172.16.3.6 - how this could be a wan ip ?

[unkn0wnm3]

Hi folks, i saw this ip adress on my web pages visitor logs, how this could be?

Is this mean ip spoofing?

Thanks in advance..

 

[bilbus]

Yes, but also some cable providers use private IPs for their modems.
Comcast used to do that ... you used to be able look at other peoples cable modems by typing 10.x.x.x. But they no longer do that. And it was not a wan IP, it was a ip used by the modem only.

 

[unkn0wnm3]

But i have seen 5 different ips which starts with 172., and as far as i know this is a lan ip, are those ips trackable?

 

[tyttebøvs]

How do you read the ip address?

It is possible to include the ip in a http header. This header can contain whatever ip possible, even fake ones. If the user sits behind a proxy, it might put such a header on the http request, so you get his private ip.

Btw, only 172.16.0.0 - 172.31.255.255 are private

 

[unkn0wnm3]

So, shall i use "HTTP_X_FORWARDED_FOR" command to get real ip?

 

[tyttebøvs]

That is the header that can contain an internal ip or just be spoofed for fun. So you don't use that now?

If you read the actual ip address (contained in the ip header) of the sender, it might have come from an internal network at your www-host.

 

[unkn0wnm3]

So, can i also do same trick (if it's a trick) to hide my real ip?

 

[bilbus]

Well, what was the whole IP?

172.x.x.x is a valid IP unless it falls into this range

172.16.0.0 – 172.31.255.255

I agree .. perhaps they are behind a proxy (or nat router), and they are passing the private ip along with the external. Are there 2 IPs?

 

[unkn0wnm3]

Nope they are all single ips; 172.16.3.6, 172.16.39.89, 172.16.0.14.

 

[bilbus]

No idea.