There are all sorts of ways in which a routable ip address can be shared. At the most basic, a pair of routers or load-balancers sharing a virtual ip using CARP. And you can do weird and wacky things if you control an entire routable netblock ( /24 or larger) using bgp to tell different peers to route it to different gateways etc.
Most of the time you can get away with thinking of an address as being tied (at least temporarily) to a particular location. But once you throw in things like NAT and proxying and the like... That abstraction starts to look more and more sieve-like.
An ip address in a web-servers logs isn't going to tell you much, for one thing it's probably not the address of a specific device; it's going to be the address of a gateway that does address translation for a private subnet; for another, what happens if the machine on the client end of the transaction is acting as a proxy for the real eventual destination of that stream of bits?
In digital forensics, an IP is only one piece of evidence; you need to be able to assemble lots of pieces to get a complete picture.
Comments
There are all sorts of ways in which a routable ip address can be shared. At the most basic, a pair of routers or load-balancers sharing a virtual ip using CARP. And you can do weird and wacky things if you control an entire routable netblock ( /24 or larger) using bgp to tell different peers to route it to different gateways etc.
Most of the time you can get away with thinking of an address as being tied (at least temporarily) to a particular location. But once you throw in things like NAT and proxying and the like... That abstraction starts to look more and more sieve-like.
An ip address in a web-servers logs isn't going to tell you much, for one thing it's probably not the address of a specific device; it's going to be the address of a gateway that does address translation for a private subnet; for another, what happens if the machine on the client end of the transaction is acting as a proxy for the real eventual destination of that stream of bits?
In digital forensics, an IP is only one piece of evidence; you need to be able to assemble lots of pieces to get a complete picture.