gateway or some proxy machine.
Also, it's not true that an IP address is only assigned to one computer at a time; the IP address 10.0.0.1 is assigned to a whole lot of computers right now. You and I know that, and understand why it's true, but the article implies (pretty directly) that an IP address is a unique identifier for a computer. Which is a widely-believed falsehood that drives me crazy.
10.0.0.1 isn't actually an unqualified "IP address", though; it's specifically a virtual IP address, which should really be dichotomous to "real" IP addresses, not considered a subset of them.
Besides, they never said globally unique. Your IP uniquely identifies you to whatever network you're participating on, the same way your username uniquely identifies you to whatever website you're logging into.
Alternate ending: In the context of the article, they were talking about tracing people via their IPs, as recorded in the logs of Internet-routable ("public facing") servers. The only kinds of IPs such a log would record are other real IPs; there's no real way it could see a virtual IP. Thus, whatever is in the log is "good enough" for pointing the finger at someone, whether that someone is a person, a company, or an ISP. The goal of such a trace is to pass the buck, not to catch the person yourself.
There are all sorts of ways in which a routable ip address can be shared. At the most basic, a pair of routers or load-balancers sharing a virtual ip using CARP. And you can do weird and wacky things if you control an entire routable netblock ( /24 or larger) using bgp to tell different peers to route it to different gateways etc.
Most of the time you can get away with thinking of an address as being tied (at least temporarily) to a particular location. But once you throw in things like NAT and proxying and the like... That abstraction starts to look more and more sieve-like.
An ip address in a web-servers logs isn't going to tell you much, for one thing it's probably not the address of a specific device; it's going to be the address of a gateway that does address translation for a private subnet; for another, what happens if the machine on the client end of the transaction is acting as a proxy for the real eventual destination of that stream of bits?
In digital forensics, an IP is only one piece of evidence; you need to be able to assemble lots of pieces to get a complete picture.
Comments
In the context of the article, the "it" in "whenever it is used to access the internet." refers to the computer that you're using, not your gateway or some proxy machine.
Also, it's not true that an IP address is only assigned to one computer at a time; the IP address 10.0.0.1 is assigned to a whole lot of computers right now. You and I know that, and understand why it's true, but the article implies (pretty directly) that an IP address is a unique identifier for a computer. Which is a widely-believed falsehood that drives me crazy.
10.0.0.1 isn't actually an unqualified "IP address", though; it's specifically a virtual IP address, which should really be dichotomous to "real" IP addresses, not considered a subset of them.
Besides, they never said globally unique. Your IP uniquely identifies you to whatever network you're participating on, the same way your username uniquely identifies you to whatever website you're logging into.
Alternate ending: In the context of the article, they were talking about tracing people via their IPs, as recorded in the logs of Internet-routable ("public facing") servers. The only kinds of IPs such a log would record are other real IPs; there's no real way it could see a virtual IP. Thus, whatever is in the log is "good enough" for pointing the finger at someone, whether that someone is a person, a company, or an ISP. The goal of such a trace is to pass the buck, not to catch the person yourself.
There are all sorts of ways in which a routable ip address can be shared. At the most basic, a pair of routers or load-balancers sharing a virtual ip using CARP. And you can do weird and wacky things if you control an entire routable netblock ( /24 or larger) using bgp to tell different peers to route it to different gateways etc.
Most of the time you can get away with thinking of an address as being tied (at least temporarily) to a particular location. But once you throw in things like NAT and proxying and the like... That abstraction starts to look more and more sieve-like.
An ip address in a web-servers logs isn't going to tell you much, for one thing it's probably not the address of a specific device; it's going to be the address of a gateway that does address translation for a private subnet; for another, what happens if the machine on the client end of the transaction is acting as a proxy for the real eventual destination of that stream of bits?
In digital forensics, an IP is only one piece of evidence; you need to be able to assemble lots of pieces to get a complete picture.